NY HIPAA Authorization Form: New York–Compliant Template & How to Fill It Out

Overview of New York HIPAA Authorization Forms

New York uses several standardized authorizations to let you direct who may access and share your protected health information (PHI). These New York–compliant forms incorporate federal HIPAA rules and state privacy protections that cover sensitive categories such as mental health, substance use disorder, HIV-related information, and genetic testing.

In practice, you will most often encounter four forms: OCA Official Form 960 issued by the New York State Office of Court Administration for litigation-related disclosures; HIPAA-1 for Workers’ Compensation Board claims; DOH-5173 for general health information releases; and OMH-11C for mental health information release from facilities overseen by the Office of Mental Health. Each serves the same core goal—Protected Health Information Authorization—while tailoring details to its setting and HIPAA release procedures in New York.

You may also see employer or plan administrator documents, such as Flexible Spending Account HIPAA forms, which collect the same required elements so plan staff can verify expenses without violating your privacy.

Key Components of NY HIPAA Authorization

Core elements you must include

• Patient identifiers: full name, date of birth, and another unique identifier (address or last four digits of SSN are common).
• Discloser and recipient: name the provider or facility authorized to release records and the person(s) or organization(s) allowed to receive them.
• Specific description and date range: list the exact records (for example, office notes, imaging, lab results, billing) and the service dates covered.
• Purpose of disclosure: e.g., “at my request,” “litigation,” “workers’ compensation claim,” or “benefit administration.”
• Expiration: a calendar date or event (for example, “end of treatment,” “final resolution of claim”).
• Signature and authority: your signature and date; if a personal representative signs, state the relationship and attach authority (e.g., health care proxy, guardianship).

Sensitive categories under New York law

New York requires heightened consent for certain data. Most forms use separate checkboxes and patient initials to authorize release of:

• Mental health records (psychotherapy notes often require a separate, specific authorization).
• Substance use disorder treatment records (subject to additional federal protections).
• HIV-related information and sexually transmitted infection data.
• Genetic test results and reproductive health services.

Your rights and compliance notes

• You can revoke your authorization in writing at any time, except to the extent action has already been taken in reliance on it.
• Disclosures may be limited to the minimum necessary. Ask for narrower date ranges or document types to uphold health information privacy compliance.
• Some recipients (e.g., insurers, employers, plan administrators) may redisclose information unless prohibited by law; many New York forms include required warnings restricting redisclosure of specially protected data.

How to Complete the OCA Official Form 960

OCA Official Form 960 is the New York State Office of Court Administration’s standard “Authorization to Release Medical Information Pursuant to HIPAA.” It is widely used in litigation, subpoenas, and other court-related disclosures.

Step-by-step

1. Patient information: enter your legal name, date of birth, and contact details.
2. Disclosing provider/facility: name each provider, hospital, or practice authorized to release records. If needed, list multiple providers.
3. Recipient: identify the person, law firm, insurer, or other party permitted to receive the information. Include addresses for clarity.
4. Describe the records precisely: specify categories (e.g., progress notes, imaging, operative reports, billing ledgers) and the date range. Avoid “any and all” unless necessary.
5. Purpose of disclosure: select or write a purpose (for example, “at my request” or “for pending personal injury litigation”).
6. Sensitive categories: check and initial boxes to authorize release of mental health, substance use disorder, HIV-related, or genetic information if you want them disclosed.
7. Expiration: provide a date or event (for instance, “one year from today” or “conclusion of litigation”).
8. Signature: sign and date. If a personal representative signs, state the relationship and attach supporting documentation.

Practical tips

• Match provider names to how they appear in your records to reduce processing delays.
• Use a narrow date range tied to the incident or condition at issue.
• Request a copy of the signed authorization for your files.

Using Form HIPAA-1 for Workers’ Compensation

Form HIPAA-1 authorizes disclosures needed to administer New York Workers’ Compensation Board claims. It allows treating providers, hospitals, and diagnostic facilities to share work‑related medical information with the WCB, your employer or its insurer/TPA, and other participants such as independent medical examiners and attorneys.

How to fill HIPAA-1 effectively

1. Claimant details: provide your name, date of birth, and contact information.
2. Injury specifics: include the date of injury and, if known, the WCB case number and insurer/carrier claim number.
3. Authorized disclosers: list your treating providers and facilities. Add diagnostic centers if imaging or tests are relevant.
4. Authorized recipients: typically the WCB, employer, carrier/TPA, treating and IME physicians, and counsel. Name specific recipients when possible.
5. Scope and timeframe: limit disclosure to records reasonably related to the work injury and specify service dates.
6. Expiration: use an event-based end point such as “final resolution of the workers’ compensation claim” unless you prefer a fixed date.
7. Signature and revocation: sign and date. You may revoke in writing, but earlier disclosures remain valid.

