Regulatory Compliance, Privacy, and Consent
The compliance frame
Patient access operates inside HIPAA, EMTALA, the Medicare Conditions of Participation, the No Surprises Act, 42 CFR Part 2 for substance use disorder records, and state law. Two rules of thumb frame nearly every item: HIPAA sets a floor, not a ceiling, so stricter state law controls; and disclosures permitted for treatment, payment, and operations still require the minimum necessary, except that treatment disclosures are generally exempt from that standard.
Consent and authorization
- Consent to treat is a clinical and state-law document; authorization to release information is a HIPAA document. They are not interchangeable.
- A valid HIPAA authorization identifies the patient, the recipient, the specific information, the purpose, an expiration, and the patient's signature, plus statements about the right to revoke and re-disclosure. Open-ended language covering all records forever to anyone fails.
- Special protections apply to psychotherapy notes, substance use disorder records, HIV and behavioral health information under state law, and minors, whose consent rules vary by state.
- EMTALA: a hospital with an emergency department must provide a medical screening exam regardless of insurance or ability to pay, and registration may not delay it.
Traps in questions
A common distractor is sharing information because the caller is family. Family members receive nothing without patient permission or a documented exception such as an emergency involving the patient's care. Another trap assumes a signed financial consent permits release of records. Watch also for items implying HIPAA allows selling data or posting clinical details without authorization.
Worked example
A spouse calls asking for biopsy results. Correct sequence: confirm whether the patient has authorized disclosure to that person, or that the patient is present and does not object. Absent that, decline, offer to take a message, explain that the patient can sign an authorization, and document the call. Do not confirm diagnosis, presence, or even patient status beyond what the caller already knows and is permitted.