The son of one of the elderly patients calls advising that he set up his mother's EHR web portal and does all of her appointment scheduling, review of tests, etc. via the portal. He then requests information from you about recent blood work results that he cannot access through the portal, but you do not have a signed release from the patient to speak with the son.

Is it appropriate to give the information to the son since he already has access to his mother's information through the practice web portal? Why or why not?