Key takeaways
Fill, sign, and submit NY OCA 960 from any browser — or have AI generate a custom version in seconds. No installs, no printing, no back-and-forth.
- The New York HIPAA Authorization Form permits the disclosure of protected health information to third parties for specific purposes.
- A patient or their legally authorized representative must sign and date the form to authorize the release of medical records.
- The form requires a detailed description of the health information to be shared and the identity of the recipient.
- Every authorization must include a specific expiration date or event that terminates the permission to share information.
- Signing this form cannot be required as a condition for receiving medical treatment, payment, or eligibility for health benefits.
- Patients have the right to revoke their authorization in writing, although certain legal exceptions to this right may apply.
What is NY OCA 960?
New York HIPAA Authorization Form (Patient Authorization for Disclosure of Health Information (New York)) is a legal document used to obtain a patient's or their authorized representative's permission for a covered entity to use or disclose protected health information. This health information release allows providers like doctors or health plans to share medical data for purposes other than standard treatment, payment, or healthcare operations. It serves as a vital tool for protecting patient privacy rights while ensuring that necessary medical records can be securely shared with third parties.
The document captures essential details to ensure the disclosure is specific and meaningful. It requires a clear description of the information to be released, the name of the entity authorized to make the disclosure, and the specific recipient of the information. Additionally, the form must outline the purpose of the disclosure, include an expiration date or event, and provide a statement regarding the individual's right to revoke their authorization in writing at any time, explaining any exceptions to that right.
U.S. Department of Health and Human Services (HHS); New York State Department of Health (NYSDOH)
Who needs the NY OCA 960 — and who doesn't
Not everyone files NY OCA 960. The checklist below tells you whether it applies to your situation — and points you to the right alternative if it doesn't.
You need this NY OCA 960 if…
- you are a patient in New York State who wants to grant a third party permission to access your protected health information
- you are a legally authorized representative, such as a parent, legal guardian, or healthcare proxy, acting on behalf of an individual
- you need to authorize a covered entity to use or disclose medical records for purposes other than treatment, payment, or healthcare operations
You do not need this NY OCA 960 if…
- the health information is being used or disclosed for standard treatment, payment, or healthcare operations
- the disclosure is required for public health activities, health oversight, or reporting abuse and neglect
- the records are requested for judicial proceedings, law enforcement purposes, or workers' compensation
Why you need the NY OCA 960
Why people fill out NY OCA 960, and what tends to go wrong when they don't.
-
Controlled Data Sharing This form allows you to specify exactly which health information is shared and for what purpose, ensuring your records are only disclosed to authorized recipients for a specific, limited duration.
-
Protect Patient Privacy By signing this authorization, patients or their legally appointed representatives can formally grant permission for third parties to access sensitive health information that is not otherwise permitted by law without consent.
-
Formal Records Release This document serves as a formal medical records release, facilitating the transfer of files to third parties while providing a written statement of your legal right to revoke the authorization.
-
Secure Digital Management Use pdfFiller to fill, sign, and share this form digitally. The platform provides secure encrypted storage and maintains HIPAA compliance to protect your sensitive health information throughout the disclosure process.
NY OCA 960 vs. similar documents
NY OCA 960 gets mixed up with similar documents more than most. Here's how to tell them apart, and what filing the wrong one actually costs.
| Comparison criteria | New York HIPAA Authorization Form | Form DOH-5032 |
|---|---|---|
| Purpose | Authorize disclosure of protected health information. | Release health information held by NYSDOH. |
| When to use | Sharing medical records with third parties. | Accessing records from New York Health Department. |
| Signatures required | Patient or legally authorized representative. | Patient or legally authorized representative. |
| Filing | Provided to the specific healthcare entity. | Submitted to New York Department of Health. |
| Governing reference | HIPAA and NY Public Health Law. | HIPAA and NYSDOH regulations. |
What each section of NY OCA 960 means
Every section explained — what it's asking, the records you'll need on hand, and the mistakes that most often cause a rejection or follow-up request.
| Health Information Description | Clearly identify the specific medical records or health information you are authorizing for use or disclosure, ensuring the description is meaningful and detailed. |
|---|---|
| Authorized Disclosing Entity | Enter the name of the healthcare provider, hospital, or organization that currently holds the records and is authorized to release the information. |
| Information Recipient Name | Specify the name of the individual, insurance company, or organization that is authorized to receive the patient’s protected health information. |
| Purpose of Disclosure | Provide a brief description explaining why the health information is being shared, such as for legal matters, insurance claims, or personal use. |
| Authorization Expiration Date | Enter a specific date or describe an event that will trigger the end of this authorization, after which no further information may be disclosed. |
| Signature and Date | The patient or their legally authorized representative must sign and date the document to validate the permission for health information disclosure. |
| Right to Revoke | Information explaining that the individual has the right to cancel this authorization at any time by providing a written notice to the disclosing party. |
| Revocation Exceptions Process | Description of any circumstances where the right to revoke is limited and the specific steps required for the individual to cancel the authorization. |
| Re-disclosure Warning Statement | A notice explaining that information disclosed to the recipient may be shared again and might no longer be protected by federal privacy regulations. |
| Condition of Treatment | A statement confirming that signing this form is not a requirement for receiving medical treatment, payment, enrollment, or eligibility for health benefits. |
How to fill out NY OCA 960 using pdfFiller
A walkthrough from the first field to the signature line. With your records in front of you, most people finish in under ten minutes.
