Extract data from medical records release forms
Unstract reads medical records release forms and HIPAA authorizations that arrive by fax, mail or email, checks each one for a signature, an expiry and a clear scope, and sends the request record to your EHR or release-of-information system.
need by 11/20 for deposition - call w/ questions
HIM-ROI-02 (REV 2026/01) · PAGE 1 OF 1
{ "patient": "Halvorsen, Margit", "date_of_birth": "09/23/1971", "mrn": "RRM-00418826", "recipient": "Pruitt & Ashby Law Group", "purpose": "Legal", "records_from": "01/01/2025", "records_to": "06/30/2026", "expires_on": "02/02/2027", "signed_by": "Patient", "confidence": 0.95}
Trusted by healthcare and revenue cycle teams around the globe
Every requester sends the authorization on its own paper
Your own release form is the easy case. Law firms, insurers and other hospitals send theirs, and patients write their requests on whatever they have to hand.
Faxed from a law office, then faxed again by the clinic
The patient struck out "entire record" and listed three items instead
Your form, an attorney's form and an insurer's form
Cover letter, authorization, ID and power of attorney in one fax
An insurer's letter listing the visits it wants copied
Release of information staff read every request line by line to find the patient, the recipient, the scope and the expiry, and a missed detail sends the wrong records to the wrong party.
Unstract reads each authorization, pulls the fields your team logs, flags a missing signature, a past expiry or an unclear scope, and sends the request to your EHR or release-of-information system.
Read the authorization, check it is complete, queue the request
LLMWhisperer reads the release form, Document Studio returns the request record with its checks, and Flow carries it into your release of information work. Each product runs on its own, so an ROI desk can start with one week of requests.
Read medical records release forms with every box and initial in place
A release form decides what leaves the building, and the small marks carry the weight: which record types are ticked, whether the mental health box is initialed, where the date range ends. LLMWhisperer keeps the layout, so a ticked box stays with its own label and the recipient's address never merges with the facility letterhead. It reports filled and empty checkboxes, reads handwriting beside printed text, and handles forms that were faxed twice or photographed on a phone.
Send the text to your own LLM, or make it the first step of a full release of information run.
Learn more about LLMWhispererTurn each medical records release form into one checked request record
Describe the request record once: patient and identifiers, requester and recipient, purpose, record types, sensitive categories, date range, expiry, revocation acknowledgment, signature and signer. HIPAA authorization form data extraction then returns the same JSON from your own form, an attorney's form or an insurer's form. The checks you set ride along with each record: a signature and date are present, the expiry has not passed, every sensitive category carries the initials your policy asks for, and a representative states a relationship.
Deploy it as an API behind your request portal, or as an ETL pipeline over the fax inbox your ROI team works from.
Learn more about Document StudioRun release of information from the fax to the release log
Describe your medical records release forms, and the cover letters and IDs that come with them, in plain language, and Flow's agents build the release workflow from that description. You approve it, and every request then runs through it the same way: picked up from the fax line, the mailroom scan or the email inbox, read, matched to the patient's chart, checked, and logged in your EHR or release-of-information system. Medical records request processing stays in one place, with each step recorded.
A missing signature, a past expiry, an uncertain patient match or a sensitive category stops for a release specialist, with the reason attached. Unstract reads the form and checks it is complete. Your ROI team decides whether the authorization is valid under your policy and which records go out.
Learn more about FlowRead a week of release forms today. Plan the ROI run with us.
Start for free and extract a folder of authorizations. A run that logs requests in your EHR or release-of-information system starts with a consultation.
Release authorizations, records requests and the papers faxed with them
Documents
- Medical records release forms
- HIPAA authorization forms
- Authorization for use or disclosure of protected health information forms
- Authorizations to release medical information
- Medical information release forms
- Medical records request forms
- Patient requests for their own records
- Attorney records requests
- Insurer and claims records requests
- Provider-to-provider records requests
- Power of attorney and personal representative papers
- Revocations of authorization
Fields captured
Built for the people who decide what leaves the chart
Every incoming authorization read and checked before a specialist opens it, with incomplete requests already sorted for a call back.
A record of what each form authorized, who signed it and which checks it passed, ready for an audit or a patient complaint.
Requests on your own authorization form read the same way as the hospital's, so fewer come back for a missing initial or date.
One way of reading release forms across every hospital and clinic in the system, whichever form the requester used.
Fewer requests read twice, fewer sent back
The form that authorizes disclosure, kept under tight control
A release form is the permission to send protected health information out of the building. It names the patient, the records and the party who may receive them, and a release made on a misread form is a breach that reaches the patient, the recipient and your privacy officer.
- Encrypted in transit and at rest.
- Release forms and the records they cover are never used to train models.
- Access by role, facility and request type, with every correction recorded against the request.
- Processed forms are deleted on the retention schedule your health system sets.
- Self-hosted deployment for health systems that keep PHI inside their own network.
What release of information teams ask first
Look for one that reads scans and faxes with the layout intact and returns the fields you name as structured data. Unstract does both: LLMWhisperer reads the page, and Document Studio returns the record as JSON for each document type, from release authorizations to discharge summaries, with unclear values sent to a person.
Start with the reading. Document Studio pulls the patient, recipient, scope, dates and signature from each authorization, and Flow runs the request from the fax inbox to the log in your EHR or release-of-information system. Your specialists keep the decision on each release.
Yes. Release of information form OCR with LLMWhisperer shows filled and empty checkboxes and reads handwritten initials beside each one, so an unticked substance use box comes back as unticked.
Yes. You describe the request record once, and Unstract fills the same schema from your own form, a law firm's form, an insurer's form or a patient's handwritten letter. No template per requester.
No. Unstract reads the form and flags what is missing or past its date: a signature, an expiry, the initials on a sensitive category, a representative's relationship. Your ROI team decides whether the authorization meets your policy and what to send.
Sensitive categories come back as their own fields, ticked or not, with the initials beside them. You can set any request that touches them to stop for a release specialist every time.
The request waits in a review queue. A specialist sees the field and the spot on the page it came from, confirms or corrects it, and the change is recorded against the request. Clear forms carry on.
Yes. POST a scanned authorization to the endpoint for that form type and the request record comes back as JSON, with flagged fields marked for review.
Flow compares the name, date of birth and record number on the form with your EHR and logs the request against the matching chart. An uncertain match stops for a person instead of guessing.
Unstract is SOC 2, ISO 27001, GDPR and HIPAA compliant. Forms are encrypted in transit and at rest, never used to train models, and deleted on your retention schedule. Health systems can self-host. See the Trust Center for the controls.
An ROI lead can start for free and upload a release form the same day. For the full request run, we build it with your HIM and IT teams in a consultation, around your forms and your EHR or release-of-information system.
Bring last month's release requests to the consultation
Your own forms, attorneys' forms, insurer letters and patient notes. We read them in the session and show which ones would have stopped for a missing signature, expiry or initial.