Live & Recorded Virtual Event
Overview
This course provides an overview of authorization fundamentals, examines patient Right of Access laws, and explores the rights of family members, minors, and deceased patients. It also introduces key distinctions between standard authorization processes and legal requests.
Learning Objectives:
- Explain the fundamental principles of authorization in healthcare, including when authorization is required and the key elements of a valid authorization.
- Describe patient Right of Access laws and analyze how these laws apply to different populations, including family members, minors, and deceased patients.
- Differentiate between standard authorization-based requests and legal requests (e.g., subpoenas, court orders), identifying appropriate processes for each.
Kimberly McGhee, RHIT, CRCR
1.0 – Information Protection: Access, Disclosure, Archival, Privacy and Security
This training offers an overview of the Illinois Mental Health and Developmental Disabilities Confidentiality Act (740 ILCS 110), one of the nation’s strongest privacy laws for mental health records. It explains how the Act relates to—and often exceeds—HIPAA, defines what qualifies as protected mental health information, and outlines the requirements for a valid Release of Information (ROI). Using practical examples and compliance guidance, the session prepares health information professionals to process disclosures correctly, avoid common errors, and reduce legal and organizational risk. Key topics include documentation standards, redisclosure limits, and how to determine when disclosure is permitted, requires authorization, or is prohibited.
Learning Objectives:
- Explain the purpose and scope of the Illinois Mental Health and Developmental Disabilities Confidentiality Act (740 ILCS 110).
- Describe how Illinois law differs from and is stricter than HIPAA in protecting mental health records.
- Identify all required components of a valid ROI under Illinois law.
- Recognize invalid or incomplete authorizations, including those that are HIPAA‑only or overly general.
- Determine when disclosure is permissible with consent, requires a specific exception, or must not occur.
- Apply the “minimum necessary” principle to all permitted disclosures, including for billing and payment.
- Utilize the ROI decision tree and checklist to support consistent, compliant release-of-information practices.
Elizabeth (Liz) White, RHIA, CHPS
1.0 – Information Protection: Access, Disclosure, Archival, Privacy and Security
HIPAA and Illinois statutes grant patients the right to access their personal health information. Enabling patient access empowers individuals to participate more actively in their healthcare decisions. Under these laws, patients may request—and healthcare facilities must provide—access to and copies of their health information, with limited exceptions.
The presentation will review the Right to Access, Personal Representatives, and Patient Directives. It will also outline best practices for fulfilling requests for health information and explain circumstances in which access may be limited.
Learning Objectives:
Attendees will learn best practices related to HIPAA and IL state statutes regarding:
- Individual’s Right to Access
- Individual’s Right to Direct PHI to Another Person
Patient Right to Access and Personal Representatives
Colleen Goethals
1.0 – Information Protection: Access, Disclosure, Archival, Privacy and Security
This session explores the legal and regulatory framework governing the release of protected health information (PHI) in legal and investigative settings. Participants will review key state and federal laws, differentiate between common legal documents used to request medical records, and examine appropriate responses to requests from law enforcement and governmental agencies. The session will also provide practical guidance and best practices for evaluating PHI requests to ensure compliance and safeguard patient privacy.
Learning Objectives:
- Understand state and federal laws that govern the release of PHI in a legal or investigative setting, including HIPAA, the Il Mental Health and Developmental Disabilities
Confidentiality Act, 42 CFR Part 2, and the IL worker’s compensation act. - Gain an understanding of the difference between a subpoena,
court order, and other documents used to request medical records in a legal setting, including requests for testimony by a medical provider. - Review the release of records to law enforcement and
records requested by governmental agencies, including IDFPR or IDPH. - Receive guidance on best practices for evaluating requests for PHI in a legal or investigative setting to determine if records can be released.
Katie Anderson
1.0 – Information Protection: Access, Disclosure, Archival, Privacy and Security
Join a panel of experienced Release of Information professionals as they walk through real case studies involving complex, uncommon, and high‑risk ROI scenarios. Using practical examples, the panel will highlight how to navigate challenging requests while remaining compliant with HIPAA and Illinois’ more stringent state laws, including specialized protections for mental health, substance use, and sensitive health information. Attendees will gain actionable strategies to strengthen decision‑making, reduce compliance risk, and ensure accurate, privacy‑focused disclosures.
