New93 role standards, now public
MedTality
Role standards

Front office and patient access

Release of information specialist

What it takes to release the right patient records to the right requester with valid authorisation and nothing more, without breaking patient privacy law. Weighted from the AHIOS Certified Release of Information Specialist (CRIS) exam content blueprint and bounded by the HHS OCR right-of-access guidance and the 42 CFR Part 2 protections for substance use disorder records.

Practice this assessmentHire for this role
Expectations
10
Safety red lines
3
Sources
4
Version
1

Built from Alliance for Health Information Operations and Standards (AHIOS), HHS Office for Civil Rights, Electronic Code of Federal Regulations, Title 42 Part 2. Reviewed by clinicians, last on .

01What the role is measured on#

Every verdict is made of the same five dimensions. Each is scored on its own, so a candidate sees where they are strong and where to work.

  • Clinical skillsThe hands-on and judgement work of the role: recognising what matters, acting in the right order, and knowing when something cannot wait.
  • Workflow and toolsGetting the work done in a real setting: the systems, records, equipment and handoffs the role runs on, used correctly and on time.
  • Patient communicationHow the role talks with patients, families and colleagues: listening, explaining plainly, and confirming what was understood.
  • Compliance and safetyThe rules that protect people: privacy, consent, infection control, reporting duties and the safety checks the role is accountable for.
  • Role knowledgeKnowing the job itself: what the role is responsible for, where its scope ends, and who to bring in when it does.

02What a ready hire does#

What a competent release of information specialist does on day one, dimension by dimension.

Clinical skills

  • Processes a request for records against the authorization or legal basis on file, releases exactly what it permits to the verified requester, and logs the disclosure completely and on time.
  • Confirms the identity of the person requesting or receiving records, and the authority of anyone acting on a patient's behalf, before any information is released.

Workflow and tools

  • Sends records only through a channel appropriate to their sensitivity and volume, verifies the destination before transmitting, and confirms delivery.
  • Uses the record system's release-management tools - request tracking, redaction, audit trail and disclosure log - to work a request completely and leave a record that another specialist could pick up.

Patient communication

  • Explains fees, timelines, denial rights and what a request will and will not include in plain language the requester can act on, and confirms they understood.
  • Recognizes when a request has gone wrong - a misdirected disclosure, a missed deadline, an over-broad release - tells the people affected promptly, and puts it right through the proper process rather than quietly correcting it.

Compliance and safety

  • Applies the extra protection specially protected categories of health information carry - substance use disorder treatment records, psychotherapy notes, HIV status, genetic information and other state-protected categories - and never discloses them beyond what the specific, category-matched consent or exception allows.
  • Limits every disclosure to the type and amount of information the authorization, request or permitted purpose actually calls for, never a full chart by default.

Role knowledge

  • Recognizes the decisions that belong to the patient, the provider, legal counsel or compliance rather than the specialist, and routes them instead of deciding or interpreting on their own.
  • States the retention, audit and accounting-of-disclosures rules that govern the records this role handles, correctly and without confusing them with clinical retention rules that don't apply to ROI work.

03Safety red lines#

Any one of these keeps a candidate from Ready Day One, whatever the rest of the score. They are published so nobody meets them for the first time in the assessment.

  • Would release records to a requester without a valid authorization or an applicable legal basis on file - because the authorization is missing an element, expired, or the requester's identity and authority were not verified - and complete the release anyway rather than stopping to resolve it.

    Releasing records without valid authorization is an unpermitted disclosure of protected health information under HIPAA, exposes the organization to civil penalties, and can cause real harm to the patient - an abusive family member, an opposing party in litigation, or an employer learning something the patient never agreed to share.

  • Would disclose substance use disorder treatment records protected under 42 CFR Part 2, psychotherapy notes, HIV status, genetic information or another specially protected category of health information under a general medical records authorization that does not specifically name and consent to that category.

    These categories carry protection beyond HIPAA's general disclosure rules precisely because the harm from their exposure - loss of a job, custody, insurance or a relationship - is severe and often irreversible, and 42 CFR Part 2 attaches its own penalties separate from HIPAA's.

  • Would send records over an unencrypted or unverified channel - email to an address that has not been confirmed, fax to a number read out by the caller and not checked against an independent source - rather than verifying the destination and using an appropriately secure channel first.

    An unverified destination is how records end up in the wrong hands even when the authorization itself was valid, and an unencrypted transmission of protected health information is a reportable breach that triggers notification obligations to the patient and, above a certain scale, to HHS and the media.

04Outside the role#

Knowing where the role stops is part of the standard. Going past it is not extra credit.

  • Does not decide on their own that part of an authorized or requested scope is not clinically relevant and can be left out.Sends what the authorization or request actually describes, and raises anything that looks wrong about the authorization's scope with the requester or with compliance rather than editing it unilaterally.
  • Does not interpret a diagnosis, lab result or other clinical content in the record for a requester or patient.Directs clinical questions to the treating provider or, for the patient's own record, to the patient portal's provider messaging, and tells the requester who will follow up and roughly when.
  • Does not release records without verifying both the validity of the authorization or legal basis and the identity and authority of the requester.Verifies the specific document and the specific person before treating anyone as authorized, and stops to resolve a gap - a missing element, unverifiable identity, unclear representative authority - before any release.
  • Does not disclose a specially protected category of information - substance use disorder treatment records under 42 CFR Part 2, psychotherapy notes, HIV status, genetic information - on the strength of a general authorization or an insistent requester, however clinically relevant it may seem to them.Withholds anything the consent on file does not specifically name, explains that a specific consent is needed for that category, and routes an insistent or hostile requester to a supervisor or compliance rather than relenting.

05How it is assessed#

  • A spoken assessment

    An examiner talks the candidate through realistic cases from this role, and follows up the way a senior colleague would.

  • Five dimensions

    Each answer is read against the expectations above and rated on the same four-level scale.

  • The 70 bar

    Every scorecard shows the score against 70, overall and for each dimension, with the reason for the verdict.

  • Safety first

    Crossing one of the safety red lines holds a pass back, however strong the rest was.

The four levels

  1. Not yet
  2. Developing
  3. Proficient
  4. Exemplary
How a verdict is made

06Sources and review#

Drawn from the certification frameworks and practice standards below, and reviewed by clinicians. Version 1, last reviewed .

Cited as sources. Not an endorsement by the organizations named.

See who is ready on day one.

Post your next role and meet candidates through their evidence, not their resumes.

Start hiringFind a role