HIPAA and Patient Records: Can Doctors Request Access Without Consent?

HIPAA Privacy Rule: General Principle

Covered entities must obtain patient written authorization before disclosing protected health information (PHI) to third parties, including other providers—unless an exception applies.

Key Exception: Treatment Purposes

§164.506(c)(2): A covered entity may disclose PHI for treatment activities of another provider without authorization. This includes:

• Referral to specialist.
• Consultation between providers.
• Transfer of care (hospital to SNF, PCP to specialist).
• Care coordination (e.g., PCMH, ACO).

Condition: The disclosure must be for the recipient’s treatment of the individual. Not for marketing, research, or employment.

Other Common Exceptions (No Authorization Needed)

• Payment (billing, collections).
• Healthcare operations (quality, training, credentialing).
• Public health reporting (communicable disease, vital stats).
• Law enforcement (specific circumstances).
• Emergency / imminent danger.
• Judicial/administrative proceedings (court order, subpoena with notice).

“Minimum Necessary” Standard

Even when disclosure is permitted, only the minimum necessary PHI should be shared for the stated purpose.

Patient Rights

• Request restriction on disclosures (provider not required to agree except for self-pay in full).
• Request confidential communications (alternative address/phone).
• Access own records (§164.524).
• Accounting of disclosures.
• File complaint with OCR (HHS).

Best Practice for Providers

1. Verify identity of requesting provider.
2. Confirm treatment purpose.
3. Send only relevant records (not entire chart unless needed).
4. Use secure fax, encrypted email, health information exchange (HIE), or patient portal.
5. Document disclosure in accounting log.