What is required when releasing a client’s records to a third party in PA?

• A. A verbal request from the client with no written record.
• B. No authorization needed for medical records.
• C. A written, signed authorization specifying scope, purpose, recipients, and duration, consistent with HIPAA and state laws.
• D. A court order is sufficient for any release without client consent.

Answer: (C)

Releasing a client’s records to a third party requires a written, signed authorization. Under HIPAA, disclosures beyond what is allowed without consent need a specific patient authorization, and Pennsylvania law mirrors that protection for mental health records. A verbal request or no authorization at all does not meet the standard.

The authorization must spell out four key elements: what is being released (the scope of records), why the release is happening (the purpose), who will receive the records (the recipient), and how long the authorization lasts (the duration). It should be signed by the client or a legally authorized representative, and it should allow the client to revoke the authorization in writing if they choose. In addition, the information released should be limited to the minimum necessary to achieve the purpose.

There are narrow exceptions where a release may occur without prior authorization (for example, to protect safety or in response to a court order), but these are specific circumstances and do not replace the general requirement for a written authorization when releasing records to a third party.