Release of Information Form for Mental Health: Free Template

Last updated: September 2026

What You Need to Know About Release of Information Forms for Mental Health

• A release of information form for mental health is a HIPAA authorization that lets a practice share client records.
• HIPAA says a valid authorization must contain six core elements and three required statements (45 CFR 164.508).¹
• Use one form for the clinical record and a separate form for psychotherapy notes, then have counsel review both.

Which Records Can a Mental Health Release of Information Form Cover?

A mental health release of information (ROI) form covers the clinical record. That record includes diagnosis, treatment plan, test results and progress notes in the chart. Three kinds of records or requests need a different path.

• Psychotherapy notes. These need a separate authorization.¹
• Substance use disorder program records. Records from a federally assisted substance use disorder (SUD) treatment program follow 42 CFR Part 2 consent rules. Compliance with the updated Part 2 rule was required by February 16, 2026.²
• A client's request for their own records. This is usually a right of access request with its own rules.

State confidentiality laws or professional ethics may set stricter limits on sharing mental health information.³

What Should a Release of Information Form for Mental Health Include?

A release of information form for mental health should include nine HIPAA items, each in its own labeled section.¹

1. Information to release (Section 4). Describe the records in a "specific and meaningful fashion."¹ Checkboxes list record types, and psychotherapy notes stay off this form.
2. Who releases it (Section 2). Name the practice or clinician who will share the records.¹
3. Who receives it (Section 3). Name the person or group who will get the records.¹
4. Purpose (Section 5). Describe each reason for the release. When the client starts the request, "at the request of the individual" is enough.¹
5. End date or event (Section 6). Write the date or the event that ends the authorization.¹
6. Signature and date (Section 8). The client signs and dates it. If a parent, guardian or other personal representative signs, the form must describe their authority.¹
7. Right to take it back (Section 7). State that the client can take back the authorization in writing. Add the exceptions and how to do it, or refer to your notice of privacy practices.¹
8. Care does not depend on signing (Section 7). State whether treatment, payment, enrollment or eligibility for benefits can depend on signing.¹
9. Sharing again (Section 7). Warn that the recipient may share the records again, and HIPAA may no longer protect them.¹

The form must be written in plain language.¹ When your practice asks a client to sign, give the client a copy of the signed form.¹ Keep the signed form for six years from the date it was created or last in effect, whichever is later (45 CFR 164.530(j)).⁴

HIPAA's list leaves out two items that some forms include.

• A maximum length. HIPAA sets no federal limit on how long an authorization lasts.¹ Your state may set one, so check your state's rules.
• A reproductive health attestation. A federal court vacated most of the 2024 HIPAA reproductive health privacy rule on June 18, 2025.⁵ Verify the current status with your legal counsel.

For releases outside behavioral health, use a general HIPAA authorization form.

Why Do Psychotherapy Notes Need a Separate Authorization?

HIPAA requires an authorization before psychotherapy notes are shared for almost any reason, including with another treating provider.⁶ That authorization can be combined only with another psychotherapy notes authorization.¹ A psychotherapy notes checkbox on the general release form would break that rule.¹

• What counts. HHS defines psychotherapy notes as a mental health professional's notes that record or analyze the conversation in a private, group, joint or family counseling session.⁶ To count, the notes must be kept separate from the rest of the client's medical record.⁶
• Narrow exceptions. The clinician who wrote the notes can use them to treat the client.¹ Other exceptions include the practice's own supervised training programs and its defense in a legal action the client brings.¹ A few disclosures that other HIPAA rules require or permit are also exempt.¹
• No HIPAA right of access. HIPAA's right of access has an exception for psychotherapy notes, for clients and their personal representatives.³
• Information blocking. The Office of the National Coordinator for Health Information Technology (ONC) says information blocking rules leave these notes out of electronic health information.⁷ ONC adds that the test is whether a note meets HIPAA's definition, whatever type of mental health professional wrote it.⁷

A note written into the chart is part of the clinical record, which the general release form covers. Only notes kept apart from the record can meet the definition.⁶ Keep those notes separate with a psychotherapy notes template.

