Release of information requests

How do we handle a release of information request from a patient, an attorney or another requester with the identity and the authorization checked, the records pulled and delivered, and the disclosure logged?

Classify the requester and the basis before any record moves. When a request arrives, Callvu reads it and classifies the requester (the patient, a personal representative, an attorney, another provider, a payer, a government agency, a researcher) and the legal basis (the patient's right of access, a valid authorization, a treatment or payment disclosure, a subpoena or court order, a public health or law enforcement exception), verifies the requester's identity and the authorization's validity against the stored authorization or the document, chases a defective authorization or a missing identity proof, pulls the records within the scope with the sensitive categories handled under their own rules, checks and prepares them (the format, the date range, the minimum necessary), routes a subpoena, a sensitive category or an unclear basis to the privacy office in the Decision Desk, delivers in the format and the channel requested within the timeline, applies the permitted fee, and logs the disclosure against the record. Live at Ministry of Health, under national rules outside the US.

Live at Ministry of HealthComplex: multi-party handoffsCallvu moves: classify, chase and verify, decide, write back

Talk to an expert Try it in the sandbox

Last updated November 7, 2026.

The problem today

The attorney's request was fulfilled from a photocopy of an authorization that had expired, and the substance use records went with it.

Today, without Callvu

Release of information is a high-volume, high-liability function: hundreds of requests a week from patients, lawyers, insurers, other providers and agencies, each with a different legal basis, a different scope, a different format, a different fee rule and a different deadline. A desk works through them by hand; the errors are the classic breaches: the wrong patient, an expired authorization, a sensitive category released without its consent, a request fulfilled late.

The Privacy Rule and the state laws define who may receive what on what basis: the patient's right of access with its timeline and fee limits, the authorization with its validity rules, the disclosures permitted without authorization and their conditions, the subpoena and court order requirements, the sensitive categories with their own consents. Each request is a classification, a verification and a scope; the logging is required. A process that classifies first and pulls second does not make the classic errors.

The basis decides the release; the desk should not have to decide the basis.

How it runs

From the requestto the system of record.

A release request arrives from a patient, a representative, an attorney, a provider, a payer or an agency, in any channel (the portal, a letter, a fax, a subpoena). Callvu reads it and opens the case.

Requester: Provides identity proof and the authorization or the legal document through a link, and receives the records in the format requested.
Patient: Is the subject; signs the authorization through its process where one is needed, and is notified where the rules require.
Privacy office: Decides subpoenas, sensitive categories and unclear bases in the Decision Desk.
Callvu: Reads, classifies, verifies, chases, pulls, prepares, routes, delivers, charges and logs.

Classify the requester and the basis
The request is read (the requester and their relationship, the patient, the records requested with dates, the purpose, the format, the authorization or legal document attached) and classified: the requester type and the legal basis (the patient's right of access, a valid authorization on file or attached, a permitted treatment or payment disclosure to a provider or a payer, a subpoena or a court order with its requirements, a public health, law enforcement or other exception), which sets the verification, the scope rules, the fee rule and the deadline.
Chase and verify
The requester's identity is verified at the level the basis requires (the patient through the portal's authentication or a document, an attorney through the firm and the authorization, an agency through its credentials); the authorization is checked against the stored structured authorization or the attached document for validity (the elements, the expiry, the scope, the signer, no revocation); a subpoena is checked for the notice to the patient or the protective order the rule requires; a defective authorization or a missing identity proof is chased from the requester with the specific gap.
Pull, prepare and decide
The records within the scope and the date range are pulled from the EHR with the sensitive categories excluded unless specifically authorized (substance use disorder records under their consent, psychotherapy notes, state-protected categories), prepared in the format requested with the minimum necessary applied where the basis requires it, and checked (the right patient, the right dates, the completeness); a subpoena, a sensitive category, an unclear basis, a request from a law enforcement agency or a request for a deceased patient's records goes to the privacy office in the Decision Desk with the case and only the allowed outcomes (release, release limited, require a valid authorization or order, or deny with the reason).
Deliver, charge and write back
The records are delivered in the channel and the format requested (the portal, a secure download, a secure email, mail, or the requester's system) within the timeline for the basis, the permitted fee is applied where the rules allow one, the disclosure is logged against the record with the requester, the basis, the records, the date and the method for the accounting of disclosures, and the patient is notified where the rules require.

Where it ends: Every request was released or refused on a classified basis with the identity and the authorization verified, the scope enforced including the sensitive categories, delivered on time in the format asked, charged correctly and logged for the accounting. The Decision Trace shows the classification, the verifications and any decision; the Audit Trace shows the request, the pulls and the delivery with time.

