It's 6:40 p.m. on a Saturday. A patient walks into your urgent care with a sore throat, gets a rapid test, and walks out twelve minutes later with a prescription. By Monday morning, that twelve-minute encounter has produced disclosures to at least four separate organizations: a reference lab, a retail pharmacy, the patient's primary care office, and your clearinghouse. If the patient asks for a work note, a fifth. The clinical event — an antibiotic for strep throat — is unremarkable. The records movement around it is where your practice gets audited.

This post is for the person who owns that movement: the practice administrator, privacy officer, or office manager who has to explain, six months later, why a chart went where it went. No clinical guidance here. Just the disclosure map, the role assignments, and the documentation that makes each handoff defensible.

The Four Handoffs Hiding in a Twelve-Minute Visit

Walk the encounter as a records flow, not a clinical one. Each arrow is a disclosure, and each disclosure has a legal basis you should be able to name on demand.

  • Clinic to lab. A specimen and identifiers go out; a result comes back. Depending on the arrangement, the lab is a separate covered entity, not your business associate.
  • Clinic to pharmacy. An e-prescription transmits patient identifiers, the medication, and often diagnosis context through an intermediary network.
  • Clinic to primary care. A visit summary goes to the patient's regular physician for continuity — usually by direct secure messaging, portal, fax, or an HIE query.
  • Clinic to payer. Claims and any attached documentation flow through your clearinghouse, which is a business associate.

Add a fifth arrow for the school or employer note, which is the one that breaks most workflows. And a sixth if the patient later requests their own chart. Six paths, three different legal bases, and one shared audit log obligation.

Why an Antibiotic for Strep Throat Visit Needs No Authorization to Reach the PCP

Here is the short answer your front desk keeps asking for.

Can you send records to another provider without a signed authorization? Yes. Under 45 CFR 164.506(c)(2), a covered entity may disclose protected health information to another covered entity or health care provider for that provider's treatment activities without patient authorization. A visit summary documenting an antibiotic for strep throat encounter, sent to the patient's primary care physician for follow-up, is a textbook treatment disclosure. No authorization form. No signature. No delay.

Two additional points your staff should internalize. First, the minimum necessary standard does not apply to disclosures to a health care provider for treatment purposes. If the receiving physician asks for the full record, you may send the full record. Second, HHS has published plain-language guidance on permitted uses and disclosures that you can print and hand to a skeptical staff member who has spent years believing every outbound record needs a form.

What "Permitted" Does Not Mean

Permitted is not the same as unlogged, unverified, or unencrypted. You still owe three things on every treatment disclosure:

  1. Recipient verification. Confirm the receiving provider's identity and address before transmitting. A fax number typo is the single most common records incident in small practices.
  2. Transmission security. Encrypted channel or documented risk-based alternative under the Security Rule's addressable specifications.
  3. A record of the disclosure. Not required in the accounting of disclosures for treatment purposes, but required for your own incident reconstruction. If you can't prove where a chart went, you can't prove it went to the right place.

The Pharmacy Hop: E-Prescribing Networks and Your BAA List

The prescription leaves your system, crosses a routing network, and lands in a pharmacy queue. Ask yourself which of those parties you have a signed agreement with, and whether you need one at all.

The pharmacy is a covered entity receiving PHI for treatment. No BAA. The e-prescribing network is trickier: if it merely transmits and does not access PHI beyond what routing requires, some vendors assert conduit status. Most do not qualify — the conduit exception is narrow, covering entities like the postal service and telecom carriers that transport without persistent access. If your intermediary stores, formats, deduplicates, or analyzes messages, treat it as a business associate and get the agreement.

Practical instruction for your privacy officer: pull the vendor list this quarter and force a yes-or-no answer on every entity in the prescribing path. If a vendor claims conduit status, get that claim in writing on their letterhead and file it with your risk analysis documentation. "They said they didn't need one" is not a defense. If you need to close gaps quickly, a signature-ready business associate agreement generated through a guided wizard beats waiting three weeks for someone's legal department to return a redline.

The Lab Relationship Is Usually Not a BAA Relationship

Reference labs performing testing are covered entities in their own right. The specimen and identifiers you send are a treatment disclosure; the result they return is a treatment disclosure back to you. No BAA required for the testing itself.

But check the edges. If that same lab provides your courier scheduling portal, hosts a results interface, or offers a population analytics dashboard, those service functions may create business associate obligations layered on top of the covered-entity relationship. One vendor, two hats. Document which hat applies to which data flow.

