Mental Health Release of Information Form: What Therapists Need to Include
What therapists must include on an ROI form to stay compliant with HIPAA, 42 CFR Part 2, and stricter state confidentiality laws.
A mental health release of information form is a written authorization that allows a behavioral health provider to disclose specific client information to a named person or organization for a stated purpose and time period. Therapists should account for HIPAA requirements as well as additional rules that may apply to psychotherapy notes, substance use disorder records under 42 CFR Part 2, and state mental health confidentiality laws.
What You'll Learn
- When therapists need a mental health release of information form
- What HIPAA requires a valid ROI form to include
- When psychotherapy notes require separate authorization
- How 42 CFR Part 2 changes the rules for substance use records
- What state-specific requirements therapists should watch for
- How to process, track, and revoke ROI authorizations correctly
01 / FoundationsWhat Is a Mental Health Release of Information Form?
A mental health release of information form, sometimes shortened to an ROI form, is a signed document that authorizes a behavioral health provider to disclose a specific piece of a client's record to a specific recipient, for a specific purpose, within a specific window of time. It exists because HIPAA, 42 CFR Part 2, and most state confidentiality statutes all start from the same default position: your client's mental health information stays with you unless the client (or someone with legal authority to act for them) says otherwise in writing.
That sounds close to a general medical records release, and structurally it is. Where it differs is in what it has to say and how carefully it has to say it. A form releasing your primary care physician's notes on a sprained ankle does not need to address psychotherapy notes, substance use disorder treatment records, or the layered state protections that apply to a client's psychiatric history. A mental health release of information form does, and in states like Illinois, California, and New York, a generic "release all my medical records" authorization is explicitly insufficient for mental health treatment records (see 740 ILCS 110/5, discussed below). If you are searching for a release of information form template to adapt for your practice, start from a mental-health-specific template, not a generic medical-records release form, since the omissions in a generic form are exactly the ones that create compliance risk.
Clinicians sometimes use "HIPAA release form" and "ROI form" interchangeably, but they describe the same underlying instrument: a HIPAA authorization, built to the specific requirements of 45 CFR 164.508, adapted for behavioral health content. We'll use "ROI form" and "authorization" interchangeably from here, consistent with how most practices talk about it day to day.
Mental Health Release of Information Form
Download this free template which includes.
- HIPAA-aligned authorization form
- ROI compliance checklist
- State-specific reminders
- Authorization tracking log
02 / Use CasesWhen Do Therapists Need a Release of Information Form?
You need a release of information form any time you disclose protected client information outside the narrow set of situations HIPAA and state law already permit without one (routine treatment, payment, and healthcare operations disclosures, for the most part, plus certain legally mandated reporting). In everyday practice, that comes up more often than clinicians expect.
Coordination of Care with Another Provider
Sharing history, a diagnosis, or a treatment plan with a client's psychiatrist, primary care physician, or a new therapist after a referral requires authorization, particularly once psychotherapy notes are involved.
Insurance and Utilization Review Requests
Payers routinely request documentation to justify medical necessity or continued authorization for sessions. Even though payment-related disclosures have more flexibility under HIPAA's general treatment, payment, and operations provisions, many practices still use a signed authorization to document the client's awareness and keep the request auditable.
Court, Legal, or Custody Proceedings
Attorneys, courts, and custody evaluators request records constantly, and a subpoena alone does not authorize disclosure of mental health records in most circumstances. You typically need either a valid client authorization or a court order that meets the specific requirements your state and, where applicable, 42 CFR Part 2 impose.
Family or Caregiver Involvement
A spouse, adult child, or caregiver asking for updates on a client's condition needs a signed authorization from the client (or their personal representative) before you can share clinical details, even when the request comes from a place of genuine concern.
Telehealth and Cross-State Care
As telehealth expands access to care across state lines, therapists are more frequently coordinating with an out-of-state provider or transferring records to a client who relocated. The same authorization requirements apply, and you'll also want to confirm which state's confidentiality statute governs the record, since that isn't always the state where the client currently sits during a video session.
03 / CompareHIPAA vs. 42 CFR Part 2: Why Mental Health and Substance Use Records Get Extra Protection
Most clinicians know HIPAA sets a federal privacy floor. Fewer know that a second federal regulation, 42 CFR Part 2, sits on top of HIPAA for any program that provides substance use disorder diagnosis, treatment, or referral and receives federal assistance, and that the two frameworks are not interchangeable.
