DOH-5173 – Authorization for Release of Health Information Pursuant to HIPAA

Jurisdiction: Country: United States | Province or State: New York

The DOH-5173 – Authorization for Release of Health Information Pursuant to HIPAA is a New York State Department of Health form that allows you to give written permission for your medical information to be shared. It is used when a doctor, hospital, clinic, or other health provider needs your clear authorization before sending your records to someone else.

If you are about to fill out this form, you are likely being asked to approve the release of specific health information. That could include medical records, billing details, test results, or information about treatment. Without your signed authorization, providers often cannot legally share these records.

This document matters because your health information is private. Federal and state privacy laws protect it. The form creates a controlled way for you to decide who gets access, what they receive, and for how long the permission lasts.

Filling it out correctly helps avoid delays. Incomplete or unclear answers can lead to rejection or requests for clarification. Understanding each section before you sign makes the process smoother and reduces the risk of unintended disclosure.

What is DOH-5173 – Authorization for Release of Health Information Pursuant to HIPAA?

Clear definition

DOH-5173 – Authorization for Release of Health Information Pursuant to HIPAA is a written authorization that allows a health care provider or health plan to disclose your protected health information to a person or organization you name. It is a formal permission document required under federal privacy rules and New York State standards.

The form identifies you, the provider releasing the information, the recipient, and the exact records to be shared. It also explains your rights, including your ability to revoke the authorization in most cases.

This document is not a general consent to treatment. It does not allow someone to make medical decisions for you. It only authorizes the release of existing information under specific conditions you define in the form.

Who typically uses this form?

Patients use this form when they want or need their medical information sent to another party. That may include another doctor, an insurance carrier, an attorney, a government agency, or a family member.

Parents or legal guardians may use it on behalf of a minor child. Personal representatives, such as a health care proxy or court-appointed guardian, may also complete it if they have legal authority to act for the patient.

Health care providers rely on this form when responding to requests for records. Before releasing certain sensitive information, they often require a properly completed DOH-5173 – Authorization for Release of Health Information Pursuant to HIPAA.

Why might you need this form?

You may need this form to transfer records to a new doctor. Many providers will not send full records without written authorization, even if you request the transfer verbally.

You might also need it to support a legal matter. Attorneys often request certified copies of medical records to evaluate claims or defend cases.

Insurance companies may require detailed medical information to process disability, life, or long-term care claims. In those situations, they usually ask for a signed authorization before reviewing your history.

You may also use the form to allow a trusted family member to receive updates or copies of records, especially if you are unable to manage communications directly.

Typical real-life scenarios

• You are switching primary care doctors and want your new provider to have your complete medical history. The current office asks you to sign this authorization before sending your chart.
• You were treated at a hospital after an accident and are now working with a lawyer. The law office sends you this form so it can request your emergency room records and follow-up treatment notes.
• Your employer’s disability insurer needs confirmation of a medical condition before approving benefits. The insurer provides the form so your doctor can release specific reports.
• You are applying for certain public benefits, and the agency needs verification of a medical diagnosis. You complete the form to allow your clinic to share limited information with that agency.
• A family member is helping you manage appointments and paperwork during a serious illness. You authorize your provider to release relevant information directly to that person.

When would you use DOH-5173 – Authorization for Release of Health Information Pursuant to HIPAA?

You use DOH-5173 – Authorization for Release of Health Information Pursuant to HIPAA when a provider cannot legally share your records without written permission. Verbal requests are usually not enough for full record disclosure, especially when sensitive information is involved.

This situation often arises when records are being sent outside the original health system. For example, if a hospital is sending records to a private attorney or an insurance company, a signed authorization is commonly required.

You may also use it when requesting your own records to be mailed to your home or another address. While you generally have a right to access your records, providers frequently require a signed form to document that request.

In some cases, researchers, schools, or government agencies request medical documentation. If the disclosure goes beyond basic confirmation of treatment and includes detailed health information, an authorization form is typically needed.

