Release of information requests need a clear, repeatable process
A release of information request can look simple: a client signs a form, another provider asks for records, and the practice sends the requested documents. In behavioral health, the process often requires more care. Progress notes, assessments, treatment plans, diagnoses, substance use records, family information, and collateral contacts may all contain sensitive details that affect privacy, continuity of care, and clinical trust.
Release of information, often shortened to ROI, is the process of reviewing, approving, documenting, and sending protected health information to a client or authorized third party. HIPAA establishes privacy protections for protected health information and gives individuals certain rights to access their health information [source:3]. Clinicians should also follow applicable state laws, payer requirements, professional ethics, and organizational policies.
This article is not legal advice. It is a practical documentation guide for therapists, counselors, social workers, psychologists, psychiatrists, and behavioral health practices that want a more consistent ROI workflow.
Why ROI is more sensitive in behavioral health
Behavioral health records may include information that clients do not expect to be widely shared: trauma history, safety concerns, family conflict, medication history, substance use details, legal involvement, or disclosures about other people. A poorly handled release can damage trust, confuse care coordination, or create documentation gaps.
A strong ROI process can support three clinical and administrative goals:
- Client autonomy: Clients should understand what they are authorizing, who will receive it, and why.
- Care coordination: Appropriate information sharing can help prescribers, therapists, primary care providers, schools, and care teams work from the same facts.
- Documentation consistency: Staff should know how to verify, record, send, and track each request.
ROI is not only a form. It is a workflow. The form matters, but so do identity verification, scope review, secure transmission, documentation of disclosures, and follow-up when a request is unclear.
Core elements of a behavioral health ROI workflow
A reliable ROI workflow should make the next step obvious for the clinician or staff member handling the request. Solo clinicians may manage the entire process themselves. Small group practices may divide tasks between clinicians, administrative staff, and supervisors. Either way, the process should be written down.
Confirm the request type
Start by identifying what kind of request you received. A client may ask for their own records. A psychiatrist may request therapy notes for care coordination. An attorney may send a subpoena. A parent may request records for a minor. A payer may ask for documentation related to a claim.
These requests should not be treated as interchangeable. Each may require a different review process. For example, a client request for access to their designated record set is different from a third-party request to send records to an attorney. HIPAA includes individual access rights, but clinicians still need to follow applicable rules about timing, format, identity verification, and any allowed limitations [source:3].
Verify identity and authority
Before sharing information, confirm who is asking and whether they have the authority to receive the information. This may include checking a photo ID, confirming contact information already in the client record, reviewing guardianship or custody documentation, or validating the request through a known professional channel.
For third-party requests, verify that the authorization is signed and that it matches the requester. If a release names “Dr. Lee at Northside Psychiatry,” do not send records to a different provider, law firm, school, or family member unless the authorization supports that disclosure.
Review the authorization before sending records
A release form should be specific enough for the clinician to understand what the client approved. Vague language creates risk and slows the process. A practical ROI form often includes:
- Client name, date of birth, and contact information
- Name and contact information of the person or organization receiving records
- Description of the information to be released
- Purpose of the disclosure and expiration date or event
Many practices also include client signature, date signed, revocation instructions, and any required notices. Practices should confirm that their forms meet applicable requirements and update them when laws, payer rules, or internal policies change.
Check the scope of the requested information
Scope is one of the most common ROI problem areas. A request for “all records” may include intake documentation, treatment plans, progress notes, discharge summaries, assessments, safety plans, and correspondence. In some situations, only a treatment summary or dates of service may be clinically appropriate or authorized.
Behavioral health clinicians should pay close attention to sensitive categories. Psychotherapy notes may receive different treatment under HIPAA than other parts of the clinical record [source:3]. Substance use treatment records, HIV-related information, minor consent services, and records involving family or collateral participants may also require additional review depending on the setting and applicable law.
Step-by-step ROI process for a therapy practice
The process below can help a behavioral health practice create a consistent path from request to completion. It should be adapted to your clinical setting, state requirements, payer contracts, and organizational policies.
- Receive the request. Record the date received, requester name, client name, and how the request arrived.
- Identify the request type. Determine whether it is a client access request, third-party authorization, payer request, subpoena, care coordination request, or another category.
- Verify identity and authority. Confirm that the requester is who they claim to be and has the authority to receive the information.
