How to Fill Out and Submit an Annual Consent Form

To fill out an annual consent form, enter your identifying information, name the person or organization you’re authorizing, describe exactly what information or action you’re permitting, set an expiration date, and sign and date the form. The details depend on which law governs the form in front of you, but the structure is consistent across healthcare, school, and financial settings.

What a Valid Form Must Contain

Before you start writing, know what the form has to include. A form missing a required element can be rejected or treated as invalid later, which defeats the point of signing it.

Healthcare Forms Under HIPAA

A valid HIPAA authorization needs at least six core elements:¹

A specific, meaningful description of the health information to be used or disclosed.
The name or identification of the person or class of persons authorized to make the disclosure.
The name or identification of the person or class of persons who will receive the information.
A description of each purpose. If you initiated the authorization yourself, “at the request of the individual” is enough.
An expiration date or expiration event.
Your signature and the date you signed. If a personal representative signs on your behalf, the form must describe their authority.

The form also has to include three statements: notice of your right to revoke in writing, whether the provider can condition treatment or benefits on your signing, and a warning that information disclosed to the recipient may be re-disclosed and lose its protection.¹

School Forms Under FERPA

A FERPA consent is simpler. It must be signed and dated, specify the records that may be disclosed, state the purpose, and identify the party or class of parties who will receive the records.² A blanket phrase like “all records to anyone who asks” would not satisfy the regulation.

FERPA itself does not require annual renewal. It requires consent before each disclosure to a new party or for a new purpose. The yearly rhythm most parents recognize comes from school districts collecting one blanket authorization at the start of each academic year.

Filling Out the Form Step by Step

The workflow is roughly the same whichever law applies. Work through the form section by section.

Start with your identifiers. You need your full legal name, current address, and a working phone number or email. If a date of birth, patient ID, or student ID appears on the form, use the number exactly as the organization has it on file. Mismatches here are the most common reason a form gets kicked back.

Name the recipient precisely. Write the full legal name of every person or entity you are authorizing to receive or use the information. A doctor’s office form might ask for the name of a specialist, insurer, or family member. A school form might ask for the name of a tutoring service or a new district. Use the name the recipient’s organization would recognize, not an informal version.

Define the scope narrowly. This is where most mistakes happen. Be as specific as the form allows. “Complete medical record” is almost always broader than you intend. If you only want lab results sent to a new physician, write that. If a school form asks what records may be disclosed, “attendance and grades” is more protective than checking a box for “all education records.” The narrower the scope, the less chance that information you did not mean to share ends up somewhere unexpected.

Set the dates carefully. Enter the date you are signing and the date you want the authorization to expire. Many pre-printed forms supply a one-year window, but you can often write in a shorter period for a temporary need. If the form ties expiration to an event rather than a date, make sure the event is described clearly enough that someone reading the form a year later would know when it ends.

Sign and date. If you are signing on behalf of someone else, such as a minor child or an incapacitated adult, the form should have a line for you to describe your legal authority (parent, legal guardian, healthcare proxy). Without that description, the authorization may not be considered valid under HIPAA.¹

Signing Electronically

Most organizations now accept electronic signatures. Under the federal E-SIGN Act, a signature or record cannot be denied legal effect solely because it is in electronic form, as long as the transaction affects interstate or foreign commerce.³ A valid electronic signature can be typing your name into a field, clicking an “I agree” button, or drawing your signature with a finger on a touchscreen, so long as you intend the action to be your signature.

When an organization sends the form through a patient portal, student information system, or secure email link, you must first receive a disclosure of your right to get a paper copy instead, the process for withdrawing electronic consent, and the hardware or software you need to view and store the document.³ You have to agree to the electronic process affirmatively; an organization cannot infer consent just because you once paid a bill online.

FERPA accepts the same approach. Signed and dated written consent may include a record and signature in electronic form, provided it identifies and authenticates you as the source and indicates your approval.²

Submitting the Form With Proof

Whatever submission method the organization accepts, the goal is proof the form arrived.

