A release of information is good for as long as the form itself says it is. Most authorizations stay valid until the expiration date or triggering event written on the document, and one year from signing is the most common window organizations use in practice. HIPAA does not set a federal maximum, but state laws, the type of record involved, and the wording you choose all shape the actual answer.
What Sets the Length
Under HIPAA, an authorization for health records must list either a calendar expiration date or an expiration event tied to you or to the purpose of the disclosure. It remains valid until that point, unless you revoke it first.1HHS.gov. Must an Authorization Include an Expiration Date The federal rule does not cap the duration.
You can set the timeframe to fit the reason for the release. A form covering a single specialist consultation might expire in 30 or 90 days. A release covering ongoing care for a chronic condition might say “end of treatment.” A release tied to a lawsuit could read “conclusion of the legal case.” Event-based expirations are just as valid as calendar dates, so long as the event relates to you or the purpose of the disclosure.2eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
One year is a convention, not a ceiling. Many providers print it as a default because it balances patient control with administrative practicality, but you are free to write in something shorter or longer.
When State Law Shortens the Window
Some states impose their own maximum duration on health information authorizations. If a state rule is stricter than HIPAA, providers in that state must follow the shorter timeframe. A form that lists a longer expiration is still valid on its face, but the provider can only act on it up to the state limit.1HHS.gov. Must an Authorization Include an Expiration Date If you’re not sure what your state allows, the medical records office or privacy officer at the provider can tell you.
If the Expiration Field Is Blank
A HIPAA authorization missing both a date and an event is defective. Releasing records on the basis of that form puts the provider at risk of a compliance violation, so many will refuse it and ask you to sign a corrected version.2eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
Some organizations treat a blank field as a one-year default under their own internal policy, but that is a risk-management choice, not something HIPAA requires. Leaving the field empty does not give you indefinite coverage. It gives you an invalid form. Fill in the expiration before you sign.
Records That Follow Different Rules
Research Authorizations
If your records are being used for a research study or added to a research database, the expiration can read “end of the research study,” “none,” or similar open-ended language. Research is the one context in which a HIPAA authorization can be truly indefinite.2eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
Substance Use Disorder Records
Records from substance use disorder treatment programs get an additional layer of federal protection under 42 CFR Part 2. For disclosures related to treatment, payment, or healthcare operations, the consent’s expiration can simply say “none” or “end of treatment,” which effectively allows an open-ended consent for routine care purposes.3eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
The rules tighten when the disclosure goes to the criminal justice system, as often happens with court-referred treatment. In that case the consent must state a specific period that is reasonable based on the expected length of treatment and the criminal proceeding, and it must include a revocation trigger tied to an event such as the final disposition of the case.3eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
Psychotherapy Notes
Psychotherapy notes, meaning the personal session notes a therapist keeps separately from your general medical chart, follow the same duration rules but require their own standalone form. A general “all medical records” release does not cover them. If you want a clinician to share psychotherapy notes, you have to sign an authorization specifically for that purpose, and it can be combined only with another psychotherapy notes authorization.2eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required4HHS.gov. Does HIPAA Provide Extra Protections for Mental Health Information
Background Check Authorizations Work Differently
Outside healthcare, the release most people run into is the background check authorization for employment. The Fair Credit Reporting Act requires your written consent before an employer pulls a consumer report, but it does not mandate an expiration date or event on the form.
An employer can use a single authorization to cover background checks throughout your entire time on the job, provided the form clearly and conspicuously says so.5U.S. Equal Employment Opportunity Commission. Background Checks: What Employers Need to Know A pre-employment form written broadly enough can stay valid for years. Read the scope before signing. Language like “during the course of your employment” grants far more access than wording limited to the hiring process.
Events That End an Authorization Early
Death
An authorization you signed while alive does not survive your death. Any existing HIPAA releases, and any medical power of attorney, lose their force once you die. HIPAA continues to protect your health information for 50 years after death, and during that time only a personal representative of the estate, usually an executor or administrator, can authorize new disclosures.6HHS.gov. Health Information of Deceased Individuals
If you are handling a deceased family member’s affairs, a release form they signed before death will not work. You’ll need to establish your authority as personal representative, typically through probate documents, and sign a fresh authorization yourself.
A Minor Turning 18
HIPAA generally treats a parent as the personal representative of a minor child, which lets the parent authorize disclosures of the child’s health information. When the child reaches the age of majority under state law, that authority ends for most purposes.7HHS.gov. Personal Representatives and Minors An authorization the parent signed for the child typically becomes unenforceable at that point, because the now-adult child controls their own health information. Continued access requires a new authorization signed by the adult child.
Ending an Authorization Before It Expires
You do not have to wait for the expiration. You can revoke an authorization at any time by giving the organization written notice. Some providers have their own revocation form, but a clear written statement identifying you and the authorization you are canceling works.2eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
Revocation takes effect when the organization receives your notice, and it only blocks future disclosures. Information already sent stays sent. Records that went out Monday cannot be pulled back if your revocation arrives Tuesday.8HHS.gov. Can an Individual Revoke His or Her Authorization
Two situations limit revocation. If the organization already acted in reliance on the authorization before receiving your notice, those prior actions stand. And if you signed the authorization as a condition of getting insurance coverage, and the law gives the insurer the right to contest a claim or the policy itself, revocation does not cut off that right.8HHS.gov. Can an Individual Revoke His or Her Authorization Outside those two scenarios, a written revocation is absolute.