Can you share it without an authorization?

Two disclosures are required. Everything else is a permission.

Most people who work in health care carry around a rough version of HIPAA that says patient information is secret unless the patient signs a form. That version is wrong in both directions. It makes staff refuse disclosures the rule plainly allows, such as sending records to the next treating clinician or telling a patient's spouse when to pick them up. And it gives no help at all with the requests that actually carry risk: the officer who wants to know whether someone came in with a stab wound, the attorney whose subpoena arrives with a ten day deadline, the reporter who asks about a patient by name.

The Privacy Rule is built differently. Under 45 CFR 164.502(a)(2), exactly two disclosures are required: to the individual, when they ask for access to their records or for an accounting of disclosures, and to the Secretary of HHS when the Secretary is investigating compliance. Everything else is permitted or prohibited. The permitted list is long. Treatment, payment, and health care operations sit in 164.506. Disclosures to family and friends, and the facility directory, sit in 164.510, which requires that the patient have a chance to agree or object. And twelve categories of public interest disclosure sit in 164.512, which requires neither an authorization nor an opportunity to object, but which attaches conditions to nearly every one.

Two consequences follow, and they are the two things worth teaching anyone who answers a phone. The first is that when HIPAA permits a disclosure, it does not require it. Declining is almost always lawful under HIPAA, though another law, such as a state reporting statute or a court order, may compel you. The second is that a permission is only as good as its conditions. A disclosure made under the right paragraph but without meeting that paragraph's conditions is an impermissible disclosure, and under 45 CFR 164.402 an impermissible disclosure is presumed to be a breach.

The order to ask the questions in

The checker above follows the order a careful privacy officer uses, and it is worth writing into your release of information procedure so that everyone uses the same one.

1. Is the requester the patient, or someone with legal authority to act for the patient? If so, the right of access at 164.524 applies and the disclosure is required, within 30 days, at a limited fee.
2. Is the purpose treatment, payment, or health care operations? If so, 164.506 permits it. Treatment disclosures to another provider are not even subject to minimum necessary.
3. Is this someone involved in the patient's care, and can the patient agree? If so, 164.510(b) governs, and the answer turns on whether the patient is present, able to decide, and not objecting.
4. Which paragraph of 164.512 fits, and are its conditions met? Law enforcement, courts, public health, abuse reporting, oversight, decedents, research, serious threats, specialized government functions, and workers' compensation each have their own.
5. Does the record type change the answer? Psychotherapy notes, substance use disorder program records under 42 CFR part 2, and anything a stricter state law protects can each close a door HIPAA left open.

If no step produces a permission, the answer is the patient's written authorization under 164.508. Then, before anything goes out, three handling rules apply that differ by path: how much you may send, how you verify who is asking, and whether you log the disclosure.

Police at the desk: six doors, each with its own key

Law enforcement is where the gap between what staff assume and what the rule says is widest. 45 CFR 164.512(f) has six numbered paragraphs, and an officer's request has to fit through one of them.

Paragraph (f)(1) covers legal process and reporting laws. You may disclose as required by law, including state statutes that require reporting gunshot wounds and certain other injuries. You may comply with a court order, a court-ordered warrant, or a subpoena or summons issued by a judicial officer, and with a grand jury subpoena. You may comply with an administrative request, such as an administrative subpoena or a civil investigative demand, but only if three conditions are met: the information is relevant and material to a legitimate inquiry, the request is specific and limited in scope as far as practicable, and de-identified information could not reasonably be used. Many agencies now write those three statements into the request.

Paragraph (f)(2) is the one that catches people. When police are trying to identify or locate a suspect, fugitive, material witness, or missing person, you may disclose only a fixed list: name and address, date and place of birth, Social Security number, ABO blood type and Rh factor, type of injury, date and time of treatment, date and time of death, and a description of distinguishing physical characteristics such as height, weight, hair and eye color, scars, and tattoos. Paragraph (f)(2)(ii) expressly excludes DNA and DNA analysis, dental records, and typing, samples, or analysis of body fluids or tissue. Diagnosis is not on the list. Neither is the reason for the visit.

