A provider may refuse service if a patient refuses to sign a disclosure consent. For non-routine disclosures such as transfer of records to a replacement physician or to the employer in connection with a disability or return to work claim, a participant may give a disclosure authorization . These authorizations are narrower in scope and the person transmitting the record must limit disclosure to only those records necessary for the purposes disclosed. There are certain circumstances when no authority or consent is required. First of all, patients have the right to see their own records, with only a few exceptions.
Patients also have the right to demand amendment of their records if incomplete or inaccurate.
Other instances when consents and authorizations are not required include public health uses in controlling communicable diseases, child abuse, other uses required for law enforcement purposes and certain disclosures of work-related injuries. These disclosures must follow separate prescribed procedures. Plan administrators must prepare and distribute notices to participants describing uses of individually identifiable health information in plan operations. This is basically a privacy policy. The notice must also describe employee rights to review and amend records and to restrict other uses.