Under 42 CFR 2.31, a valid Part 2 consent needs the patient's name, the name or class of persons authorized to disclose, a specific and meaningful description of the information to be disclosed, the name or class of recipients, the purpose of disclosure, the patient's right to revoke in writing, an expiration date or event, and the patient's signature and date (42 CFR 2.31, eCFR). That list overlaps heavily with HIPAA's authorization requirements, but the overlap is where the similarity ends.
Per 42 CFR 2.32(a)(1), a general medical-release authorization is explicitly not sufficient to satisfy Part 2's consent-to-redisclose requirement. Any disclosure made under a Part 2 consent must also come with a required notice warning the recipient against further redisclosure. As of the 2024 final rule (effective April 16, 2024, with a compliance date of February 16, 2026), Part 2 created a new category called "SUD counseling notes," modeled directly on HIPAA's psychotherapy notes concept. A consent for SUD counseling notes can only be combined with another consent for SUD counseling notes, not folded into a broader treatment, payment, or operations consent (42 CFR 2.31(b); HHS Fact Sheet on the 42 CFR Part 2 Final Rule). The same 2024 rule also aligned Part 2's penalties, breach notification duties, and patient rights, including the right to file a complaint directly with HHS, more closely with HIPAA (HHS Fact Sheet, same source).
The practical takeaway for a group practice or solo clinician who treats co-occurring substance use and mental health conditions: a HIPAA-compliant authorization does not, by itself, satisfy Part 2. If your practice provides SUD treatment, you need a Part 2-specific consent with the required redisclosure notice, and starting in 2026, a further separate consent if you're disclosing SUD counseling notes specifically.
| Consideration | HIPAA | 42 CFR Part 2 |
|---|---|---|
| Applies to | All covered entities handling PHI | Programs providing SUD diagnosis, treatment, or referral that receive federal assistance |
| General medical release sufficient? | Not for psychotherapy notes | Explicitly not sufficient (42 CFR 2.32(a)(1)) |
| Redisclosure warning | Recipient may redisclose; may no longer be protected | Required notice warning recipient against further redisclosure |
| Special note category | Psychotherapy notes | SUD counseling notes (as of 2024 final rule) |
04 / ComplianceWhy Psychotherapy Notes Require Separate Authorization
Psychotherapy notes are not the same as the rest of the clinical chart — and HIPAA does not treat them the same way. HIPAA carves out a narrow category called psychotherapy notes, and it treats them more strictly than anything else in a client's record. Under 45 CFR 164.501, psychotherapy notes are notes recorded by a mental health professional documenting or analyzing the content of a counseling session, and kept physically separate from the rest of the medical record. The definition specifically excludes medication management, session start and stop times, treatment modalities and frequency, test results, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, or progress. Those items live in the regular chart and follow standard PHI rules.
Because psychotherapy notes are defined so narrowly, most of what you write in an ordinary progress note (diagnosis, symptoms, interventions, treatment plan updates) is not a psychotherapy note under HIPAA and doesn't require this heightened authorization. Where the heightened rule applies, it applies firmly: with a short list of exceptions (use by the note's own author for treatment, the covered entity's own training programs, certain legal defense and oversight situations), a covered entity needs a specific authorization before using or disclosing psychotherapy notes, even to share them with another treating provider (45 CFR 164.508(a)(2)).
That authorization also can't be bundled into a general records release. Per 45 CFR 164.508(b)(3)(ii), an authorization for psychotherapy notes may only be combined with another authorization for psychotherapy notes, not with a broader medical-records release. HHS explains the rationale directly: psychotherapy notes are "particularly sensitive" and represent "the personal notes of the therapist… of little or no use to others not involved in the therapy" (HHS, "HIPAA Privacy Rule and Sharing Information Related to Mental Health"). Clients, and even parents acting as a minor's personal representative, have no HIPAA right of access to psychotherapy notes at all, a specific carve-out from the general medical records access right (45 CFR 164.524(a)(1)(i)-(ii), cited in the same HHS guidance).
