Patient/Participant Release Forms for Communications and Marketing Materials

Use this guide to determine which authorization form is required when featuring individuals, including research study participants, in public-facing communications such as web stories, photos, videos and audio, interviews or social media.

If you are in doubt or unsure about whether the information needed can be de-identified, err on the side of obtaining authorization.

Patient or Person Involved	Required Form
UW Health patient	UW Health Authorization Form (submissions go to UW Health Media Relations); Spanish version (UW Health Pulse login required)
Research participant - for use by UW Health	Use the UW Health Authorization Form (submissions go to UW Health Media Relations); Spanish version (UW Health Pulse login required); verify with IRB that intended use of PHI is within your protocol
Research participant - for use by SMPH	UW–Madison Office of Compliance forms: Authorization for Use or Disclosure of Medical Information for Marketing or Fundraising (found under Forms → Authorizations) is typically the most relevant. Keep completed form on file for your records; Office of Compliance does not retain records of form submissions; verify with IRB that intended use of PHI is within your protocol
Does not involve a patient or research participant but subject is a student, minor or visitor, and no PHI is shown	UW–Madison General Talent Release Form linked from Policy UW-203: Use of Visuals

*Please prefill the consent forms for patients/participants to sign, as they may not be able to explain how their information will be used. Signed blank forms are not valid.

Important Reminders

Dual roles: SMPH employees who are also patients or research participants must still sign an authorization form. HIPAA protections apply regardless of employment status.
Environmental risks: Even if no PHI is intended, check surroundings for whiteboards, screens, metadata, or audio that could contain PHI.
Simulations: Clearly label any staged scenarios to avoid confusion with real clinical situations.

Storage Guidelines

Never store PHI on personal devices.
Do not use personal email, file-sharing, messaging apps, or social media for PHI.
If you suspect PHI was used with non-approved tools, file a HIPAA incident report immediately.
See the Office of Compliance guidance for approved tools for exchanging PHI and page 6 for prohibited platforms.