When Can a Covered Entity Disclose PHI Without Authorization?

A covered entity can disclose protected health information without a patient’s authorization in two broad situations: for routine treatment, payment, and healthcare operations, and for a defined list of public-interest purposes written into the HIPAA Privacy Rule. Knowing when a covered entity can disclose PHI without authorization matters because the list is longer than most patients realize and includes disclosures the patient never sees, from public health reports to law enforcement requests to research studies.

The categories below come directly from the Privacy Rule at 45 CFR 164.502, 164.506, 164.510, and 164.512. Some are permissive, meaning the entity may disclose but doesn’t have to. Two are mandatory. Several require the entity to first give the patient a chance to object, even if no signed form is involved.

Treatment, Payment, and Healthcare Operations

This is the exception that keeps the healthcare system running day to day. A covered entity may use and disclose PHI for its own treatment, payment, and healthcare operations without any patient authorization.¹

Treatment covers sharing your records with a specialist for a referral, sending your chart to a lab, and letting a pharmacist check your prescription history for drug interactions. A covered entity may disclose PHI for the treatment activities of any healthcare provider, not just its own staff.¹

Payment includes submitting insurance claims, coordinating benefits between plans, determining eligibility, and collecting amounts owed. A covered entity may also disclose PHI to another covered entity or provider for the payment activities of the entity receiving the information.¹

Healthcare operations covers internal activities like quality assessment, staff training, compliance reviews, auditing, and fraud detection. Sharing PHI between two covered entities for operations is more restricted: both entities must have a relationship with the patient, and the disclosure must relate to that shared relationship.¹

A provider may still ask you to sign a consent form for these uses, but the Privacy Rule doesn’t require one. Formal written authorization is reserved for more sensitive disclosures, such as marketing or the sale of PHI.²

When Disclosure Is Required, Not Just Allowed

Two disclosures are mandatory. First, when you request access to your own PHI in a designated record set, the covered entity must provide it, including the right to direct that copies be sent to a third party you choose.³

Second, a covered entity must disclose PHI to the Department of Health and Human Services when HHS requests it for a compliance investigation, review, or enforcement action.⁴ Refusing to hand over records during an HHS inquiry is itself a violation.

Disclosures Where You Get a Chance to Object

The Privacy Rule creates a middle category where no written authorization is needed but the patient gets an informal opportunity to agree or object.⁵

A hospital may maintain a facility directory that lists your name, general condition, location in the facility, and religious affiliation. Anyone who asks for you by name may be told most of that information, and religious affiliation may be shared with clergy. Before the listing goes live, the hospital must tell you what the directory includes and let you restrict or opt out. If you arrive incapacitated or in an emergency, the provider can include you based on professional judgment and any known prior preferences.⁵

A covered entity may also share PHI with a family member, close friend, or anyone else you identify as involved in your care, as long as you have the chance to agree or object. That is the rule allowing a doctor to discuss your condition with your spouse in the exam room or update a parent about an adult child’s surgery. When you can’t be asked, the provider may use professional judgment about what serves your best interest.⁵

Public Health, Safety, and Abuse Reporting

Covered entities may disclose PHI without authorization to a public health authority that is legally authorized to collect information on disease, injury, births, deaths, and other surveillance data. The rule also permits disclosures for public health investigations and interventions.⁴

PHI may go to a person who has been exposed to or is at risk of contracting or spreading a communicable disease, if the covered entity or public health authority is legally authorized to make that notification.⁴ This is what supports contact tracing during outbreaks.

A separate provision covers imminent danger. A covered entity may disclose PHI when it believes in good faith that disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, as long as the recipient is someone reasonably able to prevent or lessen the threat.⁴ Both words matter: the threat must be serious and it must be imminent. A vague concern about future behavior doesn’t qualify.

Victims of Abuse, Neglect, or Domestic Violence

A covered entity may report PHI about a person it reasonably believes to be a victim of abuse, neglect, or domestic violence to a government authority authorized to receive those reports.⁴ The rules turn on who the victim is:

Child abuse or neglect may be reported to a government authority without consent, where state law permits or requires reporting.
For adult victims, if a state mandatory-reporting statute requires the disclosure, no patient agreement is needed.
For adult victims, disclosure is also permitted without agreement when necessary to prevent serious harm to the victim or others.
In other adult situations, the covered entity generally must obtain the individual’s agreement before reporting. If the patient is incapacitated, disclosure may proceed without agreement only when it won’t be used against the individual and is needed for immediate enforcement activity.

Courts, Subpoenas, and Law Enforcement

PHI may be disclosed in response to a court order, including an order from an administrative tribunal, without patient authorization. The entity discloses what the order specifies.⁶

Subpoenas and discovery requests are treated differently. A covered entity that is not a party to the litigation may disclose PHI in response to a subpoena or discovery request only if it receives satisfactory assurances that the patient has been notified and given time to object, or that a qualified protective order has been sought.⁶ A bare subpoena from an attorney, without those assurances, is not enough. Providers frequently get this wrong: a subpoena arrives, staff assume they must comply immediately, and records go out that shouldn’t have.

