What Protected Health Information (PHI) Disclosures Do Not Require Authorization?

There are three times that you can disclose protected health information without the patient's written authorization. They are for treatment, payment, or health care operations. Let's take a closer look at each of these.

You can disclose PHI without the patient's written authorization if you are communicating with the ordering and referring physician or the physician or healthcare practitioner you're referring to because that's all-around coordination of care. I am always going to tell you to err on the side of being conservative. Here's an example. A physician referred a patient to your practice. You could send results back to that physician and not need the patient's authorization to do so. But let's say a different physician reaches out to you and wants a copy of the patient's records. You should get authorization from the patient to send to that new entity or to transfer your records to another provider. You should get authorization from the patient. Let's say a school system reaches out to you. I would not send results to a school without the patient's authorization.

You do not need a patient's authorization to send claims to their insurance company. It's important to note that patients can restrict disclosures to their insurance company and waive their insurance benefits if they want. Health care operations generally include anything around your business. This could be administrative, financial, legal, and quality improvement activities of a covered entity that are necessary to run its business. Remember, you're going to have business associates' agreements with your accountant and your attorney, things regarding accreditation, and insurance or other audits and you do not need the patient's authorization. You can disclose information that's in your medical record that was provided by another provider because it's now part of your record.