A release of information form, often called an ROI, is a written authorization that allows a rehab program to share specified health information with specified people or organizations. The form should identify who may receive the information, what can be disclosed, the purpose or scope of the disclosure, and when the authorization expires.
Why might rehab ask me to sign an ROI?
An ROI can support coordination with an outside psychiatrist, primary care doctor, pharmacy, family member, employer representative, attorney, or other person involved in care or planning. The amount of information shared should depend on the purpose.
Are addiction-treatment records protected differently?
They can be. In addition to HIPAA, records from federally assisted substance use disorder programs may be protected by 42 CFR Part 2. HHS explains that Part 2 generally limits disclosure of information identifying someone as having or having had a substance use disorder unless the disclosure is permitted by the rule.
What should an authorization tell me?
A valid authorization generally describes the information to be disclosed, who may disclose it, who may receive it, the purpose or permitted uses, an expiration date or event, and the patient’s right to revoke. Ask questions before signing if the scope is broader than you expected.
Do I have to authorize my entire medical record?
No. An authorization can be limited to information needed for a particular purpose, such as medication history, attendance confirmation, discharge planning, or coordination with an outside clinician.
Can I revoke an ROI?
Generally, yes. HHS states that HIPAA authorizations can be revoked, subject to limits for actions already taken in reliance on the authorization. Part 2 has its own consent requirements, and the treatment program should explain how revocation works in that context.
Does an ROI mean the recipient can share the information with anyone?
Not necessarily. Redisclosure rules depend on the recipient, the type of information, HIPAA, Part 2, and the consent given. Current Part 2 rules permit certain treatment, payment, and health-care-operations redisclosures after a qualifying consent, while retaining additional protections against use of SUD records in legal proceedings.
How is an ROI used for family communication?
If you want a spouse, partner, parent, or other support person to receive updates, the program may ask you to identify that person and define what can be shared. Signing a narrow authorization does not automatically give someone unrestricted access to every treatment detail.
For provider coordination, see Trinity’s guide on working with an outside psychiatrist or primary care doctor.
Frequently asked questions
Is an ROI the same as a power of attorney?
No. An ROI authorizes information disclosure; it does not automatically give someone authority to make treatment decisions for you.
Can I authorize more than one person?
Yes, depending on the form and program. You can ask how to identify multiple recipients and what information each may receive.
Can I limit the authorization to a certain time period?
Yes. Authorizations include an expiration date or event and can be written for a defined purpose or period.
Can rehab refuse treatment if I will not authorize family updates?
HIPAA generally prohibits conditioning treatment on an authorization for uses or disclosures that are not otherwise required, subject to limited exceptions. Ask the program to explain any authorization it says is necessary.
Sources
Before signing a release at Trinity Behavioral Health or any adult treatment program, read the scope carefully and ask who will receive information, what will be shared, why it is needed, and how you can change or revoke the authorization.