CalMHSA Learn (LMS System)
Help Desk Ticket (Admin)
Customer Ticket Portal
EHR Bulletin

MENU
  • Last updated: July 15, 2026

How to Document a Release of Information (Authorization to Disclose Confidential Information)

Under HIPAA, mental health providers may disclose confidential information for the purpose of treatment, payment, or operations without the client’s explicit, written approval. For a mental health provider to share for any other reason, an authorization to disclose confidential information, also known as a release of information, or ROI, is required.  

Under 42 CFR Part 2, substance use disorder treatment providers may NOT disclose confidential information without the client’s explicit, written approval. This includes for treatment, payment, or operations.  

In this article, we will review how to complete the Release of Information (ROI) form in SmartCare. There are two ROIs in SmartCare:  

  1. The SmartCare Native ROI, which was created and is managed by Streamline 
  2. The CalMHSA Custom ROI, which was created and is managed by CalMHSA 

While CalMHSA considers both valid, counties continued to express concerns about the core ROI, which led to CalMHSA creating a custom ROI.  

Please note that the ROI is a legal document. It’s not considered valid until signed by the client or the appropriate representative (a guardian or legal guardian). SmartCare documents will list a document as “signed” as soon as the author (staff member) signs. Do not sign an ROI until the client or guardian is ready to sign. Always confirm the client has signed the ROI and the ROI is still valid before disclosing confidential information.  

Please also note that the person who must sign is the person who holds privilege over the records. For adult clients, this is almost always the client themselves. For young clients, this is often the parent. However, in the case of youth, this may be the client themselves, even if the client is not receiving services under minor consent laws. If you’re unsure of who holds privilege, consult with a supervisor or your county counsel. CalMHSA does not provide legal guidance in these situations.  

SmartCare Native Release of Information

  1. With the client open, click the Search icon.

  2. Type “Release of Information” into the search bar.

  3. Click to select “Release of Information (Client)” from the search results.
 

  1. If there’s already an ROI on file for the client, click the New icon.
    • Note: If this is the first ROI you’re creating, the system will automatically create a new ROI for you, so you can skip to the next step.
 

  1. The CDAG Program Enrollment window will pop up. Select your program from the drop-down menu and click OK.
 

  1. This will bring you to the Release of Information document. Complete the “Release To/Obtain From” section. This section is the person or entity that you’ll be sharing information with.
    • Enter the person or entity that you’re planning to exchange information with. This can be a personal contact or an agency. If it’s an agency, you’ll still want to enter a first and last name for the main point person at that agency, if possible.
 
 

  • If the person you’ll be sharing information with is already a contact person in the client’s Client Information screen, select “Contact”. Then select them from the dropdown menu in the “Release To/From” field. This will bring their information into this document from the Client Information: Contacts screen so that you don’t have to re-enter the information.
 
 
    • If the person you’ll be sharing information with is not a client contact on the Client Information screen, or is an agency, then select “Organization/Provider”. If this is an agency that you’ve used in the past, start typing the name in the “Release To/From” field to search. If you can find the person/entity, click to select it.
      If you don’t find the agency, c      lick on the 3 dots button that appears next to the “Release To/From” field. This will bring up a pop-up window where you can enter in all the agency’s information. After entering the information, click Save. This will close the pop-up window and take you back to the ROI document, where the information has now been entered. This will also save this entity for future ROIs.

  • Select whether you will be releasing information to this person/entity and/or obtaining information from this person/entity. You can select one or both, but must select at least one option.
 

 
  1. Complete the “Purpose of Disclosure” section. This is the reason you’re sharing information with the person/entity listed in #6 above. Most frequently, the purpose will be “Treatment/Care Coordination”. If you select “Other”, make sure to clarify in the text field. You must select at least one option, but can select more than one, if applicable.
  2. Complete the “Preferred Method of Delivery” section. Here you will select the physical or electronic method of the record disclosure.
  3. Complete the “Expiration” section. The system will automatically enter today’s date as the Start Date for the ROI document. You can leave this section blank to automatically end-date this ROI 1 year from the Start Date. You can also enter a specific end date or select one of the options available.
 