HIPAA does not give blanket special protection to "mental health information" as a category. The extra protection applies only to this narrowly defined subset of therapist notes kept separate from the chart. Your diagnoses, treatment plans, and standard progress notes follow the same PHI rules as any other health information (HHS FAQ, "Does HIPAA Provide Extra Protections for Mental Health Information Compared to Other Health Information?").
05 / RequirementsWhat Should a Mental Health Release of Information Form Include?
A mental health release of information form only does its job if it contains the elements HIPAA requires. Miss one, and the authorization is defective, which means the disclosure you make in reliance on it is impermissible (45 CFR 164.508(b)(2)). Here is what belongs on every form, drawn from 45 CFR 164.508(c)(1)-(2).
| Required Element | What It Must Include | Regulatory Basis |
|---|---|---|
| Patient identification | Name and enough identifying detail to confirm identity | 45 CFR 164.508(c)(1) |
| Specific information to be disclosed | Described "in a specific and meaningful fashion," not a blanket reference to "all records" | 45 CFR 164.508(c)(1) |
| Recipient name and contact | The specific person, organization, or class of persons authorized to receive the disclosure | 45 CFR 164.508(c)(1) |
| Purpose of disclosure | A description of each purpose (or "at the request of the individual" if the client initiated it) | 45 CFR 164.508(c)(1) |
| Expiration date or event | A date or event tied to the individual or the purpose of the disclosure | 45 CFR 164.508(c)(1) |
| Signature and date | Client's signature, or a personal representative's signature with a description of their authority | 45 CFR 164.508(c)(1) |
| Right to revoke | A statement of the client's right to revoke in writing, with exceptions or a reference to the Notice of Privacy Practices | 45 CFR 164.508(c)(2) |
| Redisclosure warning | A statement that the recipient may redisclose the information and it may no longer be protected by the Privacy Rule | 45 CFR 164.508(c)(2) |
A form also has to be written in plain language, and the covered entity must give the client a copy of the signed authorization (45 CFR 164.508(c)(3), (d)). HHS has confirmed that a third party may draft the form itself. HIPAA doesn't dictate a specific format, only the content it has to contain (HHS FAQ #472).
06 / How-ToHow to Fill Out a Mental Health Release of Information Form
A mental health release of information form should be completed carefully enough that anyone reviewing it can tell exactly who is authorizing the disclosure, what information may be shared, who may receive it, why it is being disclosed, and when the authorization ends. HIPAA requires these elements to be stated clearly and specifically, and an incomplete or defective authorization may be invalid.
When completing or reviewing an ROI form, work through each field in order:
Identify the Client
Enter the client's full name and enough identifying information to confirm that the authorization applies to the correct person. Depending on your practice and form design, this may include the client's date of birth or another identifier.
Name the Provider or Practice Authorized to Disclose Information
Clearly identify the clinician, behavioral health practice, or organization that is authorized to release the information. Avoid vague descriptions when a specific provider or organization can be named.
Identify the Person or Organization Receiving the Information
List the specific individual, provider, organization, or permitted class of recipients that may receive the records. Include contact information when appropriate so the disclosure is directed to the intended recipient.
Describe Exactly What Information May Be Released
Be specific about the records covered by the authorization. HIPAA requires the information to be described in a "specific and meaningful" way, so broad language such as "all records" may not provide enough clarity for every situation. Instead, identify the type of information and, when useful, the applicable date range.
State the Purpose of the Disclosure
Explain why the information is being released. Common purposes may include coordination of care, transfer of records, a legal request, or another client-authorized use. If the client initiated the request, HIPAA permits language such as "at the request of the individual."
Add an Expiration Date or Expiration Event
Every HIPAA authorization must state when it ends. This may be a specific calendar date or an event related to the purpose of the disclosure, such as completion of a defined episode of care. Do not leave the expiration field blank. State law may impose additional requirements or consequences when an expiration date is missing. For example, Illinois limits disclosure to the day the form is received if no expiration date is stated.
Include the Client's Signature and Date
The client must sign and date the authorization. If a parent, guardian, or other personal representative signs instead, the form should also identify that person's authority to act for the client.
Confirm the Required Authorization Statements
Before the form is finalized, make sure it includes the additional statements HIPAA requires, including the client's right to revoke the authorization in writing; any applicable information about whether treatment, payment, enrollment, or eligibility may be conditioned on signing; and a warning that information disclosed under the authorization may be redisclosed by the recipient and may no longer be protected by the HIPAA Privacy Rule. The authorization should also be written in plain language, and the client should receive a copy of the signed form.
