To be able to release the information to the requester they need to have appropriate authority from the data subject or be a bona fide regulator acting within their powers.
Regulators will know what powers they are using and should specify this in a written communication.
Likewise a professional acting on behalf of a client will have obtained pre consent e.g. “I am a solicitor acting on behalf of my client Mr X and request a copy of his medical records. Appropriate authority is enclosed”.
DO NOT RELEASE IT OTHERWISE