Learning Objectives:
- Evaluate complex or unusual ROI requests and identify which federal and Illinois state laws apply.
- Apply HIPAA Privacy Rule requirements—including minimum necessary, valid authorization elements, and permitted disclosures—to real-world scenarios.
- Differentiate between HIPAA protections and stricter Illinois confidentiality laws, such as those governing mental health, substance use, and HIV/AIDS-related information.
- Implement effective verification, documentation, and workflow processes to minimize compliance risk when handling complicated ROI situations.
- Strengthen critical thinking and decision-making skills through analysis of subpoenas, law enforcement inquiries, family and custody issues, and other high-risk requests.
- Communicate effectively with requestors and internal teams to ensure accurate, timely, and privacy‑compliant disclosures.
1.0 – Information Protection: Access, Disclosure, Archival, Privacy and Security
This interactive round table invites Release of Information professionals and privacy leaders to engage in open dialogue about challenging, unusual, or high‑risk disclosure scenarios. Participants will have the opportunity to submit questions in advance or raise them during the session, allowing facilitators to offer real‑time guidance rooted in HIPAA requirements and Illinois’ more stringent confidentiality laws. Through shared experiences, expert recommendations, and collaborative problem‑solving, attendees will gain practical insights to strengthen compliance, refine workflows, and confidently navigate complex ROI situations.
Learning Objectives:
- Discuss real-world ROI challenges based on participant-submitted questions and explore compliant solutions through group dialogue.
- Identify how HIPAA and Illinois‑specific laws intersect when responding to unusual, sensitive, or high‑risk disclosure requests.
- Strengthen decision‑making skills by analyzing diverse scenarios involving subpoenas, minors, mental health records, and law enforcement inquiries.
- Explore best practices for documentation, verification, and communication that support consistent and defensible ROI processes.
- Collaborate with peers and privacy experts to gain fresh perspectives on emerging issues and evolving industry standards.
- Leave with actionable recommendations tailored to real questions raised by attendees.
Elizabeth (Liz) White, RHIA, CHPS
Kimberly McGhee, RHIT, CRCR
Susan Freed, MHA-L, RHIA, CHP, CRIS
Colleen Goethals
1.0 – Information Protection: Access, Disclosure, Archival, Privacy and Security
Course Info
Published Date
April 2026
Total CEs
6.0
Domain(s)
Information Protection: Access, Disclosure, Archival, Privacy and Security
Pricing
ILHIMA Member
$100
Non-Member
$150
Student
$20
ILHIMA Member – an AHIMA dues-paying member who has selected Illinois as their Component Association (CA)
Non-Member – includes AHIMA dues-paying members from other AHIMA Component Associations (CA) as well as AHIMA Credentialed Non-Members
Learn More
Speakers
Additional Information
AHIMA
This educational offering has been approved for continuing education credit for use in fulfilling the continued education requirements of the American Health Information Management Association (AHIMA).
AAPC
CEUs are accepted from programs sponsored by AHIMA national offices and the state or regional AHIMA branches. One hour of instruction is worth one CEU. A certificate of attendance or completion is necessary to show participation.
ACDIS
AHIMA CEUs that are CDI-related are accepted.
Register
In order to access this course, you will need to click on the button labeled “Register for this Course.“
Already Purchased Course?
If you have already purchased this course, then you will need to sign in to access and then click on the session(s) listed under Course Content.
Access instructions for the course will be emailed to you within 2 business days following receipt of payment.
You will have 60 days to access the course after access has been granted.
How Do I Receive the CE?
You must click on the button labeled “Mark Complete” at the bottom of each course page before the CE will appear on the My Certificates page.
- For on-demand events, access instructions for the course will be emailed to you within 2 business days following receipt of payment.
- You will have 60 days to access the course. If your course has expired, and you need an extension, please contact us.
- You must click on the button labeled “Mark Complete” at the bottom of each course page before the CE will appear on the My Certificates page.
View more FAQs.
Need assistance? Contact us!
Course Content
Course Includes
- 4 Lessons
- Course Certificate
