How to draft a Release of Information (ROI)

Every cross-agency data share runs through a versioned, scoped, person-signed Release of Information. The ROI ledger lives at the platform level (not per-org) so a person who signs once can have their record visible to every partner agency in the chain — without re-typing or re-faxing forms.

What an ROI carries:
• personId + personOrgId — the canonical Person record
• grantedToOrgIds — the partner agencies who can see the record (up to 5 per ROI)
• scope — which fields are shared: identity / contactInfo / enrollmentStatus / assessmentScores / healthInsurance / benefits / healthRecords / substanceUse / criminalHistory
• authority — usually 'self'; can be 'parent-guardian' or 'court-order'
• effectiveAt + optional expiresAt — many states require explicit 12-month expiry
• signatureMethod — e-signature is preferred; verbal-witnessed is supported for crisis intake

The drafting flow:
Continuum tab → Consents → Draft new. Pick the partner agencies + scope, route to the person for e-signature. The signed PDF lives in the ledger forever; if revoked, a paired revocation PDF is stamped.

Special scopes that carry extra rules:
• healthRecords — HIPAA consent has its own rules; the form switches to HIPAA-grade language
• substanceUse — 42 CFR Part 2 requires separate consent; we never bundle this with general health
• dv — VAWA usually denies this; the comparable database silo is separate from HMIS

Person-side revoke:
The person can revoke any ROI from /me/services at any time — no reason required, no manager approval, no waiting period. The agencies lose access immediately. Their services don't stop — only the data sharing.

Have Wally do it: ask "warm handoff to Cornerstone Family Services" and the action card drafts the ROI for confirmation.