Who can they share the PHI with?

Editorial team Published on

Protected Health Information (PHI) can be disclosed to the individual it belongs to, to healthcare workers for specific purposes, or to outside groups when the patient gives permission or the law allows it.

You can review the official guidelines on the HHS Summary of the HIPAA Privacy Rule for more details.

Disclosures Allowed Without Patient Authorization

  • The Individual: You must give a patient access to their own PHI.
  • Treatment, Payment, and Operations: Doctors, nurses, labs, and insurance companies can share PHI to treat the patient, get paid, and run daily business tasks.
  • Family and Friends (with agreement): You can share information if the patient agrees, or if they object but are not there and you use professional judgment to see if it is in their best interest.
  • Public Health and Safety: You can share data with public health groups to track diseases or stop injuries.
  • Authorities: You can report abuse, neglect, or domestic violence to proper government groups.
  • Law and Courts: You can share information for court orders, subpoenas, or specific law enforcement needs.
  • Averting Threats: You can share data with anyone who can stop a serious and immediate threat to public or personal safety.

Disclosures Requiring Patient Authorization

  • Any sharing outside of treatment, payment, operations, or legal exceptions requires a signed, explicit HIPAA Authorization from the patient.
  • Examples include sharing records with an employer, marketing groups, or family members not involved in care.

Who can authorize sharing of PHI in place of a person?

A person's legal representative (or a healthcare professional exercising professional judgment when a patient is incapacitated) can authorize the sharing of protected health information (PHI) in place of the individual.

⚖️ Legal and Professional Authorization Roles

  • 📌 Legal Representative: Acts as the personal representative under HIPAA Guidelines with explicit state-law authority.
    • Power of attorney
    • Court-appointed guardian
    • Executor of an estate
  • 🩺 Healthcare Professional: Uses professional judgment during emergencies or incapacitation.
    • Determines the patient's best interest
    • Limits sharing to relevant care details
    • Assesses lack of prior objection

Is permission needed to share a patient's PHI with his or her life insurance company?

Yes, written permission or authorization from the patient is required to share protected health information (PHI) with a life insurance company.

Why Permission is Needed

  • Not a Covered Entity: Life insurance companies are not considered "covered entities" (healthcare providers, health plans, or healthcare clearinghouses) under the Health Insurance Portability and Accountability Act (HIPAA).
  • Outside TPO: HIPAA allows providers to share PHI without authorization only for routine treatment, payment, or healthcare operations (TPO). Life insurance underwriting or applications fall outside of these routine exceptions.
  • Written Authorization: Sharing medical records for financial or insurance benefit evaluations requires a signed, specific HIPAA release form or written authorization from the patient.

When can PHI not be disclosed?

Under the HIPAA Privacy Rule, Protected Health Information (PHI) generally cannot be disclosed without the individual's written authorization, except for specific, legally defined exceptions.

When patient consent or an approved legal exception is absent, healthcare providers, health plans, and their business associates are legally required to withhold PHI.

When PHI Cannot Be Disclosed

  • Without Patient Authorization or a Legal Exception: Default rules prohibit sharing identifiable health data for marketing, fundraising, or general inquiries from family members or employers without explicit consent.
  • Beyond the Minimum Necessary Scope: Even when a disclosure is legally permitted (such as for payment or health oversight), entities cannot release entire medical files if only a limited subset of data is required to fulfill the purpose.
  • Detailed Law Enforcement Requests: Without a proper court order, warrant, or specific statutory requirement, sensitive data like DNA, dental records, or bodily fluid/tissue analysis generally cannot be handed over to law enforcement.
  • Unverified Subpoenas: PHI cannot be disclosed in response to a standard legal subpoena unless satisfactory assurances (such as proof that the patient was notified or a protective order was issued) accompany the request.

What cannot be shared under HIPAA?

Under HIPAA, healthcare providers and health plans generally cannot share Protected Health Information (PHI)—any individually identifiable health data linked to a specific person—without the patient's written authorization.

What Cannot Be Shared Without Authorization

  • Medical Records and Lab Results: Clinical notes, test results, diagnoses, and treatment plans.
  • Personal Identifiers Linked to Health Data: Names, addresses, birth dates, Social Security numbers, phone numbers, and biometric data.
  • Billing and Payment Details: Insurance claims, account numbers, and financial records related to care.
  • Psychotherapy Notes: Separate notes taken by a mental health professional that require distinct, strict authorization under the HIPAA Privacy Rule.
  • Marketing Lists: Patient information cannot be sold or used for commercial marketing or fundraising without explicit, opt-in consent.

Key Exceptions (When Information Can Be Shared)

  • Treatment, Payment, and Operations (TPO): Providers can share data for direct patient care, billing, and basic business operations.
  • Public Health and Safety: Disclosures are allowed for mandatory reporting, such as tracking infectious diseases or reporting gunshot wounds to law enforcement.
  • Involved Family and Friends: Information relevant to an individual's care can be shared if the patient agrees, does not object, or is incapacitated and the provider judges it to be in their best interest.

