By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Release of Information (ROI)
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
Release of information (ROI) is the process healthcare organizations use to receive, validate, fulfill, and track requests to disclose protected health information to patients, their representatives, other providers, payers, attorneys, government agencies, and other authorized recipients.
The HIMSS Dictionary describes ROI as the formal process for requesting the release of health information to other providers and authorized users, while making sure the information is timely, accurate, complete, and kept confidential. The dictionary also notes that the acronym ROI can mean return on investment, a different concept.
| ROI Request Type | Typical Requirement | Example |
|---|---|---|
| Patient Access | HIPAA right of access; verify identity | A patient requests a copy of a hospital stay record |
| Treatment | Generally permitted without authorization | A specialist requests recent notes and results |
| Payment and Operations | Permitted for certain purposes, subject to minimum necessary | An insurer requests records to process a claim |
| Authorization-Based | Valid HIPAA authorization signed by the patient | A life insurer or employer requests records |
| Legal Requests | Subpoenas, court orders, and other legal process with specific conditions | An attorney sends a subpoena for records |
| Specially Protected Records | Additional rules may apply | Substance use disorder treatment records under 42 CFR Part 2 |
⚠️ Exam Alert: Release of information is the process for disclosures. The right of access is the patient’s right to inspect and obtain copies of records. A HIPAA authorization is required for disclosures not otherwise permitted. Information blocking refers to practices that interfere with access, exchange, or use of electronic health information. In finance, ROI means return on investment.
🌐 Why It Matters: Real-World Healthcare IT Context
ROI sits at the intersection of privacy, patient rights, legal requirements, and operations. Organizations must release information promptly to people entitled to it while preventing improper disclosures. Mistakes in either direction create harm: delayed access can affect care and patient rights, while wrongful release can violate privacy.
HIPAA gives individuals a right to access their PHI in a designated record set. Covered entities generally must act on a request within 30 days, with one 30-day extension allowed if the individual is notified, and may charge only a reasonable, cost-based fee for copies. Individuals can also direct that copies be sent to a third party they designate.
Enforcement has focused on access. HHS’s Office for Civil Rights has emphasized the right of access through enforcement actions against organizations that failed to provide timely access, and HHS has published consumer-facing information encouraging patients to get, check, and use their records.
Authorizations govern many other disclosures. Under the Privacy Rule, a valid authorization must include specific elements, such as a description of the information, the recipient, the purpose, an expiration, and the individual’s signature. ROI staff review authorizations carefully before releasing records.
Information blocking rules have changed expectations. Under the 21st Century Cures Act, ONC’s information blocking regulations prohibit practices likely to interfere with access, exchange, or use of electronic health information, subject to defined exceptions. Many organizations now release test results and notes to patient portals promptly, which has reduced some ROI requests while raising new workflow questions for clinicians.
Specially protected information adds complexity. Substance use disorder treatment records covered by 42 CFR Part 2, some state-protected information such as certain mental health or HIV records, and records of minors may require additional steps. Personal representatives, such as parents or health care agents, have access rights that vary with circumstances.
Many organizations outsource ROI to specialized vendors, which act as business associates. Technology helps track requests, verify identity, apply redactions, log disclosures, and support the accounting of disclosures that HIPAA requires for certain releases.
Common ROI problems:
- Missed deadlines for patient access requests
- Excessive or improper fees
- Releasing records without valid authorization
- Failing to segregate specially protected information
- Inconsistent identity verification
- Requests received on units but never routed to HIM
Practices for effective ROI:
- Centralized intake and tracking of requests
- Clear identity verification procedures
- Standard authorization review checklists
- Electronic delivery options, including portals and apps
- Training for staff who receive requests
- Monitoring timeliness, accuracy, and complaints
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses often receive requests for information and play an important role in routing them correctly.
At the Bedside
Patients and families frequently ask nurses for copies of results, notes, or imaging. Nurses can explain how to access information through the patient portal and how to request complete records through health information management or the ROI office.
Verbal sharing for treatment purposes and with involved family members follows separate HIPAA rules from formal ROI. Confirming a patient’s preferences about who may receive information protects privacy while supporting family involvement.
In Clinical Workflow
Requests from attorneys, employers, insurers, or law enforcement that arrive on a unit should be routed to the appropriate office rather than fulfilled directly. These requests often require legal review, valid authorizations, or specific procedures.
Nurses providing records to another provider for treatment, such as during a transfer, typically use established processes like sending documents with the patient or through electronic exchange. These disclosures are generally permitted without authorization.
When patients review their records through portals, they may have questions about notes or results. Nurses can help explain information and route requests for amendments to the appropriate process.
In EHR Implementation (Go-Live Perspective)
During an Epic Go-Live, organizations configure ROI tools, define the designated record set, set portal release rules, and plan how legacy records will be accessed for requests. Patients requesting records that span old and new systems must still receive complete information.
At-the-elbow support analysts may field questions from unit staff about printing or sharing records. Reinforcing that formal requests go through HIM helps prevent improper disclosures during the busy transition.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Release of information appears in privacy, HIM, and patient access questions:
| CAHIMS Domain | How ROI Appears |
|---|---|
| Healthcare & Technology Environments | HIPAA right of access; information blocking; 42 CFR Part 2 |
| Clinical Informatics | Patient portal release, routing of requests, family communication |
| Healthcare Information & Systems Management | ROI tracking tools, designated record set, disclosure logging, redaction |
| Management & Leadership | Compliance, vendor management, timeliness metrics |
Key Terms to Know Alongside Release of Information
- Right of Access — an individual’s HIPAA right to inspect and obtain copies of their PHI
- HIPAA Authorization — a patient’s signed permission for disclosures not otherwise permitted
- Designated Record Set — the records used to make decisions about individuals that are subject to access rights
- Accounting of Disclosures — a record of certain disclosures that individuals may request
- Information Blocking — practices likely to interfere with access, exchange, or use of electronic health information
- Personal Representative — a person with authority to act for an individual in health care decisions
HIMSS Organizational Position
HIMSS supports patient access to health information and secure, timely exchange through its interoperability education and public policy work, including information blocking implementation. Members can find related education and research through the HIMSS Resource Center.
🔗 Explore Further: External References
- eCFR — 45 CFR 164.524, Access of Individuals to Protected Health Information https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524
- eCFR — 45 CFR 164.508, Uses and Disclosures for Which an Authorization Is Required https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508
- HHS — Get It. Check It. Use It. (Your Right to Access) https://www.hhs.gov/hipaa/for-individuals/right-to-access/index.html
- ONC — Information Blocking https://healthit.gov/information-blocking/
- HHS — Personal Representatives https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/personal-representatives/index.html
- AHIMA — American Health Information Management Association https://www.ahima.org/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply