Can a patient's medical records be transferred to another medical entity for treatment payment, or healthcare operation purposes without obtaining patient authorization?
Section 164.506 of the HIPAA privacy regulations permits release of information for treatment, payment, or healthcare operation purposes without a specific patient authorization. Consequently the regulation allows a mammography facility to transfer medical records to another covered entity in most situations without a specific patient authorization. The Office of Civil Rights, the DHHS office with primary responsibility for HIPAA implementation, has also stated that, "a covered health care provider may share protected health information with another health care provider for treatment purposes without a business associate contract." Additional information regarding HIPAA requirements can be found on the DHHS Website at http://www.hhs.gov/ocr/hipaa/.