A records request is only as strong as the authorization behind it. Providers can reject an authorization that is incomplete, expired, or missing a required statement, and corrections can delay processing. Use this checklist to reduce avoidable authorization problems before you submit.
FCA’s Records Retrieval team submits authorized requests, follows up with providers, and delivers available medical and billing records to your firm. Your part is a complete request and a valid, signed authorization. [5]
Key takeaways
- A consent-to-treatment form is not necessarily a valid authorization to release records to a law firm.
- Check all six HIPAA core elements, all three required statements, and applicable state requirements.
- Have the attorney approve record scope, expiration and any special-records authorization.
- Track requests, corrections, expiration and received records until the request is reconciled.
In this article
- Consent and authorization
- Required elements
- The staff checklist
- Provider rejections
- Follow-up tracking
- Final checks and FAQs
Consent and authorization are different
HIPAA permits a provider to obtain voluntary consent for treatment, payment and health care operations. When HIPAA requires authorization for a disclosure, that general consent is not enough unless it also meets the authorization requirements. For a PI records request relying on patient authorization, use the appropriate release form rather than assuming an intake consent covers disclosure to your firm. [1]
What every valid authorization must include
Under HIPAA, a valid authorization contains six core elements and three required statements. Missing any one of them can make the form defective. The authorization must also be written in plain language. [2]
| Core element | What to check |
|---|---|
| Description of the records | Specific and meaningful, such as record types and dates of service |
| Who may disclose | The provider, facility, or class of providers releasing the records |
| Who may receive | Your firm and, where applicable, FCA or other authorized recipients identified by name or specific class |
| Purpose | Describe each purpose; “at the request of the individual” is sufficient when the individual initiates the authorization and does not give a purpose |
| Expiration | A date or event related to the individual or the disclosure purpose, consistent with applicable state law |
| Signature and date | Signed and dated by the patient, or by a personal representative with a description of their authority |
Required statements must explain all of the following: [2]
- Revocation: the right to revoke in writing, plus the exceptions and how to revoke. The form may instead refer to the covered entity’s privacy notice if that notice supplies the exceptions and instructions.
- Conditioning: whether treatment, payment, health-plan enrollment or benefit eligibility may depend on signing. State the prohibition when it applies, or the consequences of refusing when a permitted exception applies.
- Redisclosure: information released under the authorization may be disclosed again by the recipient and may no longer be protected by the HIPAA Privacy Rule.
Other laws may still protect the information. Use the firm’s current approved wording rather than treating this summary as a ready-to-sign form.
California adds its own requirements
For authorizations subject to California’s Confidentiality of Medical Information Act, Civil Code 56.11 adds requirements. Among them, the authorization must be handwritten or printed in typeface no smaller than 14-point, and it must tell the signer they have the right to receive a copy. [3] [4]
For California authorizations, use an expiration of one year or less unless the supervising attorney confirms an applicable exception. CDII’s June 2025 guidance notes an exception when the signer requests a longer timeframe. Do not assume a longer case automatically permits a longer authorization; have counsel check the current statute and the form before using that exception. [3]
The staff checklist
Stage 1 Before the client signs
Set the form up correctly so the signature is the last step, not the first.
- Use a current authorization template your firm’s attorneys have approved
- For California providers, confirm the form is printed in 14-point type or larger
- Keep the authorization as its own document, not combined with a retainer or other intake language
- Fill in the client’s full legal name, date of birth, and any former names used at the provider
- Name the provider or facility exactly as it appears on bills or intake records
- Describe the records requested: medical records, billing records, or both
- Enter the attorney-approved record date range, including relevant pre-injury records only when appropriate to the request
- Identify the authorized recipients accurately, including your firm and FCA where the approved retrieval arrangement calls for it
- State the purpose, such as evaluation of a personal injury claim
- Set an attorney-approved expiration date or event that meets applicable law; do not automatically use the full life of the case
- Confirm the complete revocation, conditioning, and redisclosure statements described above are present
Stage 2 At signing
- The client signs and dates the form; no blanks are left in required fields
- If someone signs for the client, confirm their legal authority for these records and describe it on the form; a family relationship alone is not enough
- Supporting proof of authority is attached when a representative signs, such as letters of administration in a wrongful death matter
- The client receives a copy of the signed authorization
- A copy goes into the case file
Stage 3 Check for special records
Some records need more than a general authorization. Flag these before you submit.
