Survivor-Specific Letters

Limit Medical Records Release to Third-Party Administrator

A fully-written letter you can copy or download. Below the letter we explain why it is written the way it is, the mistakes most people make, and the legal authorities the language invokes.

The letter

▸Show full letter

To: [TPA Claim Examiner], [TPA Name]
CC: HR at [Employer Name]
From: [Your Full Name], [Employer Claim ID]
Date: [Today's Date]
Subject: Limited Release of Medical Information — FMLA Claim [Claim Number]

Dear [Claim Examiner],

I am writing in response to your request dated [Date] for a signed authorization to release medical records in connection with my FMLA claim.

I am providing the completed WH-380-E medical certification form, which is what the FMLA requires. The regulation limits the information my employer (and any third party acting on its behalf) can require to what is necessary to determine whether my condition qualifies for FMLA leave. The completed WH-380-E meets that standard.

I am not signing the general HIPAA authorization attached to your request. That authorization, as drafted, would release my full medical record, including records unrelated to this leave. HIPAA authorizations are voluntary, and the FMLA does not require one. I am declining it.

If you need clarification or authentication of anything on the WH-380-E, please use the process the regulation provides: contact routed through a healthcare professional, HR representative, or management official designated by the employer, limited to clarifying information on the form. I do not authorize direct contact with my provider for any other purpose.

If you believe the certification is insufficient, please identify in writing the specific item or items that need additional information. I will have seven calendar days from that written notice to cure the identified deficiency.

I expect this FMLA claim to be processed on the basis of the completed WH-380-E alone. Please direct any further correspondence to me in writing.

Sincerely,

[Your Full Name]
[Your Work Email]
[Your Phone Number]

Replace every bracketed prompt with your own information before sending. Everything in brackets is for you. Everything outside brackets is the letter.

Before you send this

Many employers do not handle FMLA paperwork themselves. They hand it off to a third-party administrator, usually called a TPA. A TPA is a leave-management vendor, like Sedgwick, Unum, Lincoln, or The Hartford, that your employer pays to process claims. TPAs have an incentive to close claims quickly, and they use a predictable set of tactics to push employees into giving up more than the law actually requires. Watch for these:

Blanket HIPAA authorization forms. These are not required for FMLA. The WH-380-E certification is. A broad HIPAA release can pull therapy notes, substance use records, and unrelated medical history into a corporate vendor's database.
Demands for records beyond the WH-380-E. The law limits what your employer or its TPA can require to what is necessary to determine FMLA eligibility. You are not obligated to provide a full chart.
Artificial delays that trip deadlines. If the TPA says your certification is incomplete, they must tell you in writing exactly what is missing and give you seven calendar days to fix it. Silence is not a legal denial.
Direct calls to your healthcare provider. TPA claim examiners cannot call your provider for general information. Contact for clarification must be routed through a healthcare professional designated by the employer.
Pressure to use an Employee Assistance Program (EAP) instead of accommodations. An EAP is a short-term counseling benefit your employer funds, usually limited to three to eight sessions. An EAP referral is not a response to an ADA accommodation request, and engaging with the EAP can muddy your record.

Watch out for the sign-up process. HR typically sends you to a TPA website to register and "start your claim." Those sign-up flows are where most of the traps live: pre-checked HIPAA authorization boxes, fields asking you to enter your diagnosis, current medications, symptoms, or the contact information for your treating providers. None of that is required to open an FMLA claim. Fill in only the administrative fields (name, employee ID, employer, dates) and leave clinical fields blank.

If the portal will not let you proceed without medical entries, or if anything about the process feels coercive, raise the concern in writing. A short email to HR and the TPA is enough: say that the portal appears to be asking for information that goes beyond what the FMLA certification requires, that you understand the employer's information rights are limited to what is necessary to determine FMLA eligibility, and that you would like to submit your certification through an alternative channel (email or fax to the TPA directly, with your provider sending the completed WH-380-E to that address). Wait for a written response. Only use the alternative if HR or the TPA agrees. Putting the concern in writing either gets you the alternative or creates a paper trail that protects you if the claim is later denied or delayed.

