A Release of Information (ROI) is a document that allows a patient to choose what information is released from their medical record. It also allows the patient to choose who receives the information, how long it can be released, and under what guidelines. A valid ROI form is signed by the patient and authorizes the provider to release patient-specific information to others.
Requesting an ROI for your patients
The Medical Records team will handle this by sending your patient an email to gather an electronic signature on a release form.
- Log into the EHR and click Web Links tab to access and complete the ROI Request Form and initiate the request. All required fields must be completed to process the request. Please complete this form during a session with the patient when possible.
- The Records team will email the patient to sign a release electronically. Once completed, the team will upload the signed ROI into AMD (see the "Documents" folder) and inform you once the process is complete.
- ROIs can take up to 30 days to process.
When you need an ROI
Generally speaking, you'll need a signed ROI from the patient to correspond with an external party that is not a covered entity (i.e., school, case worker, probation officer, attorney, etc.).
When you don't need an ROI
- You don't need an ROI to speak with or email another healthcare provider about the patient's care. The HIPAA Privacy Rule allows healthcare providers to coordinate care without a patient's authorization when connecting with another healthcare provider (i.e., a physician, another provider, hospital staff, etc.). These communications are covered under Treatment, Payment, and Operations or TPO. TPO also allows healthcare providers to make a referral to connect the patient with services or resources or communicate with an insurance company without an ROI.
- You do not need an ROI to release information to the patient for things like letters or paperwork you've completed at the patient's request.
- You do not need an ROI to speak with a parent/guardian of a patient for anyone who is aged 17 and younger. Unless a biological parent’s rights have been terminated or there is information in the minor patient’s record that could reasonably be harmful to the minor child if the information was released, both biological parents will have the right to access the minor patient’s medical records regardless of who signed consent for the minor.
- You do not need an ROI if a patient requests a provider to talk with their partner, a relative, or a friend. In these situations, document the request in your note and that you obtained verbal consent from the patient.
- You do not need an ROI if someone else is joining a session at the patient's request. Document the process in your note to specify that the patient AND guest provided verbal agreement.
Authorization to Release Patient Information Policy
To learn more about the process for the use and disclosure of protected health information (PHI) pursuant to written authorization, please click here.
Updated