Being precise keeps the exchange of PHI focused on the claim and speeds benefit decisions while protecting your privacy.

Understanding Form DOH-5173 Requirements

Form DOH-5173 is a New York State Department of Health authorization designed for general PHI releases outside court or workers’ compensation settings. It captures the HIPAA-required elements and New York’s additional consent requirements for sensitive categories.

What DOH-5173 typically includes

• Clear identification of the disclosing provider and the recipient(s).
• A specific description of the information to be released and the date range covered.
• An articulated purpose (treatment coordination, personal use, benefit or claim administration).
• Separate checkboxes and initials for mental health, substance use disorder, HIV-related, genetic testing, and reproductive health information.
• Expiration by date or event, plus your right to revoke.
• Signature lines for the patient or personal representative and a statement of authority, if applicable.

When you might use DOH-5173

Use this format to share records with another treating provider, a life/disability insurer, a school or camp, or a benefit plan. Many plan administrators accept DOH-5173 in place of proprietary forms, including for Flexible Spending Account HIPAA forms, provided all required fields are complete.

Special Considerations for OMH Authorization Form OMH-11C

OMH-11C supports mental health information release from programs and facilities overseen by New York’s Office of Mental Health. Because state law affords heightened protections, you must be explicit about what to disclose and to whom.

Completing OMH-11C with care

• Define the purpose narrowly (for example, care coordination with a new psychiatrist or disclosure to an attorney for a specific case).
• List only the mental health records you want released—such as treatment plans, medication history, discharge summaries, or progress notes.
• Authorize and initial sensitive categories as required. Psychotherapy notes often need their own specific authorization.
• Name each recipient precisely and set an appropriate expiration date or event.
• If a personal representative signs, indicate legal authority (e.g., guardian, health care proxy). For minors, follow New York rules on who may consent to release.

If your records include substance use disorder treatment, additional federal protections apply; ensure those elements are expressly included before you sign.

Common Mistakes to Avoid When Filling NY HIPAA Forms

• Leaving the date range blank or overly broad, which can delay processing or disclose unnecessary information.
• Failing to initial sensitive categories, causing providers to withhold mental health, HIV-related, or substance use records you intended to share.
• Using “any and all records” when you only need specific items, increasing privacy exposure.
• Not naming all intended recipients (for example, an insurer’s third‑party administrator or outside counsel).
• Skipping the expiration entry; without it, some providers will not process the request.
• Having a representative sign without attaching proof of authority, prompting rejection.
• Sending copies with illegible entries or missing signatures; type or print clearly and keep a copy of what you sign.

Conclusion

New York HIPAA authorizations all follow the same logic: specify who may disclose, who may receive, exactly what records and why, for how long, and with your clear signature—and initials for sensitive categories. Choose the form matched to your setting (OCA 960, HIPAA-1, DOH-5173, or OMH-11C), tailor scope and dates, and you will maintain strong privacy while enabling timely record sharing.

FAQs

What is the purpose of the NY HIPAA Authorization Form?

Its purpose is to let you control the release of your protected health information in a way that complies with HIPAA and New York privacy laws. By naming the discloser, recipient, scope, purpose, and expiration, you authorize a targeted exchange of records while preserving your right to revoke.

How do I fill out the OCA Official Form 960?

Enter your identifiers, list the provider(s) authorized to disclose, name the recipient, describe the exact records and date range, state the purpose, initial any sensitive categories you want included, add an expiration date or event, and sign and date. If a representative signs, attach documentation showing their authority.

Can HIPAA authorization forms be used for workers’ compensation cases in New York?

Yes. Use Form HIPAA-1 to authorize disclosures specifically for Workers’ Compensation Board claims. Include the date of injury and any available case or claim numbers, limit the scope to work‑related records, list relevant recipients (WCB, employer, carrier, IME doctors, and attorneys), set an expiration tied to claim resolution, and sign.

What information is required on the OMH-11C authorization form?

Provide patient identifiers; the OMH program or facility authorized to disclose; the specific mental health records and date range; the precise recipient(s) and purpose; initials for any specially protected categories; an expiration date or event; and a signature (plus authority documentation if a representative signs).