Skip to main content


U.S. flag
      An official website of the United States government
              Here’s how you know
        Here’s how you knowDot gov**Official websites use .gov**
                 A **.gov** website belongs to an official government organization in the United States.
                  HTTPS**Secure .gov websites use HTTPS**
                 A **lock** (A locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. 
  Menu Close
          Enter the terms you wish to search for.
    Search
        








  
  
    

  
      

                                      About HHS
    
                        
                              
      
      
      Programs & Services
    
                        
                              
      
      
      Grants & Contracts
    
                        
                              
      
      
      Laws & Regulations                  
Health Information Privacy
  HIPAA for Individuals
    
                        
                                            
      
      
      Filing a Complaint
    
                        
                                            
      
      
      HIPAA for Professionals
    
                        
                                            
      
      
      Newsroom

              

    



Breadcrumb
    HHS
                              HIPAA Home
                              For Professionals
                              FAQ
                              Treatment, Payment, and Health Care Operations Disclosures


    

    

    Navigate to:
  Authorizations (30)
          Business Associates (41)
          Compliance Dates (2)
          Covered Entities (14)
          Decedents (9)
          Disclosures for Law Enforcement Purposes (5)
          Disclosures for Rule Enforcement (1)
          Disclosures in Emergency Situations (2)
          Disclosures Required by Law (6)
          Disclosures to Family and Friends (28)
          Disposal of Protected Health Information (6)
          Facility Directories (7)
          Family Medical History Information (3)
          FERPA and HIPAA (10)
          Group Health Plans (3)
          Incidental Uses and Disclosures (10)
          Judicial and Administrative Proceedings (8)
          Minimum Necessary (14)
          Notice of Privacy Practice (20)
          Preemption of State Law (10)
          Privacy Rule: General Topics (12)
          Protected Health Information (2)
          Public Health Uses and Disclosures (13)
          Research Uses and Disclosures (20)
          Right to an Accounting of Disclosures (8)
          Right to File a Complaint (1)
          Right to Request a Restriction (4)
          Safeguards (13)
          Security Rule (24)
          Smaller Providers and Businesses (145)
          Student Immunizations (8)
          Transition Provisions (3)
          Treatment, Payment, and Health Care Operations Disclosures (30)
          Workers Compensation Disclosures (5)
          Limited Data Set (6)
          Marketing (17)
          Marketing - Refill Reminders (16)
          Personal Representatives and Minors (12)
          Right to Access and Research (58)
          Mental Health (35)
          Health Information Technology (41)
          Telehealth (11)Text resize icon

                    




Treatment, Payment, and Health Care Operations Disclosures
  
  
  