Health care providers, billing departments, compliance staff, and medical records offices are the professionals who process these forms. They review them for completeness before releasing any information.

Legal characteristics of DOH-5173 – Authorization for Release of Health Information Pursuant to HIPAA

This form is designed to meet privacy standards under federal law and New York State requirements. For it to be effective, it generally must clearly identify the patient, specify who may release the information, and name the person or organization that will receive it.

It must describe the information to be disclosed. Broad phrases like “all records” may be accepted in some contexts, but many providers prefer more detail, such as specific dates of service or types of records.

The form usually includes an expiration date or event. Without a defined time limit, a provider may reject the authorization. An expiration event could be a specific date or the conclusion of a claim.

A valid signature and date are essential. If someone signs on behalf of the patient, their authority must be stated. Missing signatures, crossed-out sections, or altered text without initials can cause delays.

New York has additional protections for certain categories of information. These may include mental health records, substance use treatment records, and HIV-related information. The form often requires specific acknowledgment before that information can be released.

This authorization does not transfer decision-making power. It does not create a health care proxy or power of attorney. It does not require the recipient to keep the information confidential beyond what the law independently requires.

Is it legally binding?

Yes, once properly completed and signed, this form is generally legally binding on the provider releasing the information. It authorizes disclosure within the limits described in the document.

The binding effect depends on accurate and complete information. If key sections are left blank or the form is altered, a provider may treat it as invalid and refuse to release records.

You typically have the right to revoke the authorization in writing. However, revocation usually does not affect information already released before the provider received notice of the cancellation.

The form binds only the disclosure described. It does not authorize future unrelated disclosures beyond its stated scope or time frame.

How to fill out DOH-5173 – Authorization for Release of Health Information Pursuant to HIPAA

Step 1 – Enter patient identifying information

Start by writing your full legal name. Include any previous names used in medical records if the form requests them. Add your date of birth and current address as required. This ensures the provider matches the authorization to the correct file.

If the form asks for additional identifiers, such as a medical record number, include them if known. Accurate identification helps prevent delays.

Step 2 – Identify the provider or facility releasing information

Clearly name the hospital, doctor, clinic, or health plan that holds your records. Be specific. If you want records from more than one facility, you may need separate forms unless the document allows multiple entities to be listed.

Check that the name matches how the provider is officially identified in correspondence or billing statements.

Step 3 – Name the person or organization receiving the information

Write the full name and address of the individual or organization that will receive your records. This may be a law office, insurance company, government agency, another medical provider, or a private individual.

If the form allows, include contact details such as a fax number or email. Make sure the information is complete to avoid misdirected records.

Step 4 – Describe the information to be released

Indicate exactly what records may be shared. This may include medical charts, laboratory results, imaging reports, billing records, or specific date ranges of treatment.

If you are authorizing the release of sensitive categories of information, review the section carefully. Some parts of the form require you to place initials or check boxes to confirm that you understand the nature of the information being disclosed.

Be clear about time frames. If you only need records from a certain period, state the beginning and end dates.

Step 5 – State the purpose of the disclosure

Many versions of this form ask for the reason the information is being released. You might write that it is for insurance review, legal evaluation, transfer of care, or personal use.

The purpose statement helps document why the disclosure is occurring. Keep the description short and accurate.

Step 6 – Review the expiration section

Enter the expiration date or event that ends the authorization. This could be a specific calendar date or a defined event, such as the conclusion of a claim.

Make sure the expiration is clear. Open-ended authorizations may be questioned or rejected.

Step 7 – Read the rights and acknowledgment section

Carefully review the statements explaining your rights. These often include your ability to revoke the authorization and the potential for re-disclosure by the recipient.

Understanding this section helps you know the limits of the form. Once information is released, it may no longer be protected in the same way by the original provider.

Step 8 – Sign and date the form

Sign your full legal name where indicated. Enter the date of your signature. If you are signing on behalf of the patient, state your relationship or legal authority, such as parent, guardian, or personal representative.