 
  1. Complete the “Information to be Disclosed” section. This is where you document what type of information will be shared. You can select as many as is appropriate.
    • The “ROI Type” field does not have any functionality built around this. It’s ok to leave this as “General”.
    • If you’re wanting to only release records from a specific time frame, enter the record start and end dates. Otherwise, leave these fields blank.
  2. If the client wishes to put any restrictions on this authorization, enter those in the “Restrictions” section. Otherwise, leave this section blank.
 
 
  1. The terms section provides the client with information about the authorization they’re signing. Make sure to review this information with the client before signing.
  2. Complete the “Agency Contact Information” section by selecting your program from the dropdown menu. This will bring in the information from the Program Details screen.
    • You can also enter yourself, or the appropriate person, in the “Attention” field.
 
 
  1. Document whether the client received or declined a copy of the ROI.
    1. You can also indicate how you confirmed the client’s identity and enter the name of the person who did so.
  2. Document whether the client is authorizing or prohibiting the release of SUD and HIV/AIDS information.
  3. CalMHSA does not use the Legal Authority field, leave this blank.

  1. Once you’ve completed the document, click Sign. This will create the PDF. The document is not considered “complete” until the client and/or guardian co-signs the document. Follow the instructions in How to Have a Client or Guardian Co-Sign a Document for detailed instructions on getting a client’s signature.

CalMHSA Custom Release of Information

  1. With the client open, click the Search icon.
  2. Type “ROI” into the search bar.
  3. Click to select “CalMHSA Custom ROI (Client)” from the search results.
 
 
  1. If there’s already an ROI on file for the client, click the New icon. 
    Note: If this is the first ROI you’re creating, the system will automatically create a new ROI for you, so you can skip to the next step. 
 

  1. The CDAG Program Enrollment window will pop up. Select your program from the drop-down menu and click OK.
 

  1. The first section is the Client Information section. This will display the client’s name, date of birth, and age.
  2. The next section, Program (Internal Entity) is where you will document if you, the program, are the discloser of information, recipient of information, or both. Click the appropriate radio button. The program and address will be listed at the bottom of the section.
 

The next section is External Entity. Based on the selection you made in the Program section, the radio button that matches your selection will already be selected in this section. For example: if you select both in the Program section then both will be selected in the External Entity section.

  1. Next, you need select the radio button for the Type of Entity
    • Client Contact: Select from contacts listed on the Client Information screen in the Client Contacts tab.
    • Organization: Select from organizations listed in the External Referral Providers list.
  2. Based on what you select above, click the dropdown arrow and select the entity or manually enter it. 
 

  1. Next is the Purpose of Disclosure section. Click the checkbox next the reason for disclosure. You can select as many as apply. If you use the “Other” checkbox, you must describe the reason in the free textbox provided.
    • Note: Under HIPAA, an authorization is not required for disclosures for treatment, payment, and/or healthcare operations (TPO), but for SUD programs operating under 42 CFR Part 2 regulations, an authorization (patient consent) is required for disclosures for TPO.
 

  1. Next is the Information to be Disclosed section. Click the checkboxes for the types of information the client authorized for disclosure. If you use the “Other” checkbox, you must describe the reason in the free textbox provided.
  2. In the Date Range of Authorized Records section, there are two radio buttons to indicate if the authorization is limited to records within a specific time period. Click the appropriate radio button according to the client’s preference.
 

  1. In the Expiration section, select when the authorization should expire. It will automatically default to “One year from the date the client/guardian signs.” To choose another option, select the appropriate radio button. 
 

  1. In the Client Rights and Terms of Authorization section, read this to your client carefully and thoroughly to make sure they understand what they are signing and agreeing to.
  2. Click Sign.
 

  • Last updated: July 15, 2026