Online portals are the fastest route. After you click submit, the system should give you an email confirmation or a confirmation number. Save it. If you receive a verification link in a follow-up email, click it promptly; some organizations treat the authorization as incomplete until that second step is finished.

If you mail a paper copy, use USPS Certified Mail with a return receipt. The 2025 certified fee is $5.30 and a mailed return receipt adds $4.40; an electronic return receipt costs $2.82 instead.⁴ The return receipt gives you a signed record of who accepted the document and when, which matters if there is ever a dispute about whether the authorization was on file.

If you deliver the form in person, ask the registrar or office clerk for a date-stamped copy or a written receipt before you leave. Without proof of delivery, you have no way to show the authorization was submitted if the office loses it.

How Long the Authorization Lasts

No single federal rule makes every consent form last exactly 365 days. The duration depends on what you wrote on the form and the organization’s policy. A HIPAA authorization lasts until the expiration date or event you specified; one year is a common provider default, not a legal requirement. A school consent form often runs from the first day of the academic year to the last, regardless of when you signed it.

Watch for forms that expire on a fixed calendar date. One signed in March with a December 31 expiration gives you nine months of coverage, not twelve. If uninterrupted authorization matters, check whether the form runs from your signature date or from a fixed institutional date, and plan the renewal accordingly. Not every organization sends a reminder when renewal is due. Setting your own calendar alert a few weeks before expiration prevents a gap that could delay a records transfer or disrupt ongoing disclosures to an insurer.

Withdrawing Consent Before It Expires

You can revoke your authorization early. Under HIPAA, revocation must be in writing and takes effect once the covered entity receives it, with two exceptions: the entity does not have to reverse actions it already took in reliance on the original authorization, and if the authorization was a condition of insurance coverage, the insurer may retain the right to contest a claim.¹

Send a written statement to the organization that holds the records. Include your full name, date of birth or other identifier the organization uses to find your file, a clear statement that you are revoking the authorization, and the original authorization date if you have it. Use the same channels you would use to submit a new form: a secure portal, certified mail, or hand-delivery with a receipt.

FERPA does not spell out a formal revocation procedure. Because consent must be given before each disclosure, you can decline to re-authorize or notify the school in writing that your prior consent is withdrawn.

Keep Your Own Copy

Save a copy of every form you submit. HIPAA-covered entities must keep authorization documentation for at least six years from the date it was created or the date it was last in effect, whichever is later.⁵ FERPA does not set a federal retention period, so school policies vary by state and district. Store your copies somewhere secure, whether a locked file cabinet or an encrypted cloud folder. If you ever need to prove what you authorized and when, your own copy is far easier to produce than a records request.

When the Right to Sign Transfers

One boundary worth knowing if you have been signing on behalf of a child: those rights eventually shift to the child, and once they do, your signature stops being the one the form needs. Under FERPA, all rights held by the parent transfer to the student when the student turns 18 or begins attending a postsecondary institution at any age.⁶ After that, the school needs the student’s consent, not yours, before releasing education records. One exception: a school may still disclose records to parents without the student’s consent if the student qualifies as a dependent for federal income tax purposes.⁷

In healthcare, HIPAA defers to state law on when a minor can independently consent to treatment. The threshold is 18 in most states, but many allow minors as young as 12 to consent to specific categories of care such as mental health, substance use, or reproductive health. Once a minor has the legal right to consent to treatment, the minor also controls who can see the records from that care. If your family is approaching this transition, ask the provider’s office what state rules apply so a form you used to sign does not surprise you by requiring your child’s signature instead.

1
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
2
eCFR. 34 CFR 99.30 – Under What Conditions Is Prior Consent Required to Disclose Information
3
Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity
4
United States Postal Service. Shipping Insurance and Delivery Services
5
eCFR. 45 CFR 164.530 – Administrative Requirements
6
U.S. Department of Education. Eligible Student
7
U.S. Department of Education. FERPA