Because of the sensitive nature of health care information, physicians generally must obtain patient consent before disclosing patient records to third parties. The theory of informed consent to release of information originates in the concept of informed consent to medical treatment. Medical and research codes, as well as Federal regulations, have traditionally emphasized the elements of disclosure, voluntariness, comprehension, and competence to consent. For there to be informed consent to medical treatment, the act of consent must be genuinely voluntary, and there must be adequate disclosure of information to the patient about what is to be done. Patients must comprehend what they are being told about the procedure or treatment, and be competent to consent to the procedure.
On the basis of this model, if informed consent requires communication of information and comprehension by the patient of what he or she is being told, informed consent to disclosure of medical information is arguably possible only when patients are familiar with the data contained in their records, so that they understand what they are consenting to disclose. Because many patients are neither granted access to their medical records, nor apprised of which portions of the record are accessible to others, most patients are ill-equipped to make intelligent choices about authorizing disclosures.