Also ROI, records request, HIPAA authorization
Release of information is the name of a department in most hospitals and of an industry outside them. It handles two kinds of request. The first is the patient’s own, under 45 CFR 164.524, which gives the individual a right of access to their records within 30 days, in the form they ask for, at a cost-based fee. The second is a disclosure to someone else under an authorization the patient signs, under 164.508: an attorney building a case, an insurer underwriting a policy, a disability examiner, an employer. The authorization names what may be released, to whom, and for how long.
Both routes share a shape. A form is completed, a request is sent, a clerk pulls the record, a fee may be charged, and the record arrives in days or weeks, often as a PDF of a printout. The “medical records retrieval” companies that dominate search results sell this process at scale to law firms and insurers, and they are good at it.
None of it applies to a treating provider asking another treating provider. That disclosure is permitted without authorization under treatment purpose of use, is exempt from the minimum necessary standard, and on the exchange networks is answered by machine in seconds through a network query. An agency that collects a signed release for every admission and faxes it to the hospital is using the ROI route for a disclosure that never needed it, and paying for that choice in days.
The line between the two is the line Vivlio draws. It retrieves for treatment and the operations that support it. It is not a release-of-information vendor, does not serve legal or payer requests, and the distinction is in its agreements rather than its marketing.