Runtime enforcement

What is enforcedwhile the work runs.

The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.

Regulations

US requirements shown. Ministry of Health runs this process under national rules outside the US; Callvu loads each market's rules as policies the same way.

HIPAA Privacy Rule (45 CFR 164.502, 164.506, 164.508, 164.512, 164.524 and 164.528): Disclosures are permitted to the individual, for treatment, payment and operations, under a valid authorization, and under the listed exceptions (public health, law enforcement with the specified conditions, judicial and administrative proceedings with satisfactory assurances of notice or a protective order, and others); the individual's right of access must be fulfilled within 30 days (one 30-day extension) in the form requested where readily producible with a reasonable cost-based fee; disclosures other than for treatment, payment, operations and to the individual are tracked for the six-year accounting of disclosures.
42 CFR Part 2, psychotherapy notes rules and the state sensitive information laws: Substance use disorder records from a Part 2 program may be released only with the Part 2 consent or under its exceptions, with the redisclosure notice; psychotherapy notes require a specific authorization; state laws protect HIV status, mental health and genetic information with their own consent requirements; the scope rules exclude these categories unless specifically authorized.
State medical records laws, subpoena rules and fee schedules: State law sets the records fee schedules for different requesters, the response periods, the handling of subpoenas (the notice to the patient, the certification of records) and the deceased patient's representative rules; the classification applies the state's rule for the requester type.

Company policies

No record moves before the requester and the basis are classified and verified.
The authorization's validity is checked against structured data; a defective one is chased, not relied on.
Sensitive categories are excluded unless specifically authorized, and the privacy office decides the hard cases.
The EHR is the system of record; the disclosure log is written on every release.

Controls

Request reading and basis classification.
Identity and authorization verification.
Chases for defective authorizations and missing proofs.
Scope-limited pulls with sensitive category handling and minimum necessary.
Decision Desk for subpoenas, sensitive categories and unclear bases.
Timed delivery, fee application and disclosure logging.

Clocks and deadlines

Right of access: Within 30 days of the request, one 30-day extension with written notice.
Other requests: The state's or the payer's period for the basis, on the case.
Subpoena: The return date, with the patient notice or protective order verified first.

Documents and checks

The request and its classification
The identity and authorization verification
The records pulled and prepared
Any privacy office decision
The delivery, the fee and the disclosure log

In the Decision Trace

The classification and the basis.
The verifications.
The scope applied and any decision with the person.

In the Audit Trace

The request with receipt time.
The pulls and the preparation.
The delivery with time and method, and the log entry.

The handoff

Between the front doorand the back office.

The front door

The portal, a letter, a fax or a subpoena, read on arrival; the requester provides proofs through a link.

The back office

The release desk works classified, verified cases; the privacy office decides only the hard ones.

The Decision Desk

A subpoena, a sensitive category, an unclear basis, a law enforcement request or a deceased patient's records goes to the privacy office in the Decision Desk with the case and only release, release limited, require a valid authorization or order, or deny with the reason.

Proof

Live at Ministry of Health.Published results only.

Each result is a published claim, with its code on agents.callvu.com, where its status, source and last verified date are kept.

The Ministry of Health hospital network runs 23 hospitals on Callvu and keeps adding more, with 3x faster procedure approvals, 78% faster patient consent and more than 1M pages of paper eliminated.

HLT-01 · Self-asserted · verified 2026-11-05

At the Ministry of Health, Callvu integrated with very old legacy systems at several hospitals, and brings ERP, CRM and EHR data into one experience.

HLT-05 · Customer-attested · verified 2026-11-05

PHI masking is tested and live.

ENF-08 · Self-asserted · verified 2026-11-02

Questions

What buyers ask next,answered plainly.

What is checked before a release?

The requester's identity, the legal basis (access right, authorization, permitted disclosure, subpoena or order, exception), the authorization's validity against the stored data, and the scope including the sensitive categories.

How fast must the hospital respond?

A patient's own access request within 30 days (one extension of 30 days with notice); other requests within the state's or the payer's period for the basis; a subpoena by its return date after the notice or order is verified.

Why log every disclosure?

Because the patient can request an accounting of disclosures for six years, and the log is the evidence of what was released to whom, on what basis and when.

Related processes

Patient right of access requests HIPAA authorizations Accounting of disclosures requests Payer document requests Try it in the sandbox All healthcare processes

Bring this process, or the one that costs you most.

We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.