Authorization for Release of Medical Information

By Elizabeth Franklin-Best, Esq., and Christopher Zoukis, JD, MBA

Form number	BP-A0621
Title as printed	Cannot be verified — BOP does not publish this form. Its own Program Statements give it two different titles (below)
Form-face date	Cannot be verified — form not published
Prescribed by	Cannot be verified from the form
Replaces	Cannot be verified — form not published
Governing Program Statements	6090.04 Health Information Management (March 2, 2015); 6031.06 Patient Care (June 22, 2026); 5260.01 (February 19, 2026)
Governing regulation	28 C.F.R. part 513, subpart D; 28 C.F.R. § 513.40. BOP is not a HIPAA covered entity
Published by BOP?	No. BP_A0621.pdf returns 404 — while neighbors BP-A0620 and BP-A0622 are live (checked 2026-09-07)
Distribution as printed	Cannot be verified. Signed form is filed in Section 6 — Administrative of the health record
How long it stays valid	Three months from the date of the patient’s signature (PS 6090.04 at p. 8)
Official PDF	None. Governing policy: PS 6090.04 · PS 6031.06

Checked against the BOP policy and form set · 2026-09-07 · How we verify

A BP-A0621 is the Bureau of Prisons’ written consent form for moving medical records across the prison wall — either releasing an incarcerated person’s health records out to a lawyer, family member or outside doctor, or authorizing the Bureau to pull records in from a community provider who treated them before. The Bureau does not publish a blank copy of it, so what follows is built from the Program Statements that create and control it — principally the medical records access policy and Patient Care, with practical context on our medical and dental care page.

Why you cannot download this form

We tested rather than assumed. On 7 September 2026 we requested BP_A0621.pdf from the Bureau’s public form directory at bop.gov/policy/forms/, along with BP_S621.pdf and BP_621.pdf. All returned HTTP 404.

The revealing part is what sits either side of it. BP_A0620.pdf (Patient Problem List) and BP_A0622.pdf (Radiologic Consultation Request/Report) both returned live PDFs from that same directory in the same session. So did BP-A0615, BP-A0618, BP-A0619, BP-A0623 and BP-A0624. The BP-A06xx health-services series is heavily published; BP-A0621 is a hole in the middle of a published run. That rules out a naming-convention error on our part — the convention is demonstrably right, and the file is simply not there.

Both neighbors carry the printed header the published forms use: form number, a form-face date of “JUN 10,” the “CDFRM” designation, and a “Paper Form. For Print Only.” notice. We cannot tell you whether BP-A0621 carries the same, because we have not seen it. We will not reconstruct a form we have not read — no invented block numbers, no invented signature language, no description of “the top of the form.”

That absence matters. This is a consent document, and the agency asking for the signature does not publish the text being signed. If you are asked to sign one, read the copy in front of you and ask for a copy of what you signed.

It has two different official names

The Bureau itself is inconsistent about what this form is called, which is why searches for it so often come back empty.

Program Statement	Edition	Title it gives BP-A0621
6090.04 Health Information Management	March 2, 2015	Authorization for Release of Medical Information (PS 6090.04 at p. 20)
5260.01	February 19, 2026	Authorization for Release of Medical Information (PS 5260.01 at p. 5)
6031.06 Patient Care	June 22, 2026	Authorization for Release of Medical Records (PS 6031.06 at pp. 11, 54, 60)

The most recent statement — Patient Care, reissued 22 June 2026 as part of the Bureau’s mass policy reissue — uses “Records.” The older statements use “Information.” The form number is stable across all three; only the title moves. Search on the number.

What the Bureau’s policy says a release must do

This is the Program Statement’s own description of the requirements, not the form. It is the operative text, and it contains the one deadline on this page.

d. “Third Party” Requests. The first party is the patient-inmate, the second party is the custodial agency holding the health records and providing care. All third party requests for medical information will be processed under direction of OGC’s FOIA/Privacy Act Section in the Central Office. A dated authorization form that has been notarized or signed under penalty of perjury must accompany any request. The authorization is valid for three months from the date of patient’s signature. Requests from the Social Security Administration (SSA) will not be forwarded to the OGC’s FOIA section. SSA requests will be processed at the institution level.

