To fill out a referral form, enter the referring and receiving provider details, identify the patient or client fully, state a clear reason for the referral with a diagnostic code where applicable, attach the supporting records, mark the urgency, and sign it before sending it through a secure channel. The rest is detail: which fields matter most, when you need patient authorization, how to transmit the form without running into privacy problems, and what to keep afterward.
What To Put in Each Field
A form that arrives with gaps gets bounced back or sits waiting while someone calls for missing information. Work through these fields in order:
- Referring provider. Full name, title, practice or organization name, phone, fax, and email. The receiving office needs a reliable way to reach you with questions.
- Receiving provider or organization. Name, department, and address. If you want a specific person inside a larger system to handle the case, name that person.
- Patient or client identification. Full legal name, date of birth, phone number, and mailing address. For healthcare referrals, add the insurance plan, member ID, and group number.
- Reason for referral. A concise description of why you are sending this person: the diagnosis, symptoms, or problem the specialist needs to address. “Please evaluate” with no context forces the receiving provider to guess or call back.
- Clinical or case history. Relevant medical history, current medications, recent test results, or a case summary. Attach the underlying documents instead of trying to compress them into a single field.
- Specific request. What you want the receiving provider to do: confirm a diagnosis, perform a procedure, give a second opinion, or take over care. The clearer the ask, the faster the response.
- Urgency level. Most forms use three tiers: routine (no immediate time pressure), urgent (attention within about 24 hours), and emergent (threat to life or limb requiring immediate action).
- Enclosures. List every document you attach: lab results, imaging reports, prior treatment notes. That way the receiving office can confirm nothing went missing in transit.
- Signature. Many receiving offices will not process a form that lacks the referring provider’s signature or electronic attestation.
Diagnostic Codes and Insurance Authorization
Two fields cause more rejected referrals than any other: the diagnostic code and the authorization number. Both exist for billing reasons, and both get skipped when staff are rushing.
Insurance companies and Medicare use ICD-10 codes to determine whether a referred service is covered. Including the correct code on the form prevents billing denials down the line. Leaving it blank means the receiving office has to look it up or guess, and a wrong guess leads to the same denial.
Then there is the question of whether the plan requires a referral, a prior authorization, or both. A referral in the insurance context is an order from a primary care provider directing the patient to a specialist. Some plan types, particularly point-of-service plans and certain HMOs, require this referral before the plan will cover the specialist visit. A prior authorization is a separate approval from the insurance company confirming that a service is medically necessary before the provider delivers it. Without prior authorization when the plan requires it, the plan may refuse to pay.1National Association of Insurance Commissioners. Understanding Health Insurance Referrals and Prior Authorizations
When the plan issues a referral authorization number after approving the request, that number belongs on the form before the patient sees the specialist. Skipping this step is one of the most common reasons specialist claims get denied, and the patient often ends up caught in the middle.
Do You Need the Patient’s Authorization To Share Records?
In most healthcare referrals, no. Federal privacy rules allow a covered entity to disclose protected health information for the treatment activities of any health care provider.2eCFR. 45 CFR 164.506 – Uses and Disclosures To Carry Out Treatment, Payment, or Health Care Operations A referral to a specialist is treatment, so sending the patient’s relevant medical history, test results, and diagnosis falls within that exception.
Two categories of records sit outside the treatment exception and need a signed authorization before you send them. Psychotherapy notes carry stricter protections, and substance use disorder records covered by 42 CFR Part 2 require separate patient consent before disclosure. When in doubt about whether a particular record qualifies, get the authorization. An unnecessary consent form wastes a minute, while an unauthorized disclosure can trigger enforcement action.
How To Send the Form
Even where authorization is not required, the HIPAA Security Rule still governs how you transmit the information. The rule does not ban email, but it requires that electronic protected health information sent over an open network be adequately protected.3U.S. Department of Health and Human Services. Does the Security Rule Allow for Sending Electronic PHI in an Email In practice, that means encryption rather than plain-text email.
The practical options, roughly in order of efficiency:
- EHR-to-EHR transfer. If both offices use interoperable electronic health record systems, the referral can be generated and sent inside the platform.
- Encrypted email or secure portal. Where direct EHR transfer is not available, send the form and attachments through an encrypted email service or upload to a shared secure portal.
- Secure fax. Fax remains common in healthcare because it transmits point-to-point. Electronic fax services encrypt the document in transit and store a delivery confirmation.
- Certified mail or hand delivery. For non-urgent referrals or settings where electronic options are unavailable, a physical copy by certified mail creates a paper trail.
Whichever method you use, confirm receipt. A referral that disappears between offices leaves the patient waiting. Most receiving offices acknowledge a referral within a day or two. If you have not heard back within a week, follow up directly.
Mistakes That Get a Referral Bounced
Most rejections trace to a short list of recurring errors. Run the completed form against this before you send it:
- Missing or wrong insurance details. An expired member ID or incorrect group number triggers automatic denial. Verify coverage first.
- Vague reason for referral. State the working diagnosis, relevant symptoms, and the specific request.
- No diagnostic code. Omitting the ICD-10 code shifts the lookup to the receiving office and risks a wrong one.
- Wrong recipient. Sending to a provider outside the patient’s network creates a coverage gap the patient may not discover until after the appointment.
- Skipping prior authorization when the plan requires it.
- Unsigned form. No signature, no processing.
Reviewing the form against this list takes less time than chasing down a rejection two weeks later.
A Warning Before You Sign: Payment Tied to Referrals
Filling out a referral form is a clinical act, not a financial one, and federal law draws a hard line around mixing the two. The federal anti-kickback statute makes it a felony to knowingly offer, pay, solicit, or receive anything of value in exchange for referring a patient for any service paid for by a federal healthcare program such as Medicare or Medicaid. Penalties include fines up to $25,000, up to five years in prison, or both.4GovInfo. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs Separately, the Stark Law prohibits a physician from referring Medicare patients for certain designated health services to any entity in which the physician or an immediate family member has a financial relationship, unless an exception applies.5Centers for Medicare & Medicaid Services. Physician Self-Referral Never tie compensation to the volume or value of referrals, and disclose any financial relationship with the entity you are referring to.
Keep a Copy, and Keep It Long Enough
The referral form becomes part of the patient or client file, and retention rules apply the same way they do to the rest of the record.
- Medicare-participating hospitals must retain medical records for at least five years following patient discharge.6eCFR. 42 CFR 482.24 – Condition of Participation: Medical Record Services
- HIPAA covered entities must retain HIPAA-related policies, procedures, and administrative records for at least six years from the date of creation or the date the record was last in effect, whichever is later.7eCFR. 45 CFR 164.530 – Administrative Requirements
- State retention periods for patient medical records range from as few as three years to more than twenty years. When federal and state timelines overlap, the longer period controls.
Default to the longest applicable period. Destroying a referral record too early can leave you unable to demonstrate medical necessity if a payer audits the claim years later. For non-healthcare professionals, check your industry’s governing body and state licensing board for the specific retention rules that apply.