      203-May specialists provide therapy to patients in a group setting
    Disclosures of protected health information in a group therapy setting are treatment disclosures and, thus, may be made without an individual’s authorization.
Read the full answer
      258-How does the HIPAA Privacy Rule change the laws concerning consent for treatment?
    The Privacy Rule relates to uses and disclosures of protected health information, not to whether a patient consents to the health care itself. As such, the Privacy Rule does not affect informed consent for treatment, which is addressed by State law.
Read the full answer
      259-Can a pharmacist use information to fill a prescription that was telephoned in by a patient's physician
    The pharmacist is using the protected health information for treatment purposes, and the HIPAA Privacy Rule does not require covered entities to obtain an individual’s consent prior to using or disclosing protected health information about him or her for treatment, payment, or health care operations.
Read the full answer
      260-Can health care providers to whom a patient is referred for the first time use protected health information
    Yes. The HIPAA Privacy Rule does not require covered entities to obtain an individual’s consent prior to using or disclosing protected health information about him or her for treatment, payment, or health care operations.
Read the full answer
      261-Are health care providers restricted from consulting with other providers about a patient’s condition without the patient’s written authorization
    Consulting with another health care provider about a patient is within the HIPAA Privacy Rule’s definition of “treatment” and, therefore, is permissible.
Read the full answer
      262-Does the HIPAA Privacy Rule restrict pharmacists from giving advice about over-the-counter medicines to customers
    A pharmacist may provide advice to customers about over-the-counter medicines.
Read the full answer
      263-Can a patient have a friend or family member pick up a prescription for her
    A pharmacist may use professional judgment and experience with common practice to make reasonable inferences of the patient’s best interest in allowing a person, other that the patient, to pick up a prescription.
Read the full answer
      264-What is the difference between consent and authorization under the HIPAA Privacy Rule
    The Privacy Rule permits, but does not require, a covered entity voluntarily to obtain patient consent for uses and disclosures of protected health information for treatment, payment, and health care operations.
Read the full answer
      265-May a health care provider disclose information to a health plan for the plan's HEDIS
    The HIPAA Privacy Rule permits a provider to disclose protected health information to a health plan for the quality-related health care operations of the health plan, provided that the health plan has or had a relationship with the individual who is the subject of the information, and the protected health information requested pertains to the relationship.
Read the full answer
      266-Does HIPAA permit a covered entity or its collection agency to communicate with parties other than the patient
    Yes. The Privacy Rule permits a covered entity, or a business associate acting on behalf of a covered entity (e.g., a collection agency), to disclose protected health information as necessary to obtain payment for health care, and does not limit to whom such a disclosure may be made.
Read the full answer
      267-Does HIPAA prevent reporting to consumer credit reporting agencies or otherwise create any conflict with the FCRA
    No. The Privacy Rule’s definition of “payment” includes disclosures to consumer reporting agencies.
Read the full answer
      268-Does HIPAA prevent health plans and providers from using debt collection agencies
    The Privacy Rule permits covered entities to continue to use the services of debt collection agencies.
Read the full answer
      269-Are location information services of collection agencies permitted under HIPAA
    Permitted Use and Disclosure, Disclosures Required by Law
Read the full answer
      270-Does HIPAA permit an eye doctor to confirm a contact prescription received by a mail-order contact company
    The disclosure of protected health information by an eye doctor to a distributor of contact lenses for the purpose of confirming a contact lens prescription is a treatment disclosure, and is permitted under the Privacy Rule at 45 CFR 164.506.
Read the full answer
      271-Does a physician need a patient's written authorization to send a copy of the patient's medical record
    The HIPAA Privacy Rule permits a health care provider to disclose protected health information about an individual, without the individual’s authorization, to another health care provider for that provider’s treatment of the individual. See 45 CFR 164.506 and the definition of “treatment” at 45 CFR 164.501.
Read the full answer
      272-Is a hospital permitted to contact another hospital or health care facility without the patient's authorization
    The HIPAA Privacy Rule permits a health care provider to disclose protected health information about an individual, without the individual’s authorization, to another health care provider for that provider’s treatment or payment purposes, as well as to another covered entity for certain health care operations of that entity.
Read the full answer
      273-Is an ambulance service permitted to report its treatment to the hospital
    Yes. The HIPAA Privacy Rule permits an ambulance service or other health care provider to disclose protected health information about an individual, without the individual’s authorization, to another health care provider, such as a hospital, for that provider’s treatment of the individual. See 45 CFR 164.506 and the definition of “treatment” at 45 CFR 164.501.
Read the full answer
      274-How does the HIPAA Privacy Rule apply to professional liability insurance
    The Privacy Rule permits a covered health care provider to disclose information for “health care operations” purposes, subject to certain requirements.
Read the full answer
      279-How can I distinguish between activities for treatment or health care operations versus marketing activities
    The overlap among common usages of the terms “treatment,” “healthcare operations,” and “marketing” is unavoidable.
Read the full answer
      455-Does the Privacy Rule permit health plans to disclose protected health information to pharmaceutical manufacturers
    The Privacy Rule permits a health plan to disclose protected health information, such as prescription numbers, to a pharmaceutical manufacturer for purposes of adjudicating claims submitted under a drug rebate contract.
Read the full answer
      456-Does the Privacy Rule permit state Medicaid agencies to disclose protected health information to pharmaceutical manufacturers
    The Privacy Rule permits State Medicaid agencies to disclose protected health information, such as prescription numbers, to pharmaceutical manufacturers and third party data vendors that assist the pharmaceutical manufacturers, for purposes of validating claims submitted under the Medicaid Drug Rebate program.
Read the full answer
      481-Does HIPAA permit health care providers to share information for treatment purposes without authorization
    The Privacy Rule allows those doctors, nurses, hospitals, laboratory technicians, and other health care providers that are covered entities to use or disclose protected health information, such as X-rays, laboratory and pathology reports, diagnoses, and other medical information for treatment purposes without the patient’s authorization.
Read the full answer
      482-Does HIPAA permit a health care provider to share information for treatment purposes by fax, e-mail, or over the phone
    Yes. The Privacy Rule allows covered health care providers to share protected health information for treatment purposes without patient authorization, as long as they use reasonable safeguards when doing so. These treatment communications may occur orally or in writing, by phone, fax, e-mail, or otherwise.
Read the full answer
      490-When may a provider disclose protected health information to a medical device company representative
    In general, and as explained below, the Privacy Rule permits a covered health care provider (covered provider), without the individual’s written authorization, to disclose protected health information to a medical device company representative (medical device company)
Read the full answer
      511-Does HIPAA limit what a doctor can do with a family medical history
    Does the HIPAA Privacy Rule limit what a doctor can do with a family medical history?
Read the full answer
      512-May a provider disclose information about an individual to another provider
    Under the HIPAA Privacy Rule, may a health care provider disclose protected health information about an individual to another provider, when such information is requested for the treatment of a family member of the individual?
Read the full answer
      705-May a covered entity in a legal proceeding use or disclose PHI for the litigation
    Yes. Where a covered entity is a party to a legal proceeding, such as a plaintiff or defendant, the covered entity may use or disclose protected health information for purposes of the litigation as part of its health care operations.
Read the full answer
      760-Must a covered health care provider obtain authorization to use or disclose PHI to an interpreter
    When a covered health care provider uses an interpreter to communicate with an individual, the individual’s authorization is not required when the provider meets the conditions below.
Read the full answer
      1040-May a Medicaid state agency and a Medicare Advantage plan share PHI to identify dually eligible enrollees
    The HIPAA Privacy Rule permits a covered entity to disclose protected health information (PHI) both for its own payment purposes, as well as for the payment purposes of another covered entity that receives the information.
Read the full answer
      May a covered entity collect, use, and disclose criminal justice data under HIPAA
    In specified circumstances, yes.
Read the full answerBack to top
    Contact HHS
    
                        
                                            
      
      
      Careers
    
                        
                                            
      
      
      HHS FAQs
    
                        
                                            
      
      
      Nondiscrimination NoticeHHS Archive
    
                        
                                            
      
      
      Accessibility Statement
    
                        
                                            
      
      
      Privacy Policy
    
                        
                                            
      
      
      Viewers & PlayersBudget/Performance
    
                        
                                            
      
      
      Inspector General
    
                        
                                            
      
      
      Web Site Disclaimers
    
                        
                                            
      
      
      EEO/No Fear ActFOIA
    
                        
                                            
      
      
      The White House
    
                        
                                            
      
      
      USA.gov
    
                        
                                            
      
      
      Vulnerability Disclosure Policy
        Sign Up for Email Updates

Receive the latest updates from the Secretary, Blogs, and News Releases.

Sign Up
  HHS Headquarters
          200 Independence Avenue, S.W.
                  Washington, D.C. 20201
                  Toll Free Call Center: 1-877-696-6775​