Release of Information in the Age of AI: Leadership, Risk, and Oversight Considerations

Artificial intelligence (AI) is beginning to reshape how healthcare organizations process requests for health information, retrieve records, identify sensitive content, and support disclosure workflows. For health information (HI) professionals, these changes present opportunities to improve efficiency and timeliness while introducing new considerations related to disclosure accuracy, patient privacy, and regulatory compliance.

As AI becomes more integrated into release of information (ROI) operations, HI professionals must ensure that this technology supports appropriate disclosure practices without compromising patient rights or organizational accountability.

ROI is one of the most visible and legally significant health information management (HIM) functions. Every disclosure of protected health information (PHI) requires balancing information access with privacy protection. While AI can streamline labor-intensive processes, errors in AI-assisted disclosure decisions may expose organizations to such problems as privacy breaches and regulatory penalties.

The increasing complexity of healthcare privacy requirements further elevates the importance of organizational oversight and accountability. In addition to HIPAA, organizations must navigate state privacy laws, 42 CFR Part 2 requirements, reproductive health protections, and other specialized disclosure restrictions.

AI also has implications for patients’ rights to access their health information. The HIPAA Privacy Rule establishes a legal right for individuals to obtain copies of their medical records, and the Office for Civil Rights (OCR) has reinforced this requirement through its Right of Access Initiative. Delays in processing requests, incomplete disclosures, and inconsistent workflows can create barriers to patient access and expose organizations to regulatory scrutiny.

As organizations seek to improve response times and manage increasing request volumes, AI may offer practical solutions for streamlining administrative processes. However, efficiency gains should not come at the expense of disclosure accuracy, privacy protections, or regulatory compliance.

The Health Information Governance Perspective

Effective information stewardship provides the framework for managing health information throughout its lifecycle, including how information is accessed, disclosed, and protected. Traditionally, ROI oversight focused on authorization management, record integrity, privacy compliance, and disclosure accountability. The introduction of AI expands these responsibilities to include evaluating how technology influences disclosure-related activities such as record retrieval and sensitive information identification.

Within ROI operations, oversight extends beyond managing authorizations and disclosure logs. Organizations must establish processes for validating how AI identifies records, applies redaction rules, prioritizes requests, and supports disclosure decisions. Because AI may influence what information is released—or withheld—organizations must be able to explain, monitor, and audit system recommendations to ensure compliance with applicable disclosure requirements.

Key AI Use Cases in ROI

Unlike many healthcare AI applications that focus on clinical decision-making or predictive analytics, ROI technologies operate at the point where patient access, privacy protection, and regulatory compliance intersect. AI in ROI is primarily used to support information retrieval, disclosure review, and privacy protection activities.

AI may assist with categorizing incoming requests, and  AI-enabled tools may help perform tasks such as locating records across multiple systems and identifying missing authorization elements. For example, when records exist across multiple facilities, applications, or document repositories, AI-assisted retrieval tools may help identify and assemble potentially relevant records for staff review, reducing the time required to locate information prior to disclosure. Some technologies can analyze document content to identify information that may be subject to special protections, while others may help route requests to the appropriate reviewer based on complexity or risk.

AI may also help identify requests requiring additional review because of state-specific disclosure requirements, sensitive record types, or incomplete authorizations. By prioritizing higher-risk requests, AI can allow ROI professionals to focus their expertise where human judgment is most critical. These capabilities may improve turnaround times, reduce administrative burden, and promote greater consistency across disclosure workflows while maintaining appropriate human oversight of disclosure decisions.

Governance Risks with AI

While AI offers significant operational benefits, it also introduces new risks such as over-disclosure, and inconsistent disclosures may create compliance concerns and increase operational risk. Organizations must also address issues related to privacy, security, system transparency, and third-party accountability.

AI-assisted retrieval and disclosure processes must also support compliance with HIPAA’s minimum necessary standard. If systems retrieve or package more information than is required for disclosure, organizations may increase the risk of impermissible disclosure even when a valid authorization or request exists.

If AI tools are not properly configured, validated, or monitored, similar requests may produce different outcomes depending on how records are classified, retrieved, or redacted. Such variability can undermine confidence in the integrity of the ROI process.

Consider an ROI request that includes behavioral health documentation and substance use disorder treatment information. An AI-assisted redaction tool may successfully identify most sensitive content but fail to recognize a reference to Part 2-protected information embedded within a clinical note. Without appropriate human review, the organization could inadvertently disclose information subject to additional federal protections. This example illustrates why validation, monitoring, and workforce oversight remain essential.

Governance Controls to Mitigate Risk

Effective oversight mechanisms are essential to ensure responsible use of AI within ROI processes. Formal review structures, validation testing, human oversight for sensitive disclosures, routine audits, and incident reporting processes help support safe implementation and ongoing performance monitoring.

Third-party oversight is equally important. Healthcare organizations should evaluate AI vendors for transparency, security controls, audit capabilities, model update practices, and compliance with healthcare privacy requirements before deployment. Organizations should also:

• Determine whether AI vendors function as business associates
• Understand how PHI is used within AI-supported services
• Ensure contractual safeguards adequately address privacy, security, and permitted uses of information

Considerations for Sensitive Health Information

Mental health records, substance use disorder treatment records governed by 42 CFR Part 2, reproductive health information, HIV-related records, genetic testing results, and records involving minors often require heightened protections.

A risk-based review approach can help ensure that disclosures involving highly sensitive information receive appropriate levels of scrutiny. AI tools should support—not replace—the professional judgment necessary to interpret complex legal and regulatory requirements and apply disclosure restrictions appropriately.

Leadership Responsibilities for HI Professionals

As AI becomes embedded within ROI operations, the role of HI professionals is expanding from managing disclosure workflows to overseeing how technology influences disclosure decisions. While AI may assist their work, accountability for protecting patient information remains a human responsibility.

In practice, HI leaders must determine where AI can be safely incorporated into ROI workflows, establish review requirements for high-risk disclosures, monitor disclosure quality, and address issues identified through audits, complaints, or incident investigations. They must also ensure that policies, procedures, and workforce practices evolve alongside emerging technologies and changing regulatory expectations.

Workforce readiness remains an important leadership responsibility. Staff should:

• Understand the limitations of AI technologies
• Recognize situations requiring escalation
• Remain accountable for validating disclosure decisions involving protected health information

The continued evolution of AI will require HI professionals to convert regulatory requirements into operational processes that support accurate and compliant disclosure practices. Their ability to align technology, policy, and workforce expectations will influence how successfully organizations incorporate AI into ROI operations.

Robyn Stambaugh, MS, RHIA, CHPS, is education program director of privacy and security/compliance at AHIMA.