Do You Really Need an ROI?

When Therapists Can Communicate with Other Providers Without an Authorization

“I can’t talk to the prescriber until I have an ROI.”

This is a common refrain I hear from therapists. Many of us were trained to be extremely cautious about confidentiality, and for good reason. But somewhere along the way, many therapists distilled that caution into a simple rule that is simply too simple:

No ROI = no communication.

However, according to HIPAA, it’s more nuanced than that.

Under HIPAA, covered healthcare providers are generally permitted to use and disclose protected health information (PHI) for treatment, payment, and healthcare operations (TPO) without obtaining a separate authorization from the client. Health and Human Services (HHS) specifically allows healthcare providers to share information with other healthcare providers for treatment purposes.

So if you and a psychiatric prescriber are both treating the same client, HIPAA generally permits you to coordinate care without an ROI, even when the prescriber works in a different practice.

There are several things to consider when deciding whether you need an ROI, and we’ll look at each of them:

• who you’re communicating with and their role in the client’s care
• the purpose of the communication
• what information you’re sharing, including the special rules for psychotherapy notes
• whether waiting for an ROI is best practice in all circumstances
• state confidentiality laws and licensing requirements
• other federal confidentiality laws, including 42 CFR Part 2
• your organization’s policies

For example, your client reports sleeping only two or three hours a night for several nights, escalating agitation and racing thoughts since a recent medication change. Her functioning has deteriorated significantly, and you’re concerned about waiting to contact her prescriber.

You may be able to make that call without waiting for an ROI. Knowing when you can is part of understanding confidentiality.

What About Providers in the Same Practice?

A question in my Facebook Group started me looking more closely at this issue.

If you and the prescriber are in the same practice and both treating the client, HIPAA generally permits you to share information needed for treatment without a separate authorization. However, your practice may have its own policy about ROIs, your state may impose additional confidentiality requirements, and some types of information receive additional protection.

Psychotherapy Notes Are Different

HIPAA gives special protection to psychotherapy notes, a term that does not refer to your regular progress notes.

Psychotherapy notes document or analyze the contents of psychotherapy conversations and are kept separate from the rest of the client’s medical record. I refer to them as “memory notes” because they are the private notes a therapist may use to jog their memory about a previous session.

With limited exceptions, HIPAA requires the client’s authorization before these separately maintained psychotherapy notes can be disclosed, including disclosure to another healthcare provider for treatment.

So you may be permitted to speak with a client’s psychiatric prescriber about treatment without an ROI while still needing authorization to send your separately maintained psychotherapy notes.

What About Collaterals?

We use the word collateral pretty loosely in behavioral health. It might refer to another treating provider, a spouse, a parent, a teacher, an attorney, a caseworker, or someone else involved in the client’s life.

The term collateral doesn’t tell you whether you need an ROI to communicate with that person.

Before communicating with a collateral, consider:

• Who is this person?
• What is their role in the client’s care?
• Why are you communicating with them?
• What information do you want to disclose?
• Do you have authorization or another legal basis for disclosing it?

A treating psychiatrist may fall under HIPAA’s provisions allowing disclosure for treatment. Communication with a spouse, parent, school, employer, attorney, or other third party doesn’t necessarily fall under the same treatment provisions and may require authorization. State law and other confidentiality requirements can also determine what you may disclose.

State Laws and Other Confidentiality Requirements

You also need to check the confidentiality laws in the state where you practice.

HIPAA establishes federal privacy requirements. States can have additional laws governing mental health records, confidential communications, privilege, minors, substance-use treatment, and disclosure of sensitive information.

This means a disclosure permitted by HIPAA may still be restricted under state law.

Requirements vary considerably from state to state. This is especially important for therapists providing telehealth across state lines and group practices with clinicians practicing in multiple states.

Before deciding whether an ROI is required, check:

• What does HIPAA permit or require?
• What does your state’s law permit or require?
• Does your licensing law or licensing board have additional requirements?
• Does another confidentiality law apply to this information?
• Does your organization have a more restrictive policy?

42 CFR Part 2 is one example. It applies to SUD records created by federally assisted programs that meet the definition of a Part 2 program. The rules governing consent and disclosure changed substantially, with compliance with the new requirements becoming mandatory February 16, 2026. If Part 2 applies to your practice, make sure you’re working from the current rules.

An ROI Isn’t Always Best Practice

Despite the common belief that obtaining an ROI is always best practice, it may not be.

I’m for transparency because it builds trust. If I’m going to coordinate with another provider, I want my client to know that we’re communicating and why. An ROI clarifies who the client wants involved in treatment and what information may be shared.

Sometimes waiting for an ROI can create its own clinical problem. An emergency is the clearest example. When the law permits you to share information needed for treatment or safety, paperwork shouldn’t postpone communication when time and treatment are critical.

Less dramatic situations can still require timely action. A concerning medication reaction or significant deterioration in functioning may warrant a call to the prescriber. Requiring an ROI when the law doesn’t can put unnecessary paperwork between a clinical concern and a clinical response.

Best practice means understanding the rules well enough to know when you need an ROI and when waiting for one could interfere with care.

Once you’ve determined that an ROI is needed, there’s another practical question: Do you need a separate authorization for every person or provider? I addressed that question in Can One Release of Information Authorize Multiple People or Providers?

Document the Coordination

If you coordinate with another provider, your note should capture enough information to explain what happened later.

“Spoke with psychiatrist. Coordinated care.”

That may jog your memory next week but three years from now? I can’t remember what I ate for dinner last night.

Include:

• why you contacted the provider;
• the clinically relevant information you shared;
• important information you received;
• decisions or recommendations that resulted; and
• follow-up plans.

For example:

Care coordination: Spoke with client’s psychiatric prescriber, Dr. Lee, regarding significant increase in insomnia and agitation following recent medication change. Shared client’s report of sleeping 2 to 3 hours nightly for the past four nights, increased racing thoughts, and difficulty functioning at work. Dr. Lee reported that medication was increased last week and will contact client today to reassess. Client denied SI/HI during today’s session; no imminent safety concerns identified. Will follow up with client tomorrow regarding symptoms and outcome of medication consultation.

Document enough to remember why you coordinated care, what information was exchanged, and what you and the other provider decided to do next.

Before You Decide You Can’t Make the Call

If you find yourself saying, “I can’t talk to their prescriber because I don’t have an ROI,” make sure you know what’s preventing you from making the call.

Confidentiality protects something enormously important in psychotherapy. Clients need to trust us with information they may tell no one else.

Check HIPAA. Check your state statutes and regulations. Check your licensing requirements. Determine whether Part 2 or another confidentiality law applies. Know your organization’s policies.

Knowing the rules helps us honor that trust while opening the door for important communication when it needs to happen.

Documenting Collateral Contacts

Care coordination is easy to bury in a progress note with little more written than “spoke with prescriber.”

If you want a form that guides you through what to write, the Documentation Wizard Essential Clinical Forms Package includes a Case and Collateral Note specifically for these contacts. It prompts you to capture who you communicated with, why the contact occurred, the relevant information exchanged, and what happens next.

Clinically important conversations need enough documentation to preserve what happened and why. A Case and Collateral Note keeps that information from disappearing into the record. It supports continuity of care and gives you something solid to stand on if your clinical decisions are ever questioned.

This article is for educational purposes and is not legal advice. Requirements vary by state, payer, license, and practice setting. Check the laws, regulations, payer requirements, and professional standards that apply to your practice.