-
Open the form Click Get Form to open New York HIPAA Authorization Form in the pdfFiller editor to begin customizing your document for the release of protected health information.
-
Identify disclosure parties Use the text tool to enter the name of the person or entity authorized to disclose the information and the specific recipient authorized to receive the records.
-
Describe health information Click the designated text fields to provide a specific and meaningful description of the health information you wish to disclose as part of this new york medical release.
-
Specify disclosure purpose Type a detailed description of each purpose for the requested use or disclosure in the provided fields, explaining why the information is being shared with the recipient.
-
Set expiration details Select the date picker or click the text field to enter a specific expiration date or event that relates to the individual or the purpose of the disclosure.
-
Review legal statements Carefully read the required statements regarding your right to revoke authorization, the risk of re-disclosure, and the non-conditioning of treatment before finalizing your hipaa form template.
-
Sign and date Click the signature field to add a legally binding e-signature and use the date tool to record when the individual or their authorized representative signed the document.
-
Save and share Click Done to save the finished PDF; you can then share it via link, email, or fax using pdfFiller, which maintains secure encrypted storage and HIPAA compliance.
Deadlines, key dates & penalties for NY OCA 960
When NY OCA 960 is due, what late filing actually costs, and how to request more time if you need it.
| Federal HIPAA Penalties | Violations of federal privacy regulations can result in civil penalties ranging from $100 to $50,000 per violation, with an annual cap of $1.5 million for identical violations. Criminal penalties for knowingly obtaining or disclosing protected health information can reach $250,000 and include up to 10 years of imprisonment. |
|---|---|
| New York State Penalties | Under New York Public Health Law, civil penalties for violations of patient information access rights may include fines of up to $1,000 for each occurrence. |
| Filing Deadlines | There is no universally mandated filing deadline for this authorization form, as it is typically executed on an as-needed basis to facilitate the release of medical records. |
Related content
The forms, guides, and worksheets most filers reach for alongside NY OCA 960.
Key terms used in NY OCA 960
A one-sentence glossary of the NY OCA 960 terms and concepts you'll see throughout this guide.
- Protected Health Information (PHI)
- Individually identifiable health data protected by law that this form allows a healthcare provider or plan to share.
- Covered Entity
- A healthcare provider or health plan that must comply with privacy rules when using or disclosing patient health information.
- Authorized Representative
- A person legally permitted to act for the patient, such as a parent, legal guardian, or healthcare proxy.
- Revocation
- The process of canceling this authorization in writing to prevent further disclosure of protected health information.
- Re-disclosure
- The act of a recipient sharing health information with others, potentially after it is no longer protected by HIPAA.
Frequently asked questions about NY OCA 960
Quick answers to the questions we hear most often about completing the NY OCA 960.
The New York HIPAA Authorization Form allows a patient or their representative to grant permission for a covered entity to disclose protected health information for purposes other than treatment, payment, or healthcare operations. This document protects patient privacy while ensuring that necessary medical records can be shared with third parties for specific, defined reasons.
This form must be signed and dated by the patient or their legally authorized representative, such as a parent, legal guardian, or healthcare proxy. If a representative signs on behalf of the patient, they must also provide a description of their legal authority to act, ensuring the disclosure is legally valid under state and federal law.
Covered entities may disclose protected health information without a signed authorization for treatment, payment, healthcare operations, and specific public interest activities like reporting abuse or workers' compensation. Other exceptions include disclosures for judicial proceedings, law enforcement purposes, or serious threats to health and safety, as permitted by federal HIPAA regulations and New York Public Health Law.
The authorization must include a specific description of the information to be disclosed, the names of the parties authorized to release and receive the data, and the purpose of the disclosure. It also requires an expiration date or event, a statement regarding the right to revoke the authorization, and a warning that disclosed information may be subject to further re-disclosure.
Federal civil penalties for HIPAA violations can reach $1.5 million per year, while New York Public Health Law allows for civil fines up to $1,000 per violation. Criminal penalties for knowingly obtaining or disclosing protected health information can result in fines up to $250,000 and imprisonment for up to ten years, depending on the severity and intent of the violation.
You have the right to revoke your authorization at any time in writing, except to the extent that the covered entity has already taken action based on it. The form must provide instructions on how to submit a written revocation and explain any exceptions to this right, ensuring you maintain control over your protected health information.
You can fill out, complete, and eSign the New York HIPAA Authorization Form using pdfFiller's secure online platform. pdfFiller allows you to add a legally binding electronic signature, share the document via a secure link or email, and store the finished PDF in an encrypted environment that is compliant with GDPR, HIPAA, SOC 2, and PCI DSS standards.
