New York HIPAA Release Form: Authorize the Release of Your Medical Records

Understanding the OCA Official Form No. 960

The OCA Official Form No. 960 is New York’s standard authorization used to permit a healthcare provider to disclose your protected health information (PHI) to a person or organization you specify. It is designed to meet HIPAA authorization requirements while also addressing New York medical records law and sensitive categories of information.

You use this form when you want records sent to a third party—such as an attorney, insurer, school, or family member—or when a provider requires a formal authorization before releasing information. The form does not force you to share everything; you decide exactly what information moves, to whom, for what purpose, and for how long.

What the form covers

• Who may disclose and who may receive your records, identified by name and contact details.
• What may be disclosed, with the ability to limit by document type, date range, or episode of care.
• Purpose of the disclosure (for example, insurance claim, legal matter, or personal use).
• Expiration date or event so the authorization automatically ends.
• Your right to revoke the authorization at any time in writing.

Sensitive information checkboxes

The form includes explicit options to authorize or withhold particularly sensitive categories—such as alcohol or substance use treatment records, mental health information, genetic testing results, and HIV-related information. You must actively authorize these; otherwise, they remain protected under strengthened healthcare provider disclosure rules.

Who can sign

You sign for yourself if you are an adult with capacity. A personal representative may sign when appropriate, such as a parent or guardian for a minor, an agent under a health care proxy, an executor for an estate, or an attorney-in-fact if the power of attorney medical records authority is clearly granted. If a representative signs, the form typically asks for the basis of that authority.

Best practices when completing Form 960

• Disclose only what is needed; narrow the date range and document types.
• Direct electronic copies when possible to reduce processing time and cost-based copying fees.
• Set a short expiration date if the disclosure purpose is time-limited (for example, a single claim or court date).
• Keep a copy of the signed form and any revocation you later send.

Accessing Medical Records under HIPAA

HIPAA gives you strong patient access rights to inspect or receive copies of your medical records maintained by covered entities. You can choose paper or electronic format when readily producible, and you may direct the provider to transmit records to a third party you designate.

Providers generally must respond within 30 days of your request. If they need an extension, they must notify you in writing and may take only one additional 30-day period. Reasonable identity verification is permitted, but providers cannot impose unreasonable barriers or require you to state a reason for your request.

What HIPAA allows and requires

• You may obtain a complete copy of your designated record set, including lab results, imaging reports, discharge summaries, visit notes, and billing records.
• Fees must reflect only allowable, cost-based copying fees—labor for copying, supplies, postage, and an optional summary if you request it.
• Per-page fees are not permitted for electronic copies from an electronic health record; providers should calculate actual cost or use a compliant flat-fee method.
• Healthcare provider disclosure rules allow certain disclosures without your authorization (for treatment, payment, and health care operations), but these do not limit your right of access.

Limits to access under HIPAA

• Psychotherapy notes confidentiality: psychotherapy notes kept separate from the medical record are excluded from the right of access and require a separate, specific authorization to be disclosed.
• Information compiled for use in a civil, criminal, or administrative action or proceeding may be withheld.
• Certain laboratory data may have special rules, but most final results are accessible to you.

Requesting Medical Records in New York

To send records to another person or organization, complete the OCA Official Form No. 960. If you are requesting copies for yourself, many providers accept a simple written request, a patient portal request, or their own standard HIPAA form—so long as it meets HIPAA authorization requirements when an authorization is required.

Step-by-step process

1. Identify the records you need. Specify date ranges, document types (for example, “operative report” or “complete chart”), and preferred format (PDF via secure email, portal download, or paper).
2. Choose the correct signer. If a representative signs, attach proof of authority (health care proxy, guardianship papers, or power of attorney medical records authorization).
3. Complete and sign Form 960 for third-party disclosures. Initial sensitive categories you want included and leave others blank to keep them excluded.
4. Submit the request. Send it through the provider’s portal, secure email, fax, mail, or in person, following their instructions for identity verification.
5. Track the timeline. Under HIPAA, you should receive the records within 30 days, or a written notice explaining a single 30-day extension.

New York medical records law works alongside HIPAA. Providers commonly use Form 960 across hospitals, clinics, and law offices because it’s widely recognized, easy to process, and tailored to New York-specific consent rules for sensitive information.