07 / TemplateSample Mental Health ROI Form Fields
If you're building or evaluating a mental health release of information form pdf for your practice, the table below shows how the required elements above translate into actual form fields. This is illustrative, not a substitute for legal review of your specific form.
| Form Field | Example Entry |
|---|---|
| Client name and date of birth | Jordan T. Reyes, DOB 03/14/1990 |
| Provider/practice authorized to disclose | Riverside Behavioral Health, PLLC |
| Recipient name and address | Dr. A. Kim, Family Medicine Associates, 123 Main St. |
| Information to be released | Diagnostic assessment and treatment plan dated 01/2026 to present (psychotherapy notes excluded unless separately authorized) |
| Purpose of disclosure | Coordination of ongoing psychiatric care |
| Expiration date or event | One year from signature, or upon completion of the stated purpose |
| Client (or personal representative) signature and date | Signed, with representative authority noted if applicable |
| Right to revoke statement | Client may revoke in writing at any time except to the extent action has already been taken in reliance on the authorization. |
| Redisclosure notice | Information disclosed may be redisclosed by the recipient and may no longer be protected |
This example is illustrative only. Mental health confidentiality laws can impose requirements beyond HIPAA, and substance use disorder records subject to 42 CFR Part 2 require additional consent and redisclosure protections. Practices should confirm the federal and state requirements that apply before relying on any ROI form template.
08 / State LawMental Health Release of Information Form Requirements by State
HIPAA sets a floor, not a ceiling, and several states build meaningfully stricter requirements on top of it (45 CFR 160.203, HIPAA's preemption provision, defers to more protective state law). If you practice in California, New York, or Illinois, or treat clients who reside there, know these three examples well. And regardless of state, confirm the current statute text before finalizing a form, since these provisions get amended more often than clinicians expect.
California Mental Health Release Requirements
The Confidentiality of Medical Information Act, Civil Code 56.11, requires that an authorization be handwritten or in 14-point type or larger, visually separate from other text on the page, signed and dated with a signature that serves no other purpose on the document, and that it identify the disclosing provider and recipient, state the purpose, and include an expiration date or event (generally capped at one year unless the client specifies otherwise). The Lanterman-Petris-Short Act, Welfare and Institutions Code 5328, layers additional confidentiality rules on top of this for recipients of public mental health services, and it specifically excludes psychotherapy notes, as defined under 45 CFR 164.501, from otherwise-permitted care-coordination disclosures to social workers and probation officers (Welf. & Inst. Code 5328.04(h)).
New York Mental Health Release Requirements
Mental Hygiene Law 33.13 makes clinical records at Office of Mental Health-licensed or -operated facilities confidential by default. Disclosure outside a defined list of statutory exceptions requires either a specific statutory basis or client (or authorized person) consent, and the statute states that any information disclosed must be limited to what's "necessary and required in light of the reason for disclosure" and kept confidential by whoever receives it. That redisclosure limit travels with the record.
Illinois Mental Health Release Requirements
The Mental Health and Developmental Disabilities Confidentiality Act, 740 ILCS 110/5, requires a written consent naming the recipient, stating the purpose, describing the nature of the information disclosed, noting the right to inspect and copy that information, describing the consequences of refusing consent (if any), stating a calendar expiration date, and stating the right to revoke at any time. If no expiration date is stated, the Act limits release to the day the form is received. A general medical release is explicitly not sufficient to release mental health treatment records under this Act. As of August 15, 2025 (Illinois House Bill 3078), the Act's longstanding requirement that a witness sign alongside the client was removed, easing a formality that used to distinguish Illinois from HIPAA's baseline. The Act also carries its own civil and criminal penalties: a knowing or willful violation is a Class A misdemeanor, and clients can sue for damages, an injunction, or other relief plus attorney's fees, independent of any federal HIPAA enforcement action.
The pattern across all three states is consistent. Each requires a specific, purpose-limited consent naming the recipient and the exact information disclosed, an explicit expiration date or event, an explicit right to revoke, and an explicit rule that a generic "release all my records" authorization does not satisfy the mental health-specific requirement. If your practice operates in multiple states, or serves clients who relocate, build your form to the strictest applicable standard rather than maintaining separate templates you might apply incorrectly.
