I do exactly the same as Medlin Software.
I send/give NO information to anyone but the client. PERIOD.
If you send information, even with the signed consent form, and something goes bad with their dealings down the road, you have just inserted yourself smack dab in the middle.