- Review the authorization. Check signatures, dates, expiration, recipient, purpose, and the specific information approved for release.
After those first checks, the clinician or assigned reviewer should decide what records are responsive to the request and whether any part needs additional review before release.
- Prepare the records. Gather only the documents approved for release, such as a treatment summary, assessment, progress notes, or treatment plan.
- Review before sending. Check for third-party information, sensitive content, wrong-client documents, duplicate pages, or records outside the authorized date range.
- Send securely. Use the method approved by policy and appropriate for the request, such as a secure portal, encrypted email, fax, or mail.
- Document the disclosure. Record what was sent, to whom, when, by what method, and under what authorization.
For complex requests, pause before sending. Examples include subpoenas, court orders, requests involving minors, requests from separated parents, records involving multiple clients, or requests for psychotherapy notes. Clinicians should follow applicable laws, consult organizational leadership when available, and seek legal guidance when needed.
What to document after releasing information
Good ROI documentation should allow another authorized person in the practice to understand what happened without guessing. The record does not need to be overly long, but it should be clear.
A practical ROI documentation entry may include:
- Date the request was received and completed
- Name and role of the requester
- Type and date range of records released
- Method of transmission and staff member who completed it
For example:
“ROI request received 04/02/2026 from client authorizing disclosure to Lakeside Psychiatry for care coordination. Authorization reviewed and signed by client on 04/01/2026. Sent intake assessment dated 02/12/2026, treatment plan dated 02/19/2026, and progress note summary covering 02/19/2026–03/28/2026 via secure fax on 04/03/2026. Disclosure logged in client record.”
This type of entry can help organize the record and support internal review. It also reduces confusion if the client later asks what was sent or if the recipient says records were not received.
Common ROI mistakes and how to reduce them
Many ROI problems come from rushed decisions, incomplete forms, or unclear office roles. The goal is not to make the process difficult. The goal is to prevent avoidable disclosures and keep the record accurate.
Sending more information than the authorization allows
A release that authorizes “treatment plan and diagnosis” does not automatically authorize every progress note in the chart. Review the exact language before sending. If the recipient asks for more, obtain an updated authorization when required.
Forgetting to document what was released
Clinicians sometimes send records correctly but fail to record the disclosure. That creates a gap. If a client, payer, or supervisor later asks what happened, the practice may have to reconstruct the event from email, fax confirmations, or memory.
Using old or unclear ROI forms
Forms should be reviewed periodically. Watch for missing expiration language, vague recipient fields, unclear revocation instructions, or checkboxes that do not match the services your practice provides. A form designed for general medical care may not address behavioral health details well.
Ignoring special record categories
Some information needs closer review before disclosure. Examples may include psychotherapy notes, substance use treatment records, records involving minors, couples or family therapy records, collateral information, and documents received from other providers. HIPAA includes specific treatment of psychotherapy notes, and other federal or state rules may apply to certain records [source:3].
Behavioral health examples: how ROI decisions show up in practice
Examples make ROI policy easier to apply. The scenarios below are simplified, but they reflect common situations in therapy and behavioral health settings.
Care coordination with a psychiatrist
A client starts medication management and signs a release allowing the therapist to coordinate with the psychiatrist. The psychiatrist asks for “therapy records.” The therapist reviews the release and decides to send the intake assessment, current diagnosis, treatment plan, and a brief treatment summary. The therapist documents the request, the records sent, the transmission method, and the purpose.
This approach may give the psychiatrist useful clinical context without automatically sending every session note. If the psychiatrist later needs specific records, the clinician can review the authorization and respond accordingly.
Attorney request for a full chart
A law office sends a signed client authorization requesting the complete record. The clinician verifies the authorization and confirms the client’s intent. Because legal requests can have significant consequences, the clinician follows practice policy and may seek legal guidance before sending records.
The clinician should avoid assuming that a signed form always means immediate release of every document. The scope, validity, applicable law, and contents of the record all matter.
Parent request for a minor’s therapy records
A parent requests records for a minor client. The clinician reviews consent, custody documentation, state law, and practice policy. If the record includes sensitive minor consent services, family therapy information, or safety-related concerns, the clinician may need additional review before responding.
Minor records can be complicated. Practices should have written policies for parent and guardian requests rather than handling each request from scratch.
