There are circumstances under which a patient’s authorization is NOT required to disclose their protected health information (PHI). One of those circumstances is when covered entities, such as practices, share patient information with another provider for treatment purposes. Many practices do not understand this provision, and require other practices to obtain a signed authorization before releasing PHI.

HHS has provided the examples below to help covered entities understand this provision:

• A hospital may use protected health information about an individual to provide health care to the individual and may consult with other health care providers about the individual’s treatment.
• A health plan may use protected health information to provide customer service to its enrollees.
• A covered entity may disclose protected health information for the treatment activities of any health care provider (including providers not covered by the Privacy Rule). For example:
  • A primary care provider may send a copy of an individual’s medical record to a specialist who needs the information to treat the individual.
  • A hospital may send a patient’s health care instructions to a nursing home to which the patient is transferred.

Any disclosures made must be consistent with your Notice of Privacy Practices.

The full text of the HHS guidance can be found here.

Feel free to share this link with other providers that are requiring authorizations for disclosures that do not warrant them. Keep in mind, however, that if a practice refuses to disclose information to you without a signed authorization, the quickest way to get the information you need is often to obtain the authorization. You may send and receive authorizations remotely.  You do not have to require a patient to sign an authorization in person. You would simply perform reasonable identity verification measures to confirm that you are sending the information to an address, fax or email address that you have confirmed with the patient, and their signature matches what you have on file.