To authorize release of your records at MedStar, download the MedStar Health medical records release form from the medical records page at medstarhealth.org, fill in the patient details, the specific records and dates you want released, who should receive them, an expiration date, and your signature, then send the completed form to the Health Information Management department at the specific MedStar facility where you were treated.1MedStar Health. Medical Records Records are stored by facility, so the location you send it to matters as much as what’s on the page.
Where to Find the Form
MedStar posts the authorization as a downloadable PDF under the “Medical Records” section of its website. Two versions exist: a general authorization used across most MedStar hospitals and clinics, and a separate release form for MedStar Health Home Care patients. Download the one that matches where you were treated. Paper copies are also available at the Health Information Management office of any MedStar facility.
Completing Each Section of the Form
Patient Information
Enter the patient’s full legal name, date of birth, mailing address, phone number, and Social Security number. The SSN field asks for the complete number, which MedStar uses to match your identity in its records system. If you would rather not provide the full number, call the facility’s records office to ask whether a medical record number can substitute. The medical record number appears on prior hospital paperwork and billing statements.
Types of Records to Release
Check only the categories you actually need. Broader requests take longer to process. The general authorization lists:
- All records for the dates of service you specify
- Inpatient medical records from hospital stays
- Outpatient records, including office visits and specialist consultations
- Laboratory and pathology records such as blood work and biopsies
- X-ray and radiology records, including MRIs and CT scans
- Pharmacy and prescription records
- Billing records
- Psychotherapy and psychiatric care records, which receive special handling
- An abstract or summary rather than the full chart
- An “other” write-in line for anything not listed
Fill in the dates of service on the line provided, either as specific dates or a range. Some versions of the form include a “Last 2 years” checkbox. Be as specific as you can, because vague ranges force staff to search more broadly.
Recipient and Purpose
Write the full name and mailing address of whoever will receive the records. For a new doctor, list the physician’s name and practice address. For an attorney or insurance company, include the firm name, a specific contact person or department, and the address, so the records don’t get misrouted. The purpose section has checkboxes such as “at my request,” “for my health care,” “for payment/insurance,” and “for employment purposes,” plus an open “other” field. Only the patient can check “at my request.”
Expiration Date
Every HIPAA authorization needs either an expiration date or an expiration event. Write in a specific date, for example 12/31/2026, or describe a triggering event such as “resolution of my legal case.” Under Maryland law, an authorization cannot be valid for more than one year from the signing date. Don’t set the expiration so short that it lapses before the records department finishes the job.
Signature
Sign and date the bottom of the form. An unsigned form is invalid and will be returned. If someone else is signing as a personal representative, use the authority line to describe the basis, such as “parent,” “guardian,” “power of attorney for healthcare,” or “executor.”
Who Can Sign on the Patient’s Behalf
An adult patient normally signs. When someone else needs to sign, HIPAA allows a personal representative to act, and the form has a line to describe that authority.
- For minor patients, a parent or legal guardian generally signs. HIPAA treats parents as the personal representative of their minor children in most circumstances.
- For incapacitated adults, a healthcare power of attorney or court-appointed guardian signs. Bring the underlying legal document, because the records department may ask for proof before releasing anything.
- For deceased patients, the executor or estate administrator signs and should note that role on the authority line. Letters testamentary or letters of administration may be requested.
MedStar’s website states that a family member requesting records for a minor or incapacitated patient must have their name documented on the request, and that written permission from the patient or evidence of power of attorney is expected.
Where to Send the Completed Form
Send the signed form to the Health Information Management office at the MedStar facility where you received care. Each hospital and clinic maintains its own records, so a form sent to the wrong location gets rerouted or lost. MedStar accepts requests in person, by mail, and by fax where a fax number is published.