09 / AuthorityWho Can Sign a Mental Health Release of Information Form?
When a personal representative, rather than the client, signs a release of information form, HIPAA requires the form to describe that person's authority (45 CFR 164.508(c)(1)). For minors, that's typically a parent or legal guardian, though state law (not HIPAA) generally determines when a minor can consent to their own mental health treatment and control disclosure of the resulting records, so confirm your state's specific minor-consent statute before assuming a parent automatically holds signing authority.
Minors and Parents
The psychotherapy notes carve-out matters here too. Parents acting as a minor's personal representative have no greater HIPAA right of access to psychotherapy notes than any other personal representative would, since the regulation excludes psychotherapy notes from the general access right regardless of who is requesting them (45 CFR 164.524(a)(1)(i)-(ii)). That distinction is worth explaining to parents directly, since it surprises many of them.
Guardians and Personal Representatives
For clients with a court-appointed guardian, or those temporarily unable to provide informed consent, professional ethics codes reinforce what the regulations already require. The NASW Code of Ethics states that confidential information may be disclosed "only with valid consent" (Section 1.07(b)) and that clients should be informed early in the relationship about the limits and legal requirements around disclosure (Section 1.07(e)). The APA Ethics Code's Standard 3.10 similarly requires psychologists to obtain informed consent in language the client can reasonably understand before providing services, which includes explaining confidentiality limits from the outset. These are professional ethical standards, not law on their own, but they reinforce the same practice: document who has authority to consent, and don't assume.
10 / WorkflowHow to Process a Release of Information Request in Your Practice
A well-written form still fails if your practice doesn't handle the request correctly on the back end. Four habits matter most.
Verify Identity and Signing Authority
Verify identity and authority before you disclose anything. Confirm the requester is who they say they are, and confirm they have the legal authority to request or receive the information, whether that's the client themselves, a legal guardian, or a properly authorized representative.
Log the Authorization and Track Its Expiration
Log and track every authorization, with expiration reminders. Every signed ROI form should be logged with its expiration date or triggering event, so you're not relying on memory to know when an authorization has lapsed. Practices that track this manually tend to be the ones that discover, months later, that they disclosed information under an authorization that had already expired.
Handle Revocation Requests Promptly
Handle revocation requests immediately and in writing. Clients have the right to revoke a HIPAA authorization at any time, in writing, except to the extent the practice has already acted in reliance on it (45 CFR 164.508(c)(2)). Under 42 CFR 2.31(a)(6), Part 2 consents carry the same revocation right. Once revoked, stop any pending disclosure and document the date the revocation was received.
Avoid Common ROI Form Mistakes
Watch for the mistakes that invalidate a form. The most common ones in behavioral health settings: releasing psychotherapy notes under a general treatment authorization instead of the separate authorization 45 CFR 164.508(a)(2) requires, leaving the expiration field blank, describing the information to be disclosed too vaguely to meet the "specific and meaningful fashion" standard, and relying on an authorization known to have already been revoked. As HIPAA Journal summarizes HHS's own compliance logic, "if a HIPAA Authorization Form lacks the core elements or required statements, if it is difficult for the individual to understand, or if it is completed incorrectly, the authorization will be invalid and any subsequent use or disclosure of PHI made in reliance on the authorization will be impermissible."
The consequences of getting this wrong are documented in HHS Office for Civil Rights resolution agreements. Shasta Regional Medical Center paid $275,000 after senior management disclosed a patient's diagnosis and treatment details to media outlets and its own workforce by email, without valid authorization. Deer Oaks, The Behavioral Health Solution, a psychological and psychiatric services provider, paid $225,000 in 2025 following impermissible disclosure of electronic PHI, including exposed discharge summaries with diagnoses, alongside a related security failure. A smaller psychiatric practice, Manasa Health Center, paid $30,000 after disclosing a patient's diagnosis and treatment information in a public response to a negative online review. It's worth being precise about what these cases show: each involved disclosure made without valid authorization at all, not a defective ROI form specifically. No published OCR case was found that turns narrowly on a form missing a single required element. Still, these settlements illustrate how seriously OCR treats unauthorized disclosure of mental health PHI, which is exactly the outcome a properly executed release of information form exists to prevent. Illinois adds its own layer of exposure on top of federal enforcement, since a knowing violation of 740 ILCS 110/5 carries independent civil and criminal liability.