Paragraph (f)(3) covers crime victims. The default is the victim's agreement, which may be oral. If the victim cannot agree because of incapacity or an emergency, you may disclose only if the officer represents that the information is needed to determine whether someone else committed a crime and will not be used against the victim, and that immediate law enforcement activity would be materially and adversely affected by waiting, and you decide in professional judgment that disclosure is in the victim's best interests. Write the representations down with the officer's name.

The last three are narrower. Paragraph (f)(4) lets you alert police to a death you suspect resulted from criminal conduct. Paragraph (f)(5) lets you disclose information you believe in good faith is evidence of a crime on your premises. Paragraph (f)(6) lets a provider giving emergency care away from its own premises, typically EMS at a scene, report the crime, its location and victims, and the perpetrator's identity and location, unless the emergency appears to be abuse or domestic violence, in which case 164.512(c) applies instead.

What none of the six covers is a general question with no paperwork, no reporting law, and none of those situations. A badge proves identity under the verification rule at 164.514(h)(2)(ii); it does not establish authority to receive anything. The response the rule supports is polite and short: we can respond to legal process, or with the patient's authorization. Two other paragraphs sometimes change it. If the officer asks for the patient by name and the patient has not opted out of the facility directory, 164.510(a) lets you confirm the patient is there and give a general condition. And if disclosure is necessary to prevent a serious and imminent threat, 164.512(j) applies on its own terms.

Inmates and people in custody are handled separately, under 164.512(k)(5). A correctional institution or an officer with lawful custody may receive what it represents is necessary for the person's care, the health and safety of the person and others, law enforcement on the premises, or institutional security. That permission ends when the person is released on parole, probation, or supervised release.

A subpoena is not a court order

Requests in civil litigation, divorces, injury claims, and administrative hearings run through 164.512(e), and the distinction it draws is the single most useful thing a records department can know. An order of a court or administrative tribunal lets you disclose the information it expressly authorizes, and no more. A subpoena, discovery request, or other lawful process that is not accompanied by an order does not, on its own, let you disclose anything.

Before responding to a subpoena without an order, you need satisfactory assurance from the party seeking the information. The notice route requires a written statement and documentation showing a good faith attempt to give the patient written notice, that the notice contained enough information about the litigation for the patient to object, and that the time to object has passed with no objection or with objections resolved. The protective order route requires a written statement and documentation that the parties agreed to a qualified protective order and presented it to the court, or that the party seeking the information has asked the court for one. A qualified protective order prohibits use of the information outside the litigation and requires its return or destruction at the end. Under paragraph (e)(1)(vi) you may also make those reasonable efforts yourself.

A subpoena still carries a response date under the court's rules, so the answer to a bare subpoena is a timely written response that you will produce once the HIPAA conditions are met, or a formal objection. Mailing the chart the day the subpoena arrives is one of the most common impermissible disclosures in civil practice. A letter from an attorney, with no subpoena at all, is not lawful process. It needs the patient's authorization, or the patient's own written direction under the right of access.

One exception sits outside paragraph (e). When the patient sues you or files a board complaint, sharing their information with your own counsel to defend the claim is health care operations, because the definition of operations at 164.501 includes conducting or arranging for legal services. That permission covers the defense. It does not cover replying to an online review with clinical details, which OCR has resolved enforcement cases over.

Family and friends: the rule most organizations apply too strictly

Section 164.510(b) lets a covered entity share information with a family member, relative, close friend, or anyone else the patient identifies, limited to what is directly relevant to that person's involvement in the patient's care or payment. How you get there depends on the patient.

If the patient is present and has capacity, you may share if they agree, if you give them a chance to object and they do not, or if you reasonably infer from the circumstances that they do not object. None of that needs to be written, though a note in the chart is good practice. If the patient is not present, is incapacitated, or is in an emergency, you may share relevant information if professional judgment says it is in their best interests, and you may let someone pick up filled prescriptions, medical supplies, X-rays, or similar items. After death, you may share with people who were involved in the patient's care or payment the information relevant to that involvement, unless it conflicts with a preference the patient expressed and you know about.

Two limits keep this from becoming a records release. The first is relevance: the spouse who drives the patient to chemotherapy needs the appointment schedule and the side effects to watch for, not the full history. The second is the line between family and personal representative. Under 164.502(g), a personal representative has legal authority to make health care decisions for the patient or to act for the estate, and is treated as the patient, including for access to the record. A spouse or adult child without that authority is not a personal representative, however involved, unless a state surrogate statute makes them one.