How Do You Fill Out a Mental Health ROI So It Stays Valid?

Fill in every core element, give the client a copy, and check any form you receive before you send records.

1. List record types and dates. Check each record type and add a date range. A line that says only "all records" may not meet HIPAA's "specific and meaningful" standard.¹
2. Name the recipient and method. Add contact details, then mark written records, verbal discussion or both.
3. Pick a purpose. Check a purpose, or check "At my request" when the client starts the release.
4. Describe a representative's authority. Parents of minors are generally their personal representatives.⁸ Exceptions can apply when state law lets a minor consent to their own care, or when the minor may be endangered.³ Requirements vary by state, so check your state's rules.
5. Give a copy and log releases. Give the client a copy when your practice asked for the signature.¹ Log each release in Section 9.
6. Log any revocation. A written revocation does not undo releases already made in reliance on the form.¹

Before you send records on someone else's form, check it for HIPAA's five defects. Any one of them makes the form invalid.¹

• It has expired, or you know its end event has happened.
• A required element is missing or left blank.
• You know the client took it back.
• It wrongly combines authorizations, such as psychotherapy notes with other records, or wrongly makes care depend on signing.
• You know that key information on it is false.

A form signed by a representative with no description of their authority is missing a core element.¹

When Is an ROI the Wrong Form for Mental Health Records?

Skip the ROI when HIPAA already permits the disclosure, when clients want their own records, or when Part 2 rules apply.

Sharing That Needs No Authorization

HIPAA permits three kinds of sharing without a signed release.³

• Treatment and care coordination. Providers may share the medical record with other providers for treatment and care coordination.³ Psychotherapy notes still need an authorization.⁶
• Family and others involved in care. A provider may talk with people involved in the client's care if the client does not object.³ If the client cannot agree, the provider may use professional judgment about the client's best interests.³
• Serious and imminent threats. A provider may warn people who can prevent or lessen a serious and imminent threat, consistent with applicable law and ethics.³

A Client's Own Records Request

A client's request for their own records falls under the HIPAA right of access (45 CFR 164.524). An authorization only permits sharing, but access requires it, with some exceptions.⁹ The practice must act on an access request within 30 days.¹⁰

Clients can also have a copy sent to a person they name through a signed, written request.⁹ When clients ask for their own copy, HIPAA limits the fee to a reasonable, cost-based amount.¹⁰

Part 2 Records

42 CFR Part 2 rules apply to records from a federally assisted SUD treatment program, including Part 2 records a practice receives.²

• Single consent. One consent can cover all future treatment, payment and health care operations.²
• Separate consents. SUD counseling notes need their own consent.¹¹ Consent for legal proceedings cannot be combined with any other.²
• Each disclosure. Include a copy of the consent or a clear explanation of its scope with each one.²

Use a Part 2 consent for these records in place of this HIPAA template. Talk to your legal counsel before you respond to a subpoena, court order or attorney letter.

Requirements vary by state, so have counsel review your forms. For wider privacy tasks, use a HIPAA compliance checklist.

How Does Commure Scribe Support Mental Health Record Keeping?

Clients sign release forms outside the session, and the records those forms release start as session notes. For behavioral health sessions, those notes can start as a draft from Commure Scribe.

Within seconds of ending the recording, a structured SOAP note appears and suggested ICD-10 and CPT codes are generated. The clinician edits and approves the note before it enters the chart. While the note drafts, the clinician can stay present in the room with the client.

Keep psychotherapy notes apart from the drafted chart note, since the general release form covers the chart. Audio is stored and encrypted. It is not used for AI training or any purpose other than generating the clinical note.

Keep session records ready to release

Commure Scribe drafts each therapy session note from the conversation. The clinician can review and approve it before a records request arrives. You can try it for 7 days without a credit card, or see current Commure Scribe plans.

This article is for informational and educational purposes only, does not constitute legal, medical, or professional advice, and does not guarantee compliance with HIPAA.

‍