How to Fill Out and Submit a Client Authorization Form

To fill out a client authorization form, you give a specific institution written permission to release specific records to a specific third party for a specific purpose, and then you sign and date it. The form has to identify you clearly enough that staff can match it to your file, name the party receiving the information, describe the records narrowly, and state when the permission ends. Vague forms get rejected. Use the institution’s own version whenever one exists, because it already contains the fields required by the law covering that type of record.

What Every Authorization Form Must Contain

The fields vary slightly by industry, but the following items appear on nearly every valid authorization. Missing or sloppy entries on any of them is the most common reason a form comes back unprocessed.

Your identifying information. Full legal name, address, phone number, and the account-level identifier the institution uses: Social Security number at a bank, medical record number at a hospital, taxpayer identification number at the IRS.
The disclosing party. The specific entity holding your records. Name the exact branch, department, or office rather than just the parent organization.
The receiving party. Full name, title or role, mailing address, and fax or email if the institution transmits electronically.
A specific description of the records. Narrow this as tightly as you can. Instead of “all tax records,” write “federal income tax returns for tax years 2023 through 2025.” For medical records, specify the type and a date range, such as “orthopedic surgical records from January through March 2025.” For legal matters, include a case number or matter ID.
The purpose of the disclosure. A short statement: mortgage underwriting, second medical opinion, resolution of a tax matter.
An expiration date or event. A calendar date, a period like “one year from signing,” or a triggering event like “upon closing of the mortgage loan.”
Your signature and the date you signed.

Pre-checked or pre-signed forms are treated as invalid because the authorization was not truly voluntary. Fill in each field yourself before you sign.

Pick the Right Form for the Record Type

Different federal laws govern different categories of records, and each category has its own quirks about what the authorization must say.

Health Records (HIPAA)

A HIPAA authorization must contain six core elements: a specific description of the health information to be disclosed, the name of the person or entity authorized to release it, the name of the person or entity who will receive it, a statement of the purpose, an expiration date or event, and your signature and date. It must also carry three required notices: your right to revoke the authorization in writing, whether the provider can condition your treatment or coverage on your signing, and a warning that once the information leaves the provider it may no longer be protected by HIPAA.¹

The expiration requirement is where people slip. An open-ended HIPAA authorization with no expiration is invalid. Use a specific calendar date, a defined period, or an event such as “upon the minor reaching age 18.”² A provider that receives a form missing any required element, or one that has already expired, cannot release the records.

Tax Records (IRS Forms 8821 and 2848)

The IRS has two separate authorization forms, and choosing between them depends on what you want the third party to do.

Form 8821, Tax Information Authorization, lets a third party inspect or receive your confidential tax information for specific tax types and periods. A mortgage lender pulling your transcripts, a financial planner reviewing past returns, or a compliance team verifying income all use Form 8821. You can designate any individual, company, or organization. If the form is for income verification or another non-tax-matter purpose, the IRS must receive it within 120 days of your signature date.³

Form 2848, Power of Attorney and Declaration of Representative, authorizes someone to communicate with the IRS, respond to notices, and handle case-related matters on your behalf. Because the authority is broader, only individuals eligible to practice before the IRS can be named: attorneys, CPAs, enrolled agents, enrolled actuaries, and certain other designated professionals. The representative must sign within 45 days of your signature, or 60 days if you live abroad.⁴

Both forms require your name, taxpayer identification number, address, and a specific description of the tax type, form number, and tax years. Do not write “all years” or “all taxes.” The IRS will reject it.⁴ You can submit either form through the IRS online portal, by fax, or by mail. Fax numbers and mailing addresses depend on where you live: eastern states route to Memphis, western states to Ogden, international filers to Philadelphia.

