Professional Role · Topic 7 of 21

Confidentiality & HIPAA

Professional role · privacy law

Confidentiality & HIPAA

HIPAA lets clinicians share PHI for treatment, payment and operations, limits other uses to the minimum necessary, and requires breach notice within 60 days.

Key numbers

Breach notice within 60 days≤ 60 days

Answer record requests within 30 days30 days (+30 once)

01 · The ruleNo authorization needed for treatment, payment, operations

A covered entity may use and disclose protected health information (PHI) without the patient's authorization for treatment, payment and health care operations (TPO); HIPAA does not block clinicians sharing what treatment requires.

02 · The ruleMinimum necessary — except provider-to-provider treatment

Use, disclose and request only the minimum necessary PHI; the rule does not apply to disclosures to a provider for treatment, to the patient or representative, under an authorization, or when required by law.

03 · The ruleBreach notice within 60 days

Notify patients of a breach of unsecured PHI promptly, at most 60 days after discovery; breaches of 500 or more also go to HHS within 60 days, and to media if over 500 in a state.

The rules

Know these

Psychotherapy notes need the patient's specific authorization must knowPsychotherapy notes — a mental health professional's separately kept notes analyzing counseling sessions — need the patient's authorization for most uses, even treatment by others, and are excluded from the patient's right of access.

Mandatory reports need no patient authorization must knowDisclosures required by law — reportable infections (e.g., HIV, syphilis, TB) to public health, child abuse and, in many states, elder or adult abuse to protective services — are permitted without the patient's authorization.

Share with involved family unless patient objectsUnless the patient objects when given the chance, share with family or friends what their role in care or payment requires; if the patient is incapacitated or in an emergency, use best-interest judgment.

Treat the personal representative as the patientA personal representative — guardian, health care agent or surrogate authorized by state law — has the patient's rights to information, unless there is reasonable concern the representative is abusing or neglecting the patient.

Serious imminent threat permits disclosurePHI may be disclosed without authorization when believed necessary to prevent or lessen a serious and imminent threat to a person or the public, to someone able to prevent it, including the target.

Written authorization for uses outside careUses outside treatment, payment, operations or another permitted purpose — e.g., records for a life insurer, employer or bank, or marketing — need written authorization; treatment generally cannot be conditioned on signing it.

Answer record requests within 30 daysPatients may inspect and copy their records: act on the request within 30 days, with one 30-day extension if the delay is explained in writing, charging only a reasonable cost-based fee.

Incidental disclosures are allowed with safeguardsAn incidental disclosure during an otherwise permitted use — a visitor overhearing a clinicians' conversation or glimpsing a nursing-station whiteboard — is not a violation if reasonable safeguards and minimum-necessary policies are in place.

Stricter state privacy laws still applyHIPAA preempts contrary state law, but state laws that give greater privacy protection, or that require reporting of disease, injury, abuse, birth or death, still apply.

What it is

Core idea

Improper disclosure is presumed a breachAn impermissible use or disclosure is presumed a breach unless a risk assessment shows low probability of compromise; PHI encrypted or destroyed per HHS guidance is 'secured', and its loss needs no notification.

More detail

Reference

Show 8 reference facts

Covered entities are health plans, clearinghouses and providers who transmit health information electronically in standard transactions; contractors handling PHI are business associates bound by a business associate agreement.

Law enforcement may receive PHI only in specified circumstances — e.g., a court order, warrant or subpoena, locating a suspect or missing person, a crime on the premises, or a death suspected to be criminal.

The Office for Civil Rights enforces HIPAA with civil money penalties; patients cannot sue under HIPAA itself, and wrongful disclosure for gain or malice can bring up to $250,000 and 10 years in prison.

A patient may request restrictions on uses or disclosures of PHI; the covered entity need not agree, but once it agrees it must honor the restriction except when the information is needed for emergency treatment.

Breaches affecting fewer than 500 people may be reported to HHS annually, within 60 days after the end of the calendar year; business associates must notify the covered entity within 60 days of discovery.

PHI may go to coroners or medical examiners, funeral directors and organ procurement organizations without authorization; properly de-identified data carry no HIPAA restriction.

Providers must give patients a notice of privacy practices; patients may complain to the provider, the institution's privacy officer or HHS's Office for Civil Rights, and retaliation for complaining is prohibited.

De-identify data by expert determination or Safe Harbor removal of 18 identifiers, including names, geography smaller than a state, date elements except year, ages over 89, contact numbers, SSN, record numbers and face photos.

Pearl

Treatment talk flows freely between clinicians; nearly everything else is minimum necessary, required by law, or needs the patient's signature.

Sources · HHS Office for Civil Rights — Summary of the HIPAA Privacy Rule · HHS Office for Civil Rights — Breach Notification Rule (45 CFR §§ 164.400–414) · Merck Manual Professional — Confidentiality and HIPAA (Pope, Aug 2025) · 45 CFR § 164.524 — Access of individuals to protected health information (Cornell LII) · HHS Office for Civil Rights — Incidental Uses and Disclosures (guidance) · HHS Office for Civil Rights — Guidance Regarding Methods for De-identification of PHI (Expert Determination and Safe Harbor) · Starter sheet built from the verified AGACNP fact map (facts reviewed 2026-10-15).