Fees Associated with Medical Record Copies

Under HIPAA, providers may charge only reasonable, cost-based copying fees. Allowable components include labor for copying (not searching or retrieving), the cost of supplies (for example, a USB drive or paper), postage if you request mail, and a summary or explanation only if you ask for one.

For electronic records produced from an electronic health record system, HIPAA does not allow per-page fees. Providers may calculate actual costs or use a compliant flat-fee option for standard requests. Reviewing your record on-site is not subject to a copying fee, though providers may manage scheduling and supervision for privacy and security.

New York medical records law may set specific limits for paper copies and contains circumstances in which fees are reduced or prohibited, particularly for requests tied to certain public benefit claims or other protected situations. When in doubt, ask the provider for a written estimate and an explanation of how the cost-based fee was calculated.

Exceptions to Medical Record Disclosure

Even with a signed authorization, some information is protected by heightened rules or may be limited to protect safety. Understanding these boundaries helps you craft precise requests and avoid delays.

Common exceptions and special protections

• Psychotherapy notes confidentiality: these are separate provider notes documenting or analyzing session conversations; they are excluded from routine access and require a specific authorization, and providers may decline to release them.
• Substance use disorder records: federal confidentiality rules (42 CFR Part 2) require explicit consent and contain strict redisclosure limits.
• HIV-related information and genetic testing: New York law requires specific authorization language; on Form 960, you must actively authorize these categories.
• Mental health records: portions may be withheld if a licensed professional determines release would likely cause substantial harm to you or another person; limited review and appeal mechanisms may apply.
• Another person’s PHI: records are redacted to protect third-party confidentiality unless that person consents or disclosure is otherwise permitted by law.

Legal Authority for Medical Record Release

Two frameworks govern most requests. First, HIPAA’s Privacy Rule defines your right of access, sets healthcare provider disclosure rules for routine operations, and establishes when a signed authorization is required. Second, New York medical records law—principally Public Health Law provisions and related regulations—adds state-specific requirements for consent, fees, and sensitive categories like HIV-related information.

Other authorities may apply in particular contexts, such as federal substance use disorder confidentiality rules and court or administrative procedure rules governing subpoenas and protective orders. If a personal representative seeks access, their authority flows from New York law (for example, a health care proxy, letters testamentary, guardianship, or power of attorney medical records authorization) and is recognized under HIPAA.

Managing Redisclosure of Health Information

Form 960 includes a redisclosure warning: once information leaves a HIPAA-covered entity and goes to a non-covered recipient, HIPAA may no longer protect it. Some categories—like 42 CFR Part 2 substance use records or certain HIV-related information under New York law—carry additional protections that follow the data, but most records do not.

How to reduce redisclosure risk

• Limit scope. Authorize only the records and dates necessary for the stated purpose.
• Be specific about recipients. Name individuals or departments rather than broad organizations when appropriate.
• Set short expirations. Use an event-based or near-term date so unused authorizations lapse.
• Choose secure delivery. Prefer portal transfer or encrypted email when available.
• Issue instructions. Ask recipients in writing not to redisclose beyond the stated purpose.
• Revoke promptly. If your needs change, send a written revocation to the disclosing provider.

FAQs.

What is the OCA Official Form No. 960?

It is New York’s standard “Authorization for Release of Health Information Pursuant to HIPAA.” You use it to direct a provider to send specified medical records to a named recipient for a stated purpose, with options to include or exclude sensitive categories and an expiration you set.

How can patients request medical records in New York?

If you want records sent to a third party, complete and submit Form 960 to the provider. If you want copies for yourself, submit a written or portal request specifying what you need, your preferred format, and delivery method. Attach proof of identity, and if a representative signs, include documentation of authority.

Are there fees for obtaining medical records?

HIPAA permits only reasonable, cost-based copying fees for producing and sending copies. Electronic copies from an electronic health record cannot be charged per page. New York law may cap paper-copy charges and prohibits or reduces fees in certain circumstances; ask the provider for a written fee calculation before you proceed.

What information is excluded from disclosure?

Psychotherapy notes kept separate from the medical record are excluded from the HIPAA right of access and require a specific authorization. Records compiled for litigation may be withheld. Sensitive categories—like substance use treatment, HIV-related information, and genetic test results—require explicit consent and may carry additional protections and redisclosure limits.