Minors are their own case. A parent is usually the personal representative of an unemancipated minor, but 164.502(g)(3) removes that status for care the minor lawfully consented to alone, care a court authorized, or care the parent agreed to keep confidential. State law then decides whether the parent sees records of that care. Reproductive health, mental health, and substance use treatment are where states most often let minors consent alone, which is exactly where a parent portal can display more than the law allows.

Reports you may already be required to make

Public health is one of the broadest permissions. Paragraph 164.512(b) lets you disclose to a public health authority authorized by law to collect the information for preventing or controlling disease, injury, or disability; to an authority authorized to receive child abuse or neglect reports; to a person subject to FDA jurisdiction for adverse events, product tracking, and recalls; to a person exposed to a communicable disease where a law authorizes the notification; to an employer, for findings from workplace medical surveillance the employer engaged you to perform, with written notice to the employee; and to a school, limited to proof of immunization, where the school is required to have it and a parent or the adult student agrees.

Adult abuse, neglect, and domestic violence reports are stricter, and they are a separate paragraph. Under 164.512(c), you may report to an authorized government agency only if a law requires the report, if the patient agrees, or if a statute expressly authorizes it and you believe it is necessary to prevent serious harm or the patient is incapacitated and the agency makes specific representations. After the report, you must promptly tell the patient, unless that would put them at risk of serious harm or you would be informing a personal representative you believe is the abuser. That duty to inform does not apply to child abuse reports, which go under paragraph (b).

Health oversight disclosures under 164.512(d) reach licensing boards, survey agencies, Medicaid integrity contractors, and inspectors general, for audits, investigations, inspections, and licensure. Oversight does not include investigating the patient personally for something unrelated to their health care or benefits. That is a law enforcement request wearing a different hat, and paragraph (d)(2) says so.

Serious threats and the duty to warn

Paragraph 164.512(j) is built for the moment that cannot wait. You may disclose, consistent with applicable law and ethical standards, if you believe in good faith that it is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, to someone reasonably able to prevent or lessen the threat, including the target. Good faith is presumed when the belief rests on actual knowledge or a credible representation by a person with apparent knowledge or authority. Psychotherapy notes may be disclosed on this path without an authorization.

The same paragraph lets you disclose to law enforcement to identify or apprehend someone who has escaped lawful custody, or who admitted taking part in a violent crime that you reasonably believe caused serious physical harm. That second permission has a deliberate gap: it does not apply if you learned the admission in treatment, counseling, or therapy aimed at the conduct, or through a request for that treatment, and it is limited to the statement and the identifying details on the (f)(2) list. State duty to warn and duty to protect statutes operate alongside all of this and may require a warning HIPAA only permits.

Three rules that change after you find the permission

Finding the right paragraph is half the work. Three handling rules then apply, and they apply differently on each path, which is why the checker reports each one separately.

Minimum necessary. Under 164.502(b), you must make reasonable efforts to limit a disclosure to the minimum necessary for its purpose. The standard does not apply to treatment disclosures to a provider, disclosures to the patient, disclosures under an authorization, disclosures to HHS, disclosures required by law under 164.512(a), or disclosures required for compliance with the rules. For disclosures to public officials under 164.512, you may rely on the official's representation that the request is the minimum necessary, if reliance is reasonable. The minimum necessary guide covers the policy side.

Verification. Under 164.514(h), before any permitted disclosure you must verify the identity and authority of a requester you do not know, and obtain any documentation the permission requires. For public officials you may rely on a badge or credentials in person, government letterhead in writing, and a written statement of legal authority, or an oral one where writing is impracticable. A warrant, subpoena, or order is presumed to be legal authority. Where you act on professional judgment under 164.510 or a good faith belief under 164.512(j), that judgment satisfies verification.

The accounting of disclosures. Under 164.528, a patient may ask for an accounting of disclosures made in the past six years, and you have 60 days to provide it. The exceptions are specific: treatment, payment, and operations; disclosures to the patient; incidental disclosures; disclosures under an authorization; directory and family disclosures under 164.510; national security; custody disclosures under 164.512(k)(5); and limited data sets. Almost everything else on this page is accountable, including police disclosures under 164.512(f), court-ordered disclosures, public health reports, oversight disclosures, and research disclosures under a waiver. The most common error is assuming every law enforcement disclosure is excluded. Only custody disclosures are.