Education Records (FERPA)

Schools and colleges fall under the Family Educational Rights and Privacy Act. A FERPA consent must specify which records may be disclosed, state the purpose, identify the party or class of parties who will receive the information, and be signed and dated. Electronic signatures are allowed as long as the system identifies and authenticates the signer and shows approval of the information in the consent.⁵

Financial Records

Banks, lenders, and brokerages each design their own authorization form. There is no single federal template, so the layout and required fields vary by institution. Expect to supply your account number, the specific records to be disclosed, and the receiving party’s contact information. Use the bank’s form rather than drafting your own.

Signing the Form: Wet Ink or Electronic

Under the federal ESIGN Act, an electronic signature cannot be denied legal effect solely because it is electronic, as long as the record can be retained and accurately reproduced later.⁶ For a signature to hold up, you must intend to sign, all parties must consent to transacting electronically, and the signed record must be stored so it can be reproduced.

In health care, the platform handling the signature must also meet HIPAA security requirements: encryption in transit and at rest, access controls, and an audit trail capturing identity, timestamp, and device. The provider should hold a Business Associate Agreement with the e-signature vendor.

One exception matters. The IRS accepts electronic signatures on Forms 8821 and 2848 only through its own online submission portal. If you fax or mail those forms, the signature must be handwritten.³ Check with the specific institution before signing digitally. Some still require wet ink.

Submitting the Form and Keeping Proof

Deliver the signed form through a secure, verifiable channel. Encrypted online portals timestamp uploads automatically. If a physical copy is required, certified mail with return receipt gives you proof the institution received it.

Faxing is still common in medical and legal offices. If you use email, password-protect the file or use an encrypted email service. Sending an unencrypted authorization that contains your Social Security number or medical record number over ordinary email is a risk worth avoiding.

Turnaround varies. Some financial institutions process authorizations within a few business days. Medical records requests can take longer depending on volume and any fees the facility charges. Fees for copying and transmitting health records are set by state law and vary by jurisdiction; expect a search-and-retrieval fee plus per-page copying charges.

Keep your own copy of the signed form. If the institution later claims the authorization didn’t cover a particular record or date range, your copy settles it.

Why Forms Get Rejected

Before you send the form, check it against the issues that cause most rejections.

Vague description of records. “All my files” is not specific enough. Name the record type, date range, and account or case number.
No expiration date. A HIPAA authorization with no expiration is automatically invalid.²
Wrong form. Using IRS Form 8821 when you need Form 2848, or the reverse, means the IRS cannot process the request for your intended purpose.
Expired authorization. If the expiration date has already passed, the institution cannot honor it. Sign a new one.
Unsigned or undated. A form missing your signature or the date you signed is incomplete on its face.
Illegible or mismatched identifying information. If the name or account number does not match the institution’s records, staff cannot verify your identity.
“All years” or “all taxes” on an IRS form. Spell out each tax type, form number, and year.⁴

Revoking the Authorization Later

You can cancel any authorization you have signed. Under HIPAA, the revocation must be in writing and takes effect when the institution receives it, not when you send it.⁷ For an IRS Form 8821, you revoke by submitting a new Form 8821 with the revocation box checked, or by sending a revocation letter that includes your name, taxpayer identification number, and the designee whose access you want to remove.³

A revocation only reaches future disclosures. Anything released while the authorization was active remains valid. The provider acted in good faith on a signed permission, and that cannot be undone after the fact.

Send any revocation through a traceable method: certified mail, a portal with read-receipt, or fax with a confirmation page. Ask the institution for written acknowledgment that the revocation has been noted in your file, and keep that acknowledgment with your copy of the original form. If a disclosure happens after the institution received your revocation, those two documents together are your evidence that the release was unauthorized.

1
eCFR. 45 CFR 164.508
2
U.S. Department of Health and Human Services. Must an Authorization Include an Expiration Date
3
Internal Revenue Service. Instructions for Form 8821
4
Internal Revenue Service. Instructions for Form 2848
5
U.S. Department of Education. FERPA
6
Office of the Law Revision Counsel. 15 USC 7001
7
U.S. Department of Health and Human Services. Can an Individual Revoke His or Her Authorization