Reproduced verbatim from Program Statement 6090.04 at p. 8, and checked against the original PDF in layout mode. This is the Program Statement’s description of what an authorization must do, not the text of the form itself.

Four things in that paragraph do real work.

It must be dated, and the three-month clock runs from the date of the patient’s signature rather than the date the request is received. It must be notarized or signed under penalty of perjury — a plain signature is not what the policy calls for, and getting this wrong is a common reason a request comes back.

Three months is short. If a lawyer needs records for a filing, or a family member is gathering documents for a medical compassionate release request, an authorization signed at the start of the process can lapse before the records arrive.

Third-party requests route through Central Office, under the Office of General Counsel’s FOIA/Privacy Act Section — not the institution. Social Security Administration requests are the stated exception, handled at the institution.

The form runs in two directions

Most people meet this form in one direction and assume that is all it does. It works both ways.

Records going out. PS 6031.06 at p. 54 addresses sharing medical information with family: an incarcerated person “may elect to request copies of portions or the entire medical record to be sent to the next of kin or other outside entity provided there is a signed release of medical information completed on BP-A0621.” The same statement, at p. 11, directs that where a community physician is permitted to examine someone during incarceration, “[t]he inmate will execute the BP-A0621.”

Records coming in. PS 5260.01 at p. 5 directs that where someone reports a documented pre-incarceration medical history, “Health Services staff will request completion of a BP-A0621 … to obtain prior medical records relevant to the inmate’s care.” Here the person is not releasing Bureau records — they are authorizing the Bureau to collect records from outside doctors. The same passage directs that a refusal to sign “will also be documented in the electronic health record as a General Administrative Note.”

Read the copy in front of you closely enough to know which direction it points. The two have different consequences, and nothing on this page tells you whether to sign either one.

BOP is not a HIPAA covered entity

This is the single most misunderstood point about federal prison medical records, and the Bureau states it plainly in its own policy.

While the Bureau is not a HIPAA covered entity, most community-based healthcare providers with which the bureau contracts are HIPAA covered entities.

PS 6090.04 at p. 9.

We verified the regulation the Bureau relies on. 45 C.F.R. § 164.512 permits a covered entity to disclose protected health information without the individual’s authorization “to a correctional institution or a law enforcement official having lawful custody of an inmate,” where the institution represents the information is necessary for one of six listed purposes — beginning with “[t]he provision of health care to such individuals” and ending with “[t]he administration and maintenance of the safety, security, and good order of the correctional institution.” The Bureau’s conclusion follows at p. 10: “an inmate does not need to sign a release of information form or otherwise give consent in order for Bureau health services staff to obtain copies of his/her medical records.”

There is therefore a gap between what the policy says is legally required for records coming in and what staff are directed to request. PS 5260.01 instructs staff to ask for a signed BP-A0621; PS 6090.04 says consent is not needed for that purpose. Both are current Bureau policy. We flag the tension rather than resolve it — resolving it would mean telling you whether to sign, which is a decision for you and your lawyer.

One limit in the regulation matters: “an individual is no longer an inmate when released on parole, probation, supervised release, or otherwise is no longer in lawful custody.” Once someone leaves custody the exception stops applying, and a signed authorization becomes the ordinary route.

Applied Insight — Christopher Zoukis, JD, MBA, Managing Director: When we build a medical record for a sentence-reduction or care-advocacy matter, we treat the authorization as perishable and get a fresh, properly executed one at the moment the request goes out rather than at intake. We also ask for the records by name and date range. The Bureau’s own policy directs staff to narrow voluminous requests, so a request that specifies what it wants moves faster than one asking for everything.