Check that every required line is completed before submitting the document. A missing signature or date is one of the most common reasons for processing delays.

Legal terms you might encounter in DOH-5173 – Authorization for Release of Health Information Pursuant to HIPAA

1. Protected Health Information (PHI): This means any health information that identifies you and relates to your physical or mental health, treatment, or payment for care. On this form, you are authorizing the release of specific PHI. The form often asks you to describe exactly which PHI can be disclosed.
2. Disclosing Provider: This is the doctor, hospital, clinic, or other health care entity that currently holds your medical records. You must clearly name this provider so they know they are authorized to release information. If the name is wrong or incomplete, the request may be rejected.
3. Recipient: The recipient is the person or organization that will receive your health information. This could be an attorney, insurance company, employer, school, or another health care provider. The form requires a specific name and address so the provider knows exactly where to send the records.
4. Authorization: An authorization is your written permission allowing your health information to be shared. Without your signed authorization, most providers cannot release your records. This form serves as that formal, written permission.
5. Expiration Date or Event: The form asks when your authorization will expire. This can be a specific date or a defined event, such as the conclusion of a legal case. After that date or event, the authorization is no longer valid.
6. Revocation: Revocation means you can cancel your authorization in writing at any time. The form explains how to do this. However, revocation does not undo disclosures that were already made before the provider received your cancellation.
7. Redisclosure: This term refers to what happens after your information is released. Once the recipient receives your records, they may no longer be bound by the same privacy rules. The form warns you that redisclosed information may not be protected under federal privacy law.
8. Sensitive Information: Some health records include especially private information, such as mental health treatment, substance use treatment, or HIV-related information. The form may require you to specifically initial or check boxes to authorize release of these categories. If you do not clearly authorize them, they will not be released.
9. Personal Representative: A personal representative is someone legally authorized to sign for you. This could be a parent of a minor child, a legal guardian, or someone with valid power of attorney. If a personal representative signs, the form usually requires a description of their authority.

FAQs

Do I have to use DOH-5173 – Authorization for Release of Health Information Pursuant to HIPAA, or can I write my own letter?

Many providers require a specific authorization form to make sure all legal elements are included. If a provider asks for this document, it is usually faster and safer to complete it instead of writing your own letter. The form includes required statements about expiration, revocation, and redisclosure that a simple letter might leave out.

What information do I need to gather before completing this form?

You need your full legal name, date of birth, current address, and possibly a patient or medical record number. You also need the full name and address of the provider releasing the records and the exact name and address of the person or organization receiving them. Be ready to describe what records you want and choose an expiration date or event.

Can I limit the records being released to certain dates or treatments?

Yes. This document allows you to describe specific date ranges, types of treatment, or particular records. If you only want records from a certain year or related to one condition, you should clearly write that in the section describing the information to be released.

What happens if I forget to sign or date the authorization?

If you do not sign and date it, the provider will not process your request. A missing signature or date makes the form invalid. Always check the signature line before submitting DOH-5173 – Authorization for Release of Health Information Pursuant to HIPAA to avoid delays.

Can someone else sign this document for me?

Yes, but only if they have legal authority to act for you. They must state their relationship to you and describe their authority, such as being a parent, guardian, or agent under a power of attorney. Some providers may ask for proof of that authority.

How long is this authorization valid?

It stays valid until the expiration date or event you list on the form. If you leave the expiration section blank, the provider may reject the form or apply a default rule stated in the document. Always review that section and make sure it reflects your intent.

Can I cancel the authorization after I submit it?

Yes. You can revoke it in writing. Your revocation becomes effective once the provider receives it, but it does not affect records already released before that date.

Will signing this form affect my treatment or insurance coverage?

No. You cannot be denied treatment or benefits simply because you refuse to sign an authorization for disclosure, unless the disclosure is necessary for specific services. The form explains that signing is generally voluntary.

