When is it permissible to share PHI without patient authorization?

When is it permissible to share PHI without patient authorization?

• A. For marketing purposes with patient consent
• B. Only with the patient’s written authorization
• C. For research purposes without consent
• D. For treatment, payment, health care operations, or as required by law

Answer: (D)

Under HIPAA, PHI can be shared without patient authorization for certain routine, lawful purposes. The big idea is that some disclosures are allowed without a signed permission because they enable care and compliance with the health system’s responsibilities. Specifically, sharing PHI is permissible for treating the patient (so other clinicians can coordinate care), for payment (like processing claims with insurers), and for health care operations (such as quality improvement or case management). It’s also allowed when disclosure is required by law, such as public health reporting or court orders. Disclosures for marketing usually require the patient’s authorization, and research disclosures without consent generally need a waiver or de-identified data. That’s why the described permissible categories—treatment, payment, health care operations, or as required by law—are the correct set of circumstances for sharing PHI without authorization.

Under HIPAA, PHI can be shared without patient authorization for certain routine, lawful purposes. The big idea is that some disclosures are allowed without a signed permission because they enable care and compliance with the health system’s responsibilities. Specifically, sharing PHI is permissible for treating the patient (so other clinicians can coordinate care), for payment (like processing claims with insurers), and for health care operations (such as quality improvement or case management). It’s also allowed when disclosure is required by law, such as public health reporting or court orders.

Disclosures for marketing usually require the patient’s authorization, and research disclosures without consent generally need a waiver or de-identified data. That’s why the described permissible categories—treatment, payment, health care operations, or as required by law—are the correct set of circumstances for sharing PHI without authorization.