RSA Risks: Selecting PHI which shares a factor with e

9 related questions found

When can PHI be shared without permission?

Protected health information (PHI) can be shared without patient permission for treatment, payment, healthcare operations, and 12 specific national priority public interest purposes under the HIPAA Privacy Rule.

Under U.S. Department of Health and Human Services (HHS) guidelines, healthcare providers do not need written consent to release records in these designated situations:

Everyday Healthcare Operations (TPO)

  • Treatment: Sharing test results, visit notes, or treatment plans with other doctors, specialists, or labs involved in your care.
  • Payment: Submitting claims to health insurance companies or sending unpaid bills to collections.
  • Healthcare Operations: Conducting quality assessments, provider reviews, or business management tasks.

Public Interest and Legal Exceptions

  • Required by Law: Complying with federal, state, or local statutes, regulations, and court orders.
  • Public Health Activities: Reporting disease outbreaks, child abuse, or adverse drug reactions to public health agencies.
  • Health Oversight: Permitting government audits, investigations, or healthcare licensure inspections.
  • Law Enforcement: Responding to warrants, subpoenas, or identifying a fugitive/missing person.
  • Safety Threats: Preventing a serious and imminent threat to public health or an individual's safety.
  • Organ Donation: Assisting organ and tissue procurement organizations.
  • Family Involvement: Sharing limited details with family or friends if the patient is incapacitated or does not object.

What is the new HIPAA rule in 2026?

The main new HIPAA requirement for 2026 is updating privacy notices under the HHS Model Notices of Privacy Practices to include stricter protections for substance use disorder (SUD) patient records.

Key 2026 Privacy Rule Updates

  • February 16, 2026 Deadline: Healthcare providers and health plans had to update their Notice of Privacy Practices (NPP).
  • Substance Use Records: Notices must now explain how substance use disorder records are protected under 42 CFR Part 2.
  • Legal Protections: Patient records generally cannot be used in civil or criminal legal cases without explicit consent or a court order.
  • Patient Rights: Patients gained clearer rights to restrict sharing, opt out of fundraising, and file complaints.

Proposed Security Rule Changes (Under Review)

Regulators are also pushing a major update to the HIPAA Security Rule that changes how organizations handle data safety:

  • No More "Addressable" Rules: Optional security steps are becoming mandatory.
  • Mandatory MFA: Multi-factor authentication is required across all systems.
  • Required Encryption: Patient data must be encrypted both in transit and at rest.

Who can authorize the disclosure of a patient's PHI?

A patient, their legal representative, or an institutional authority in specific legal exemptions can authorize the disclosure of protected health information (PHI) under HIPAA guidelines.

Who Can Authorize Disclosure

  • The Patient: An individual of legal age and sound mind holds the primary right to sign a written authorization for releasing their PHI to third parties (such as life insurers or employers).
  • A Legal Representative: A personal representative, legal guardian, power of attorney for healthcare, or an executor of an estate can authorize disclosure if the patient is a minor, incapacitated, or deceased.
  • Institutional Bodies (Without Patient Authorization): An Institutional Review Board (IRB) or privacy board can waive authorization for research, and covered entities may disclose information under specific public safety or legal mandates.

When Authorization is Not Needed

  • Treatment, Payment, and Operations (TPO): Health care providers can share PHI with other clinicians for treatment without explicit patient authorization.
  • Public Interest Exceptions: Disclosures are permitted without consent for public health reporting, workers' compensation, and addressing an imminent threat to health or safety.

Does a patient have the right to access their own PHI?

Yes, a patient has a clear legal right to access their own Protected Health Information (PHI) under the HIPAA Privacy Rule.

What Patients Can Access

  • Medical and billing records: Includes clinical notes, lab and imaging reports, medication lists, and payment files.
  • Format: Records in both paper and electronic formats (including via smartphone apps).
  • History: Applies to current, archived, or very old records.

Rules and Limits

  • Deadlines: Covered entities generally must provide access within 30 calendar days.
  • Fees: Providers may charge only reasonable, cost-based fees for labor and supplies.
  • Exceptions: Access can be denied in rare cases, such as certain psychotherapy notes or if a provider determines access causes physical harm. Unpaid medical bills are not a valid reason to deny access.

Can a family member violate HIPAA?

An ordinary family member cannot violate HIPAA as a private individual, because the law only applies to healthcare providers, health plans, and healthcare clearinghouses, known as covered entities.

When a Family Member Can Violate HIPAA

  • Healthcare employment: A family member can commit a violation only if they work for a medical facility or health plan and look at a relative's medical records without a valid job-related reason.
  • Misuse of access: Snooping on a family member's chart using employee credentials breaks federal privacy rules, even if they are related to the patient.

When Sharing with Family is Legal

  • Patient consent: Medical staff can share details with relatives if the patient gives verbal permission or does not object when asked.
  • Incapacitated patients: Providers can share relevant facts if the patient cannot speak and the provider uses professional judgment to decide it is in the patient's best interest.
  • Private conversations: If a patient tells a family member their own medical details, HIPAA does not apply to that private discussion.