When the record type changes everything

Psychotherapy notes are defined narrowly at 164.501: notes by a mental health professional documenting or analyzing a counseling session, kept separate from the rest of the medical record, excluding medication, session times, test results, diagnosis, and treatment plan summaries. When notes meet that definition, 164.508(a)(2) requires an authorization for nearly every use and disclosure. The exceptions are use by the originator for treatment, supervised training programs, defense of a legal action the patient brought, HHS, disclosures required by law, oversight of the originator, coroners and medical examiners, and a serious and imminent threat. An authorization for psychotherapy notes may be combined only with another psychotherapy notes authorization. The right of access excludes them too, though many states grant broader access to mental health records.

Records from a federally assisted substance use disorder program are governed by 42 CFR part 2, which permits far fewer disclosures than HIPAA. The 2024 final rule aligned part 2 more closely with HIPAA, including a single consent for future treatment, payment, and operations disclosures, but it kept the core protection: part 2 records may not be used to investigate or prosecute a patient, or in proceedings against the patient, without consent or a court order issued under subpart E after a good cause finding, and a subpoena alone never authorizes disclosure. The narrow part 2 carve-outs, such as medical emergencies, research, audit and evaluation, child abuse reporting, and crimes on program premises, each have their own conditions.

State law is the third layer. Under 45 CFR 160.203(b), a state law that is more stringent than HIPAA, meaning more protective of privacy or more generous with patient access, is not preempted and controls. HIV and sexually transmitted infection results, mental health records, genetic test results, and minors' records are the usual examples. On reproductive health care, the printed CFR still contains the 164.509 attestation added in 2024, but the U.S. District Court for the Northern District of Texas vacated most of that rule in Purl v. HHS on June 18, 2025, and the appeal was dismissed on September 10, 2025. The attestation is not in effect. The ordinary permissions apply as written, and several states have their own, stricter reproductive health privacy laws.

What training has to cover, and what it does not prove

Every result in the checker describes a decision made by a person, usually at a desk or a bedside, usually in less than a minute. That is why the Privacy Rule makes training a standard rather than a suggestion: 45 CFR 164.530(b)(1) requires training on your policies and procedures for protected health information for every workforce member, as necessary and appropriate for their functions, and 164.530(b)(2) requires you to document it. The Security Rule adds a security awareness program at 164.308(a)(5)(i). Staff who handle release of information need to know the difference between a court order and a subpoena, the (f)(2) list, the family rule, and what to say when they are not sure. That last one matters most: a written escalation path to the privacy officer prevents more impermissible disclosures than any form.

Training proves that named people were taught on a stated date. It does not, by itself, make an organization compliant, and no course, certificate, or tool can certify that. Whether a disclosure was lawful depends on the permission it relied on, whether the conditions were met, what was sent, and how it was recorded. Training is the input that makes the right answer likely. If you are training a front desk, a records team, or a whole practice, individual certification and team training both produce dated, verifiable certificates, and pricing is published.

Sources

Regulation text was checked against the current CFR on November 13, 2026. Links go to the official eCFR. Court and enforcement items are cited to their dates.

• 45 CFR 164.502 , required disclosures, minimum necessary and its exceptions, decedents, and personal representatives.
• 45 CFR 164.506 , treatment, payment, and health care operations.
• 45 CFR 164.508 , authorizations and the psychotherapy notes exceptions.
• 45 CFR 164.510 , the facility directory and disclosures to people involved in care.
• 45 CFR 164.512 , the twelve public interest permissions, including law enforcement at (f) and judicial proceedings at (e).
• 45 CFR 164.514 , minimum necessary reliance, limited data sets, and verification.
• 45 CFR 164.528 , the accounting of disclosures, its exceptions, and temporary suspension.
• 45 CFR 160.203 , preemption and the more stringent state law exception.
• 42 CFR part 2 , confidentiality of substance use disorder patient records, including 2.12, 2.31, and the court order provisions of subpart E.
• Haynes Boone, September 29, 2025 , on the Fifth Circuit's dismissal of the Purl v. HHS appeal and the surviving part 2 notice changes.