What it costs, and what you actually receive

The fee schedule sits in the same Program Statement, and is more generous than people expect.

c. Fees. Under 28 CFR 16.11, an inmate may be charged $.10 per page for duplication. An inmate may never be charged for a review of his/her records. A charge for fees may not be levied if the total to be collected is $14.00 or less.

The first 100 pages are free with no subsequent charge until a fee in excess of $14.00 is reached:

Pages 1-240 = No charge. Pages 241 and above = charged $.10 per page for each page after the first 100.

Example: 241 pages = 241-100 = 141 pages x $.10 = $14.10 335 pages = 335-100 = 235 pages x $.10 = $23.50

Reproduced verbatim from PS 6090.04 at p. 8, checked against the original PDF in layout mode.

The arithmetic is the agency’s own and internally consistent: 100 pages free, the remainder at ten cents, and nothing collected unless the total exceeds $14.00 — which is why 240 pages still costs nothing. Reviewing your own records is always free. Copies are not released until fees are paid, and the institution’s Trust Fund Manager handles collection.

Two limits sit alongside the fees. Imaging films are handled separately: the Bureau estimates the cost from a community source and sends the films to a physician the requester names rather than to a housing unit. And for people already released or in a Residential Reentry Center, PS 6090.04 at p. 7 directs that requests sent to the institution be returned with instructions to write to the Central Office address instead, with identity established by a notarized signature or one made under penalty of perjury.

BP-A0621 or DOJ-361? They are different routes

Both documents move records, and people frequently reach for the wrong one.

	BP-A0621	DOJ-361 Certification of Identity
What it is	The Bureau’s consent form for releasing or obtaining medical records	A Justice Department identity certification used with a FOIA or Privacy Act request
Published by BOP?	No	Yes
What it proves	That the patient consents to the disclosure	Who the requester is, and consent where a third party is requesting
Typical use	Records to a lawyer, family member or outside doctor; records in from a prior provider	A formal FOIA/Privacy Act request under 28 C.F.R. part 513, subpart D
Signature	The patient’s	The record subject’s own — which is why it cannot be used for someone who has died

We walk the Justice Department form through on our DOJ-361 Certification of Identity page. The distinction that matters most: DOJ-361 requires the record subject’s own signature, so it is not the route for records of someone who has died. There, the request goes forward as a FOIA request with proof of death — 28 C.F.R. § 16.3 allows a requester to establish greater access “by submitting proof that the individual is deceased (e.g., a copy of a death certificate or an obituary).”

Someone who simply wants to see their own file often needs neither form. Under 28 C.F.R. § 513.40, an inmate “may at any time request to review all disclosable portions of his or her Inmate Central File,” and that information “is available without filing a FOIA request.” The Central File and the health record are different files, though — the health record has its own path through Health Services.

Where the signed form goes, and what to do if it is wrong

Once signed, the BP-A0621 becomes part of the medical record. PS 6090.04 at p. 20 lists it among the forms filed in Section 6 — Administrative of the health record, where records “are to be filed chronologically without a prescribed order of forms.” PS 5260.01 at p. 5 adds that signed release documents “will be added to the electronic health record.” So there should always be a retrievable copy of what was signed and when — the answer to the most common worry about an unpublished consent form. Ask for a copy when you sign; if you are not given one, request it in writing and keep the request.

If a release was signed but records were never sent, if information went somewhere you did not authorize, or if an authorization expired before it was used, the route is the Bureau’s administrative remedy process — an informal resolution attempt with unit or Health Services staff first, then a BP-9 to the Warden, a BP-10 to the Regional Director, and a BP-11 to the Office of National Inmate Appeals. Deadlines are short. Name the form, the date signed, and who the records were supposed to go to.

Where the records matter to a court filing — a sentence-reduction motion, a care-related grievance, a civil claim — it is worth having counsel handle the request rather than relying on a single form. Our attorneys handle Bureau administrative and post-conviction matters nationwide.

Frequently Asked Questions About the Medical Information Release Form

Reviewed for legal accuracy by Elizabeth Franklin-Best, Esq., Principal Attorney·September 2026