Law enforcement disclosures are permitted in several specific scenarios, each with its own limits. When police are trying to identify or locate a suspect, fugitive, material witness, or missing person, a covered entity may respond without a court order or warrant, but only with a narrow set of identifying details: name, address, date and place of birth, blood type, type of injury, date and time of treatment or death, and distinguishing physical characteristics. The full medical record is off-limits under this provision.⁷

For broader disclosures of medical evidence, a formal legal instrument is required: a court order, a court-ordered warrant, a grand jury subpoena, or an administrative request that meets specific criteria (the information must be relevant, the request must be specific, and de-identified information must not suffice).⁷

A covered entity may also disclose PHI to law enforcement if it believes in good faith that the information is evidence of a crime that occurred on its premises.⁷ The provision covers the entity’s own premises only.

Health Oversight, Workers’ Compensation, and Government Functions

Health oversight agencies conducting audits, investigations, inspections, licensure actions, or disciplinary proceedings may receive PHI without patient authorization.⁴ A state medical board investigating a physician’s conduct is a common example.

Workers’ compensation is a separate carve-out. Covered entities may disclose PHI to workers’ compensation insurers, state administrators, employers, and others in workers’ comp systems, as authorized by and to the extent necessary to comply with workers’ compensation laws.⁸ “To the extent necessary” is the operative phrase; a full medical history should not go out when only records tied to the workplace injury are relevant.

PHI may also be disclosed without authorization for military and veterans’ activities, national security and intelligence purposes, and to correctional institutions regarding inmates when necessary for the health and safety of the inmate or others.⁴

Decedents and Research

PHI about a deceased person may be disclosed to coroners, medical examiners, and funeral directors for identification, determining cause of death, and carrying out their duties. Covered entities may also share a decedent’s PHI with organ procurement organizations to facilitate organ, eye, or tissue donation. A deceased person’s health information remains protected as PHI for 50 years after the date of death, and after that period it is no longer PHI at all.⁹

Research is another authorization-optional category. PHI may be disclosed for research without individual authorization when an Institutional Review Board (IRB) or a Privacy Board has granted a waiver of the authorization requirement.¹⁰ The board must determine that the research couldn’t practicably be done without the waiver and that the privacy risks to individuals are minimal given the protections built into the research plan. The waiver mechanism exists because requiring individual consent for large population studies or retrospective chart reviews would often make the research impossible.

Limits That Still Apply

Even when a disclosure falls squarely within one of the categories above, the Privacy Rule generally limits what may be shared to the minimum amount of PHI necessary to accomplish the purpose.¹¹ A workers’ compensation insurer asking about a knee injury doesn’t get psychiatric records. A public health authority tracking flu cases doesn’t need Social Security numbers. Covered entities must maintain internal policies identifying which employees need access to which categories of information, and non-routine requests must be evaluated individually against reasonable criteria.

The minimum necessary standard is waived in five situations:

Disclosures to another provider for treatment, where the full clinical picture matters.
Disclosures to the individual, who is entitled to complete records.
Disclosures the patient has authorized in writing, where the authorization itself sets the scope.
Disclosures to HHS for compliance and enforcement.
Disclosures required by other law, where the statute’s own scope controls.¹²

How to See Where Your PHI Has Gone

If you want to know where your information has been sent, you have the right to request an accounting of disclosures covering the six years before your request.¹³ The accounting captures most of the categories described above, including public health reporting, law enforcement disclosures, health oversight activities, and research conducted under an IRB waiver.

Some disclosures are excluded from the accounting. The covered entity doesn’t have to list disclosures made for treatment, payment, or healthcare operations; disclosures you authorized in writing; disclosures for the facility directory or to persons involved in your care; and disclosures for national security or certain law enforcement purposes involving inmates.¹³ The practical effect: the accounting mostly surfaces the disclosures you probably didn’t know about, which is the point.

1
eCFR. 45 CFR 164.506 – Uses and Disclosures to Carry Out Treatment, Payment, or Health Care Operations
2
HHS.gov. Summary of the HIPAA Privacy Rule
3
U.S. Department of Health & Human Services (HHS). Individuals’ Right Under HIPAA to Access Their Health Information
4
eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
5
eCFR. 45 CFR 164.510 – Uses and Disclosures Requiring an Opportunity for the Individual to Agree or to Object
6
HHS.gov. Judicial and Administrative Proceedings
7
eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
8
HHS.gov. Disclosures for Workers’ Compensation Purposes
9
HHS.gov. Health Information of Deceased Individuals
10
HHS.gov. Privacy Boards and Institutional Review Boards
11
HHS.gov. Minimum Necessary Requirement
12
eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information General Rules
13
eCFR. 45 CFR 164.528 – Accounting of Disclosures of Protected Health Information