The School and Employer Note: Where the Workflow Actually Fails

A parent asks the front desk to fax a return-to-school note. Staff, having just been trained that provider-to-provider sharing needs no form, fax it.

Wrong. A school is not a health care provider engaged in treatment. Neither is an employer. Disclosure to either requires a valid HIPAA authorization under 45 CFR 164.508 — unless the patient themselves is receiving the document and choosing to hand it over, which is the cleanest path and the one your SOP should default to.

Write the default into your workflow: notes go to the patient or the patient's personal representative, in hand or through the portal. Your practice does not transmit to third-party recipients without a completed, dated, specifically-scoped authorization naming the recipient. This single rule eliminates the most common category of small-practice complaint traffic.

Minors and Personal Representatives

Pediatric sore-throat visits generate representative questions constantly. The general HIPAA rule is that a parent is the personal representative of an unemancipated minor and has access to the record — but state law controls where it grants a minor the right to consent to specific care, or where a court has intervened. Your registration workflow should capture the relationship at check-in, not at the release-of-information desk three weeks later.

Assign this to a named person. Front desk collects and scans the relationship documentation; the privacy officer maintains a one-page state-law summary for the jurisdictions you operate in and reviews it annually.

The Request That Comes Back: 30 Days and Information Blocking

Two weeks after the visit, the patient emails asking for the full record. Two clocks start.

The HIPAA right of access clock gives you 30 calendar days, with one 30-day extension available if you notify the patient in writing of the reason and the new date. Fees must be reasonable and cost-based. Records go in the form and format requested if you can readily produce them — including by unencrypted email, if the patient asks for it after you've explained the risk.

The second clock is faster and less forgiving. Under the information blocking regulations, delaying or conditioning access to electronic health information without a qualifying exception can expose providers to disincentives and developers or networks to civil monetary penalties. "We only release records on Wednesdays" is not an exception. Neither is "our release-of-information vendor takes two weeks."

Audit your actual turnaround time. Pull twenty requests from the last quarter, measure days from receipt to fulfillment, and see whether your written policy matches reality. If it doesn't, fix the process before someone else measures it for you.

A Referral Packet SOP You Can Deploy This Month

Here is the workflow, with owners and timing. Adapt the names to your org chart.

At Check-In (Front Desk, Same Visit)

  • Capture the patient's primary care physician name, practice, and preferred transmission method.
  • Capture relationship documentation for minors and representatives.
  • Provide the Notice of Privacy Practices and log acknowledgment.

At Discharge (Clinical Staff, Same Visit)

  • Generate the visit summary. Note that the summary documenting an antibiotic for strep throat encounter typically includes the test performed, the result, and the prescription — all of which the receiving provider needs.
  • Hand the patient any school or work documentation directly.

Within 24 Hours (Records Coordinator)

  • Transmit the summary to the PCP through the designated secure channel.
  • Verify successful delivery. Log the recipient, timestamp, channel, and confirmation.
  • Route failures to a same-day exception queue. Failed faxes and bounced direct messages are where continuity quietly dies.

Weekly (Privacy Officer)

  • Review the exception queue and the disclosure log.
  • Spot-check five transmissions for correct recipient and appropriate scope.
  • Escalate any misdirected disclosure to the breach risk assessment process immediately — the four-factor assessment, not a hallway conversation.

Where This Connects to Your Risk Analysis

Every path above is a data flow, and the Security Rule requires an accurate and thorough assessment of risks to electronic PHI across all of them. Most practices document the EHR and stop. The lab interface, the e-prescribing intermediary, the fax server, the release-of-information portal, and the clearinghouse connection all carry PHI, and all belong in the analysis.

If your current risk analysis is a spreadsheet someone built in 2022 and nobody has touched since, that gap is visible from the outside. Tools that generate the risk analysis, policy set, and supporting compliance documentation for a healthcare organization get you to a current, defensible baseline faster than starting from a blank template — and they force the vendor inventory conversation you've been deferring.

For the underlying framework, NIST's implementation guidance for the Security Rule remains the reference most auditors recognize, and HHS's own Security Rule guidance library is free and specific.

Start With One Encounter Type

Don't try to map every workflow in the practice at once. Take the highest-volume encounter you have — for many urgent care and pediatric offices, the sore-throat visit that ends with an antibiotic for strep throat qualifies — and trace every outbound record path it generates. Name the legal basis for each. Confirm the agreement status of each vendor touched. Then move to the next encounter type.

If that exercise surfaces missing agreements or a stale risk analysis, close those gaps before your next records request arrives. