Release of Information Process

AHIOS ROI Process
AHIOS logo

THE RELEASE OF INFORMATION (ROI) PROCESS

A 45-Step Workflow
Legend: Process step Decision point Continue / Return marker
1. Logging, Tracking & Verifying Request
1
Receive Request
2
Enter Request in ROI tracking software for Accounting of Disclosures
3
Is the request from the individual or personal representative under HIPAA (78 FR 5566, 5635)?
3
Is the authorization valid? Patient identifiable? Contains 6 core elements & 3 required statements per 45 CFR 164.508(c)?
YES3a. Update status in software
NO3b. Reject auth — send invalid authorization letter to requester
→ Continue to Step 4
2. Retrieving Patient Protected Health Information
4
Search for Medical Record Number
5
Able to locate patient in the Master Patient Index?
NO5a. Search secondary systems → 5b. Is PHI available? — YES continue Step 6 / NO 5b1–5b2 update status & send status letter
Step 6 — Determine format of PHI (Paper · Microfilm · Electronic). Only 3.4% of hospitals are fully paperless, so hybrid records require Steps 7, 12 & 16.
Offsite Paper/Microfilm
7
Order offsite record of PHI
8
Transport offsite record
9
Login offsite PHI
10
PHI retrieved?
YES11. Update Chart Locator → Step 12
NO10a–c. Report to HIM Mgr, update status, send status letter
Onsite Paper/Microfilm
12
Retrieve onsite paper PHI & billing records
13
Log into Patient Accounting; extract or order itemized billing
14
Is the paper record available?
NO14b–d. Locate via chart locator, receive chart, update locator
15
Update Chart Locator to ROI area → Step 16
Electronic PHI
16
Retrieve electronic PHI — log in to EMR system(s)
16b
Is electronic PHI available?
YES17. Extract PHI from EMR → 18. Upload to ROI software & save order
NO16c–e. Report to HIM Mgmt, update status, send status letter
→ Continue to Step 19
3. Protecting Sensitive Information
19
Review every page/image printed or downloaded for federally/state protected info (drug & alcohol, HIV, mental health)
YES19a. If authorized, proceed to Step 22
20
If protected info not authorized, reject & update status
21
Send invalid authorization letter to requester
22
Verify all pages/EHR images are the correct patient
23
Verify dates of service and items requested/authorized
24
Scan backup set (request & authorization) into tracking software
25
Scan paper PHI as Medical Records Set; reassemble chart exactly
26
Return paper chart to file/storage; update Chart Locator
27
Retrieve imaged PHI; upload to Medical Records Set
→ Continue to Step 28
4. Releasing Authorized Information
28
Match paper/electronic PHI to request: verify SS#, DOB, and diagnosis-based treatment records
29
Perform quality review to ensure all PHI is included as authorized
NO29a–b. Notify HIM Mgmt & requester
YES29c–d. Update status & send status letter
30
Pages oriented correctly? Within date range? Correct record types?
31
Flip, delete, or scan PHI as needed to fulfill request correctly
→ Continue to Step 32
5. Completing & Invoicing the Request
On-Site Release
32
Does requester require a fee approval?
YES32a–b. Verify fee/state rate, select charge type, generate & send Fee Approval Notice
→ Return to Step 1
33
Verify state rate; apply payment received with request
34
Generate invoice and print PHI
35
Compare patient name (last PHI page) with invoice; perform mail QA
36
Attach supplemental info: affidavit, certification, etc.
37
Place documents in envelope; place in mail-out bin
Centralized Processing
38
Review every PHI page: proper orientation, correct dates/type, correct patient name on every page
39
Are all pages available and correct?
NO39a–b. Notify site; print wrong-patient pages, fax to site & file
40
Correct name on all pages?
41
Paper output → follow Steps 33–37; CD output → go to Step 45
42
Alternately stack document set to be verified and mailed
43
Compare patient name/invoice, verify mailing address & supplemental info; envelope & mail-out bin
44
Mail PHI
45
Burn to CD, final QA, include invoice, package & place in mail-out bin