Your written permission slip: a HIPAA authorization naming who shares, who receives, what records, the purpose, and an expiration - and the scope is yours to set, so narrow over-broad requests ("all records") to what the situation actually needs before signing.
Other rules: revoke in writing anytime going forward; treatment usually cannot be conditioned on signing; and doctor-to-doctor transfers often happen through the new office without the formal form. Whatever the signed form covers is fair game - that is why the scope line matters most.
What to do
Common questions
What is a medical record release form?
A medical record release form - formally a HIPAA authorization - is your written permission for a provider to share your records with a named person or organization. What it must contain to be valid: who is authorized to share, who may receive, WHAT information (this is the scope you control - "orthopedic records from 2024" versus "all records"), the purpose, an expiration, and your signature. The power you hold: scope - requests often arrive over-broad by default (a lawyer or insurer asking for "all records" when the situation concerns one injury); you can narrow it before signing, and you should, because whatever the form covers is fair game. Other rules worth knowing: you can revoke an authorization in writing at any time going forward (what was already sent stays sent); treatment cannot be conditioned on signing an authorization in most cases; and the receiving party is whoever you name - records sent to your new doctor, a lawyer, an insurer, or a school each travel under your signature. For simple transfers between doctors, a request through the new office usually handles it without the formal form. Pymander, a free AI doctor available 24/7 by text, can help you scope a specific request.