11 / TelehealthCan Mental Health ROI Forms Be Signed Electronically?
As more practices operate partly or entirely through telehealth, paper-only ROI workflows stop making sense. HIPAA doesn't require a particular format for an authorization, only the required content (HHS FAQ #472), which means an electronically signed form can be just as valid as a handwritten one, provided it captures every required element and the client's signature is authentic and dated.
State-level formatting rules still apply to electronic forms, so build your e-signature workflow around them rather than around convenience alone. California's Civil Code 56.11, for example, requires a signature that "serves no other purpose" on the document, a requirement your e-signature platform needs to satisfy structurally, not just cosmetically. Illinois no longer requires a witness signature as of August 2025, which actually simplifies electronic execution for practices in that state. Whatever platform you use, keep an audit trail showing when the form was presented, signed, and stored, since that trail is what demonstrates the authorization was properly executed if it's ever questioned.
12 / TechnologyHow the Right EHR Keeps Release of Information Documentation Organized
Everything above describes a real administrative burden: tracking which authorization covers which disclosure, watching expiration dates across dozens or hundreds of active clients, distinguishing psychotherapy notes from the rest of the chart, and doing all of it differently depending on which state's statute applies. Handled manually, on paper or in spreadsheets, this is exactly the kind of task that slips, and a slipped expiration date or a misfiled revocation is how a practice ends up in the kind of enforcement action described above.
This is where a behavioral-health-specific EHR earns its place in the workflow, rather than being the starting point of it. ICANotes keeps signed authorizations attached directly to the client chart, with psychotherapy notes stored and access-controlled separately from the rest of the record, consistent with how 45 CFR 164.501 and 164.508(a)(2) require them to be treated. Secure client-portal signing and audit-ready documentation are built into the same system clinicians already use to write progress notes and manage treatment plans, rather than living in a separate paper file or a disconnected e-signature tool. For a solo practice or a multi-clinician group juggling coordination-of-care requests, insurance reviews, and the occasional subpoena, having authorizations, expirations, and disclosure logs in one auditable system reduces the exact administrative burden that leads to missed expirations and misdirected disclosures in the first place.
Keep every ROI authorization organized and audit-ready
ICANotes attaches signed authorizations to the client chart and stores psychotherapy notes separately, exactly as HIPAA requires. Start your free trial and see how behavioral-health-specific documentation reduces compliance risk.
- Notes completed in under 3 minutes
- 30-day free trial, no credit card required
- HIPAA and 45 CFR Part 2 compliant
- Live support from behavioral health specialists
FAQFrequently Asked Questions
What is the difference between a HIPAA release and anROIform?
Do ROI forms need to be notarized?
How long is a mental health release of information valid?
Can a client revoke authorization after signing?
Is a mental health release form different from a general medical release?
Key takeaways
- A mental health release of information form should clearly identify who is authorizing the disclosure, what information may be shared, who may receive it, why it is being shared, and when the authorization expires.
- Psychotherapy notes require separate authorization under HIPAA and should not be bundled into a general release for the rest of the client record.
- If your practice handles substance use disorder treatment records, HIPAA authorization alone may not be enough; 42 CFR Part 2 can impose additional consent and redisclosure requirements.
- State mental health confidentiality laws may be stricter than HIPAA, so practices should verify the requirements that apply in each state where they provide care.
- A valid ROI process does not end when the form is signed. Practices should verify authority, track expiration dates, document disclosures, and act promptly on revocations.
- Use a mental-health-specific ROI form, rather than relying on a generic medical records release, when behavioral health information is being disclosed.
Dr. October Boyles
Dr. October Boyles is a behavioral health expert and clinical leader with extensive expertise in nursing, compliance, and healthcare operations. With a Doctor of Nursing Practice (DNP) and advanced degrees in nursing, she specializes in evidence-based practices, EHR optimization, and improving outcomes in behavioral health settings. Dr. Boyles is passionate about empowering clinicians with the tools and strategies needed to deliver high-quality, patient-centered care.