If any of this is happening, read Protecting Your Medical Records, FMLA and HIPAA Privacy Rights, or use the letter that limits records release to a TPA. If you need to talk to someone free of charge, see our list of free legal helplines and crisis lines.

When to use this letter

A third-party administrator (TPA) handling your FMLA or STD claim has asked you to sign a broad HIPAA authorization that would give them access to your full medical record, including therapy notes. You want to provide only the WH-380-E and nothing else.

Third-party administrators routinely send blanket HIPAA releases that authorize release of your entire medical record to 'process your claim.' Signing one can put therapy notes, trauma history, substance use history, and records unrelated to your leave into a corporate vendor's database. For survivors, the risk is substantial and the legal requirement is almost always lower than the request.

The FMLA only authorizes release of a completed WH-380-E (or equivalent). HIPAA does not require you to sign a broad authorization, and you can decline or narrow one without losing your FMLA rights. This letter documents that you are providing what is required and refusing what is not.

Why the letter is written this way

Each paragraph is doing specific legal work.

01
Why send this to both the TPA and HR
TPAs frequently claim they are acting on HR's authority. Copying HR puts your employer on notice of what the TPA is actually demanding and creates a paper trail if a records release happens without your consent.
02
Why refuse the general HIPAA authorization
Broad HIPAA authorizations reach records that have nothing to do with your FMLA claim. Therapy notes, substance use records, gynecological history, and decades-old diagnoses can all be pulled under a signed general release. 45 C.F.R. § 164.508 makes signing voluntary.
03
Why cite § 825.307 specifically
29 C.F.R. § 825.307 limits who can contact your provider and for what purpose. The regulation requires that contact go through a healthcare professional (not the TPA claim examiner alone) and only for clarification. Forcing the TPA into that structure prevents fishing expeditions.
04
Why invoke the 7-day cure period
Under 29 C.F.R. § 825.305(c), if the employer or TPA finds the certification incomplete or insufficient, you are entitled to a written list of what is missing and seven calendar days to fix it. TPAs often skip this step and treat silence as grounds for denial. Naming the rule in writing forces compliance.
05
Why close by restating your expectation
The last line ('processed on the basis of the completed WH-380-E alone') makes clear what you think should happen next and creates a record if the TPA denies or delays the claim. Courts give weight to contemporaneous letters that state what the claimant asked for.

Don't do this

The mistakes that undo the letter.

01Signing the broad authorization to 'avoid delay.' The delay is often manufactured to push employees into overbroad consent. The certification itself is the legally required document.
02Treating a TPA claim examiner as a neutral party. They are a vendor paid by your employer. Their incentive is to close claims quickly, which can mean denying them.
03Having your provider respond to a TPA phone call directly. 29 C.F.R. § 825.307 puts structure on this for a reason. Your provider should only respond to written clarification requests routed through a healthcare professional representing the employer.
04Not following up in writing if the TPA claims the WH-380-E is 'incomplete.' Require the written list of deficiencies and the 7-day cure period, in writing.
05Forgetting to document. Keep every TPA letter, email, and voicemail. If the claim goes sideways, this record is what a lawyer will need.

Legal authorities cited

The language invokes real regulations.

29 C.F.R. § 825.305(c): Incomplete certifications and 7-day cure
29 C.F.R. § 825.306(a): Scope of certification contents
29 C.F.R. § 825.307: Authentication and clarification of certification
45 C.F.R. § 164.508: Voluntary nature of HIPAA authorization
42 U.S.C. § 12112(d)(3)(B): Confidentiality of medical information
45 C.F.R. § 164.524(a)(1)(i): Separate protection of psychotherapy notes

Keep reading

Where to go next.

LeaveRights is a free educational tool and does not provide legal advice. No data is collected or stored. Information provided is for general guidance only. Consult a qualified employment attorney for advice specific to your situation.

Each paragraph is doing specific legal work.

Why send this to both the TPA and HR

Why refuse the general HIPAA authorization

Why cite § 825.307 specifically

Why invoke the 7-day cure period

Why close by restating your expectation

The mistakes that undo the letter.

The language invokes real regulations.

Where to go next.