- Psychotherapy notes: for an authorization-based PI records request, use a separate authorization that can only be combined with another psychotherapy notes authorization
- Substance use disorder treatment records: may be covered by federal confidentiality rules (42 CFR Part 2) with specific consent requirements
- HIV test results, genetic testing, or certain mental health records: may require specific written consent under state law
- Minor’s records: confirm who is legally able to sign, since some minor-consented services may require the minor’s own authorization
When in doubt, ask the attorney on the case and check the provider’s own requirements.
These are issue-spotting flags, not a substitute for checking current federal and state requirements for the particular records. [2] [4]
Stage 4 Submitting the request to FCA
- Client and case information, including your file number
- Provider or facility name, address, phone, and fax
- Record type: medical only, billing only, or medical and billing
- Requested date range
- The signed authorization, scanned clearly and completely (all pages)
- Any provider-specific form, ID copy, or certification the provider has asked for
- Any add-on you need: Datalens Text Analysis, FCA Insights AI Medical Record Summary, or MIDAS Medical Data Suite (these add-ons cannot be combined)
Use the firm’s approved secure submission process and provide only the documents needed for the authorized request.
Why providers reject authorizations
Most rejections come from a short list of avoidable errors.
| Rejection reason | Quick fix |
|---|---|
| Expired authorization | Use a lawful, attorney-approved expiration and replace the form before it lapses |
| Blank required field | Review every core element before the client signs |
| Patient name or date of birth does not match provider records | Include former names and confirm details with the client |
| Small print on a California form | Use a current attorney-approved form in at least 14-point type |
| Representative signed with no stated authority | Confirm legal authority, describe it on the form, and attach supporting proof when required |
| Combined with other paperwork | Keep the authorization as a standalone document |
| Special records requested on a general form | Use the separate or specific authorization those records require |
| Provider requires its own form | Ask early and have counsel review any additional form before the client signs |
Track follow-up through delivery
A complete authorization starts the request. Keep one request log per provider so your team can see what remains outstanding.
- Record the submission date, provider contact, delivery method, requested record types and attorney-approved date range.
- Save submission confirmation, the authorization expiration, the next follow-up date and the staff member responsible.
- Log provider replies, any rejection reason, requested correction, who will resolve it and the resubmission date.
- Compare each delivery with the requested dates and record types. Track missing records, missing billing, no-record responses and any further request separately.
- Flag approaching authorization expiration and case deadlines to the supervising attorney. Do not assume a provider’s correction request resets a legal deadline.
FCA follows up and reports available status information, but timing varies by provider and request. Your firm remains responsible for legal deadlines, scope decisions and review of the records received. [5]
Before you send
- All six core elements are filled in
- Complete revocation, conditioning, and redisclosure statements are present
- 14-point type or handwritten (California providers)
- Signed and dated by the client or an authorized representative
- Authorization has not expired and no revocation is known
- Special records are covered by the right separate authorization
- Provider details, record type, and date range are complete
- Scan is legible and includes every page
Frequently asked questions
What makes a medical record authorization valid? Under HIPAA, it must describe the records, name who discloses and who receives them, state the purpose, include an expiration, and be signed and dated. It also needs statements on revocation, conditioning, and redisclosure.
Do California providers have extra requirements? Yes. California’s CMIA includes requirements for the form, signature, expiration and right to a copy. Use a current attorney-approved form and confirm any exception before selecting an expiration beyond one year.
Can a general authorization also cover psychotherapy notes? For an authorization-based PI request, use a separate psychotherapy notes authorization. It can only be combined with another psychotherapy notes authorization.
Can a family member sign for the client? A family relationship alone is not enough. Confirm that the person is legally authorized to act for the client for the records requested, and describe their authority on the form. Minor-consented services need particular care.
How long does retrieval take once the authorization is submitted? Timing depends on each provider, the record volume, and whether the provider asks for corrections. A complete, valid authorization helps avoid the most common delays.
What if the provider rejects the authorization? FCA identifies the follow-up item the provider has requested, so your team can correct it and resubmit.
Send your records request
Submit your request with the signed authorization, and FCA can coordinate provider follow-up and delivery of available records. Questions? Call (855) 870-2274.
Disclaimer
This checklist is general information for law firm staff and is not legal advice. Authorization requirements vary by provider, record type, and jurisdiction; confirm forms with your supervising attorney. Fund Capital America is not a law firm.
Sources
Legal guidance and service details checked October 20, 2026. Confirm current requirements before using an authorization form.
1. HHS guidance on consent and authorization
2. 45 CFR 164.508 on authorization requirements
3. California CDII Statewide Health Information Policy Manual June 2025 section 2.1.1 pages 18 and 19
4. California CDII State Health Information Guidance January 2025 Appendix 2