Checklist: Before, During, and After DOH-5173 – Authorization for Release of Health Information Pursuant to HIPAA

Before

• Confirm exactly which provider holds the records you need.
• Verify the correct legal name and address of that provider.
• Identify the full name and mailing address of the recipient.
• Decide what records you want released and for what date range.
• Determine whether sensitive information needs special authorization.
• Choose a clear expiration date or event.
• Gather documents proving authority if you are signing for someone else.
• Review any deadlines related to a lawsuit, claim, or application.

During

• Print clearly or type to avoid misreading.
• Enter your full legal name as it appears in medical records.
• Double-check spelling of provider and recipient names.
• Be specific when describing the information to be released.
• Mark or initial boxes for sensitive categories if needed.
• Fill in the purpose of the disclosure, even if it is “at my request.”
• Complete the expiration section carefully.
• Sign and date the form in the correct place.
• Include your relationship and authority if signing as a representative.

After

• Make a complete copy of the signed form for your records.
• Submit the form using the provider’s accepted method.
• Note the date you delivered or mailed it.
• Request confirmation that the form was received.
• Track expected processing times.
• Follow up if you do not receive a response within a reasonable period.
• Keep copies of any records that are sent out.
• Store the authorization with your important medical or legal papers.

Common mistakes to avoid with DOH-5173 – Authorization for Release of Health Information Pursuant to HIPAA

• Mistake: Leaving sections blank because you think they are optional, which happens when instructions are skimmed, leading to rejection of the form, so do not forget to complete every required field.
• Mistake: Writing “all records” without considering sensitive categories, which happens when you rush, and may result in more information being released than intended, so do not forget to review and limit the scope if needed.
• Mistake: Using nicknames or outdated addresses, which happens when you rely on memory, causing delays or mismatched records, so do not forget to verify your current legal name and contact details.
• Mistake: Failing to include proof of representative authority, which happens when a parent or agent assumes it is obvious, leading to refusal to process the request, so do not forget to attach supporting documents if required.
• Mistake: Choosing an unrealistic expiration date, which happens when you guess without checking deadlines, causing the authorization to expire too soon, so do not forget to align the date with your actual needs.
• Mistake: Forgetting to keep a copy of the signed form, which happens when you focus only on submission, making it harder to prove what you authorized, so do not forget to store a complete copy for your records.
• Mistake: Sending the form to the wrong department, which happens when large facilities have multiple offices, delaying processing, so do not forget to confirm the correct mailing address or fax number.
• Mistake: Not following up after submission, which happens when you assume processing is automatic, potentially missing deadlines, so do not forget to track and confirm receipt.

What to do after filling out DOH-5173 – Authorization for Release of Health Information Pursuant to HIPAA

Once you complete the form, pause before sending it. Review every entry line by line. Make sure names, addresses, and dates are correct. Confirm that you clearly described the records you want released. Small errors can cause long delays.

Make at least one full copy of the signed authorization. Keep that copy in a safe place. If the records relate to a legal case or insurance claim, store the copy with your case file.

Submit the form according to the provider’s instructions. Some accept mailed originals. Others accept faxed or scanned copies. Use the method they specify to avoid rejection.

• Step 1: Deliver the form to the correct provider or records department using the approved submission method.
• Step 2: Record the date of submission and the name of any staff member you spoke with.
• Step 3: Request written or email confirmation that your authorization was received and is being processed.
• Step 4: Ask about the expected processing time and whether fees apply for copying or mailing records.
• Step 5: Mark your calendar with a follow-up date if you do not receive records within the expected timeframe.
• Step 6: Review any records you receive to ensure they match the date range and categories you authorized.
• Step 7: Contact the provider promptly if records are missing or incorrect.
• Step 8: If your situation changes, send a written revocation to cancel the authorization going forward.
• Step 9: Update your personal records to reflect who received your health information and when.
• Step 10: Store all related correspondence, copies of records, and proof of submission together for future reference.

Being organized after submission protects you. It helps you meet deadlines, track disclosures, and respond quickly if questions arise about what you authorized.