Client request for their own records
A client asks for a copy of their treatment record. HIPAA gives individuals rights to access health information in many circumstances [source:3]. The practice verifies identity, clarifies the format requested, reviews applicable timing rules, and prepares the records according to policy.
If the clinician has concerns about sensitive content, the response should still follow applicable law and organizational policy. A concern about clinical discomfort is not the same as a valid reason to deny access.
ROI checklist for clinicians and small practices
A checklist can prevent skipped steps, especially when staff are busy or requests arrive between sessions. Use this as a starting point, then adapt it to your practice requirements.
- Is the request type clearly identified?
- Has the requester’s identity and authority been verified?
- Is there a valid authorization, if required?
- Does the authorization name the correct recipient?
Next, check the content of the requested record before sending anything.
- Does the request specify what information may be released?
- Are the dates of service clear?
- Have sensitive record categories been reviewed?
- Has the disclosure been documented in the client record?
Finally, confirm transmission details. Use the approved method, verify recipient information, and keep confirmation records according to policy.
How documentation software can support ROI work
Technology cannot decide whether a disclosure is legally appropriate. It can, however, help clinicians keep records organized so ROI review is less chaotic. For example, structured progress notes, consistent treatment plans, clear assessment documentation, and organized client records make it easier to identify what should be reviewed when a request arrives.
AutoNotes.ai helps behavioral health professionals create structured, editable progress note drafts from session details. Clinicians can review, edit, and finalize each note using their own clinical judgment. That matters for ROI because clearer documentation can make later record review easier.
For example, if a psychiatrist requests a treatment summary, structured notes may help the clinician quickly identify:
- Presenting concerns and diagnosis history
- Interventions used across sessions
- Client response and progress toward treatment goals
- Current plan, referrals, and coordination needs
AutoNotes may support the documentation side of ROI by helping clinicians keep notes more consistent across sessions. It does not replace a valid authorization, legal review, privacy policies, or clinician judgment. Practices should continue to follow applicable laws, payer requirements, and organizational procedures.
FAQ: release of information in behavioral health
What is a release of information?
A release of information is a process that allows health information to be shared with a client or authorized person or organization. In behavioral health, ROI often involves progress notes, assessments, treatment plans, diagnoses, medication information, or care coordination records.
Does every disclosure require a signed ROI form?
Not always. Some disclosures may be permitted or required under HIPAA or other laws, while many third-party disclosures require authorization. The correct answer depends on the request, purpose, recipient, setting, and applicable law. Clinicians should follow their policies and seek guidance when unsure [source:3].
Can a client access their own therapy records?
HIPAA gives individuals rights to access health information in many situations [source:3]. Behavioral health practices should have a written process for verifying identity, reviewing the request, preparing records, and responding within required timelines.
Are psychotherapy notes treated the same as progress notes?
No. HIPAA treats psychotherapy notes differently from many other parts of the clinical record [source:3]. Progress notes typically document services provided, interventions, client response, progress, and plan. Psychotherapy notes may contain the clinician’s private notes from counseling sessions and may require separate review.
What should I do if an ROI form is incomplete?
Do not guess. Contact the client or requester, explain what is missing, and request a corrected authorization if needed. Document the contact and do not release records until the request is clear and policy requirements are met.
How often should ROI policies be reviewed?
Many practices review ROI policies at least annually and whenever there are changes in law, payer requirements, practice ownership, record systems, or service types. Staff should know where the current policy and forms are stored.
Can AutoNotes handle release of information decisions for my practice?
No. AutoNotes helps clinicians create structured, editable clinical documentation drafts. It may help organize progress notes and treatment information, but clinicians and practices remain responsible for reviewing records, making ROI decisions, and following applicable requirements.
Build an ROI process that clinicians can follow under pressure
Release of information work should be careful, but it should not be improvised each time. A practical process gives clinicians and staff a clear path: identify the request, verify authority, review the authorization, check the record, send securely, and document the disclosure.
Clear clinical documentation also makes ROI review easier. When progress notes consistently describe interventions, client response, progress toward treatment goals, and next steps, clinicians can locate relevant information faster and respond with more confidence.
If documentation backlog is making record review harder, AutoNotes can help create structured, editable note drafts for behavioral health workflows. Clinicians stay in control of reviewing and finalizing each note. Start your free trial to see how AutoNotes can support a more organized documentation process.