Commonly used submission points include:
- MedStar Washington Hospital Center, 110 Irving St. NW, Washington, D.C. 20010, phone 855-651-1882
- MedStar Georgetown University Hospital, 3800 Reservoir Rd. NW, Bles Building, Lower Level Room 140, Washington, D.C. 20007, phone 202-444-3392
- MedStar Franklin Square Medical Center, 9000 Franklin Square Drive, 2 North, Release of Information, Baltimore, MD 21237, phone 443-777-7270, fax 443-777-7971
- MedStar Union Memorial Hospital, 201 E. University Pkwy., Baltimore, MD 21218, phone 410-554-2000
- MedStar Montgomery Medical Center, 18101 Prince Philip Drive, Olney, MD 20832, phone 301-774-8661 (press 1)
- MedStar St. Mary’s Hospital, 25500 Point Lookout Rd., Leonardtown, MD 20650, phone 301-475-6181, fax 240-434-7181
The full list of facility addresses, phone numbers, and fax numbers is on the MedStar Health medical records page.1MedStar Health. Medical Records
Fees and Processing Time
MedStar typically processes records requests within 5 to 10 business days. If you were recently discharged, the chart may not be finalized, and a complete copy of a hospital stay can take up to 30 days.1MedStar Health. Medical Records Federal law requires a covered entity to act on an access request within 30 days, with one 30-day extension allowed if the entity provides a written explanation.2eCFR. 45 CFR 164.524
The form states that if pre-payment is not requested, you will be billed for copying and postage costs in accordance with state law.3MedStar Health. MedStar Health Medical Records Release Form Because most MedStar facilities are in Maryland, the Maryland Health-General Article governs fee limits for those locations. Maryland caps paper copies at $0.76 per page, plus a preparation fee of up to $22.88 for retrieval and assembly, with postage added on top. Electronic copies use a reduced per-page rate capped at $80 for the per-page portion.4Maryland General Assembly. Maryland Code Health-General 4-304 For patients enrolled in Maryland Medicaid, the total fee cannot exceed $20 per 100 pages. These figures are adjusted annually for inflation, so confirm current rates with the facility.
HIPAA separately limits what you can be charged for your own records. The fee must be reasonable and cost-based, covering copying labor, supplies, and postage, not search-and-retrieval time.5eCFR. 45 CFR 164.524 If a fee looks excessive, you can file a complaint with the HHS Office for Civil Rights.
Sensitive Records That Need Extra Steps
Psychotherapy Notes
Psychotherapy notes, meaning the private session-by-session notes a therapist writes during counseling, receive heightened protection under HIPAA. An authorization for psychotherapy notes cannot be combined with an authorization for any other type of record. If you check the psychotherapy and psychiatric care box on the MedStar form, the form itself warns that this authorization may need to stand alone.6MedStar Health. General Medical Records Release and Authorization for Use or Disclosure of Protected Health Information You may need to submit two separate forms: one for general medical records and a second for psychotherapy notes.7eCFR. 45 CFR 164.508
Psychotherapy notes do not include medication records, session start and stop times, treatment plans, diagnoses, or progress summaries. Those are part of the general medical record and can be released on the standard form.8U.S. Department of Health and Human Services. Does HIPAA Provide Extra Protections for Mental Health Information
Substance Use Disorder Records
Records from federally assisted substance use disorder treatment programs are protected under 42 CFR Part 2 and generally cannot be disclosed without specific written consent that meets requirements beyond a standard HIPAA authorization. The MedStar home care form notes that confidentiality of records for patients in a drug abuse or alcohol treatment program are protected by federal confidentiality rules.9MedStar Health. MedStar Health Home Care Medical Record Release Authorization Form If your records include substance use treatment, contact the facility’s records office to confirm whether the standard release form is enough or whether a separate consent document is required.
The form also warns that if your records contain information about HIV/AIDS status, cancer diagnosis, mental health treatment, or sexually transmitted diseases from previous providers, signing the authorization consents to release of that information as well.
Revoking an Authorization You Already Signed
You can cancel a previously signed authorization at any time by sending a written revocation to the facility that received the original form. The revocation takes effect when the records department receives it and does not undo disclosures that already happened while the authorization was active.7eCFR. 45 CFR 164.508 The MedStar home care form directs revocations to the Privacy Liaison at the home care office in Rosedale, Maryland. For a hospital-based authorization, send the written revocation to the same Health Information Management department that received the original. Keep a copy for yourself.
Requesting a Correction to Your Records
If you review your records and find an error, such as a wrong medication, an incorrect diagnosis, or a note tied to the wrong visit, you can request an amendment. Submit the request in writing, identifying the specific information you believe is inaccurate and explaining why it should change.
The provider must respond within 60 days and can take one 30-day extension with written notice of the reason. An approved correction is added to your record and shared with anyone you designate. A denial letter must state the reason and inform you of your right to submit a written statement of disagreement, which then becomes part of your permanent record. Improper denials can be reported to HHS.2eCFR. 45 CFR 164.524