Release Of Records Form Template for England and Wales
Generate a bespoke document
What is a Release Of Records Form?
A Release of Records Form in England and Wales authorises a holder of personal records to disclose them to a named recipient. It supplies the documented consent required by UK GDPR and the Data Protection Act 2018. The form should identify the type of records, the time period covered, the releasing organisation, and the purpose, ensuring the disclosure is both specific and auditable.
Frequently Asked Questions
What is a Release of Records Form?
It's a consent document authorising an organisation that holds records, such as a hospital, school, or employer, to release copies of those records to a named individual or third party. In England and Wales, it provides the documented consent required under UK GDPR before personal records can lawfully be shared.
What types of records can this form cover?
The form can cover medical records, educational records, employment files, financial records, or any other documents held by an organisation that relate to the individual. Each category may carry additional legal requirements, particularly for health records governed by the Access to Health Records Act 1990.
Can someone request their own records without this form?
Yes. An individual can make a Subject Access Request under UK GDPR to obtain their own data. A Release of Records Form is typically used when the individual wants a third party, such as an insurer, solicitor, or new employer, to receive the records directly rather than going through a SAR.
Do medical record releases require special consent?
Yes. Health information is special category data under UK GDPR, requiring explicit consent. The Access to Medical Reports Act 1988 also gives individuals the right to review any medical report prepared for an employer or insurer before it's released. Standard consent forms should reflect these heightened requirements.
Can a Release of Records Form be used for a deceased person's records?
UK GDPR does not apply to deceased individuals, but the Access to Health Records Act 1990 gives certain people, such as the patient's personal representative, a right of access to health records. The appropriate form or application process differs for deceased individuals' records.
How specific does the form need to be?
It should be as specific as possible. Blanket authorisations covering all records are less legally robust than forms naming the type of record, the time period, the releasing organisation, and the recipient. Specificity reduces the risk of an overly broad disclosure and demonstrates genuine informed consent.
How long does an organisation have to respond to a records release?
Where the release is processed as a Subject Access Request under UK GDPR, the organisation has one calendar month to comply. For releases based on consent rather than a SAR, the organisation's own procedures govern timing, though unreasonable delay may still raise data protection concerns.
How does GenieAI assist with this document?
GenieAI generates a records release form structured for England and Wales, covering the consent language, data description, and recipient details required for UK GDPR compliance. The finished document is ready to complete, sign, and submit to the record-holding organisation.
About the Release Of Records Form
A Release Of Records Form is a legally binding document that authorizes the disclosure of confidential information while ensuring compliance with federal and state privacy laws. When you need access to protected records such as medical files, educational transcripts, or government documents, this form serves as your legal gateway to obtaining that information. The form establishes clear boundaries around what information can be shared, with whom, and under what circumstances, protecting both the record holder and the subject of the records.
When do you need this document?
You'll need a Release Of Records Form whenever you're requesting access to confidential information protected by privacy laws. Healthcare providers require this form before sharing medical records with insurance companies, specialists, or family members. Educational institutions use these forms when students transfer schools, apply for jobs, or when parents need access to their child's academic records. Employers may need signed releases to verify educational credentials or obtain background check information. Legal professionals use these forms to gather evidence for cases, while government agencies require them for benefits applications or security clearances. Insurance companies also rely on these forms to access medical or educational records when processing claims or applications.
Key legal considerations
The form must clearly identify all parties involved, including the record holder, requesting party, and subject of the records. You must specify exactly which records are being requested rather than using broad language like "all records." The purpose for requesting the records must be stated explicitly, as this affects what information can legally be disclosed. Include a specific expiration date for the authorization, as indefinite releases are generally not permitted under privacy laws. The form should include language explaining the subject's right to revoke authorization at any time and any limitations on re-disclosure of the information. Consider whether the requesting party has legitimate authority to access the records and ensure proper identification verification procedures are in place.
Legal requirements in United States
Under HIPAA, medical records releases must include specific elements such as a description of the information to be used or disclosed, identification of who may make the disclosure, the purpose of the disclosure, and an expiration date. The Privacy Rule requires that authorizations be written in plain language and include the individual's right to revoke consent. FERPA governs educational records and requires schools to obtain written permission before disclosing personally identifiable information from student records, with exceptions for directory information and certain administrative purposes. The Privacy Act of 1974 applies to federal agency records and requires agencies to obtain written consent before disclosing personal information, with specific procedures for verification of identity. State privacy laws may impose additional requirements, including longer retention periods for authorization forms, specific formatting requirements, or enhanced consent procedures for sensitive information categories.
GOVERNING LAW
Applicable law
This Release Of Records Form is drafted to comply with England and Wales law. Key legislation includes:
Explore 208,390+ legal templates
Explore 208,390+ legal templates
Genie's Security Promise
Genie is the safest place to draft. Here's how we prioritise your privacy and security.
Your data is private:
We do not train on your data; Genie's AI improves independently
All data stored on Genie is private to your organisation
Your documents are protected:
Your documents are protected by ultra-secure 256-bit encryption
We are ISO27001 certified, so your data is secure
Organizational security:
You retain IP ownership of your documents and their information
You have full control over your data and who gets to see it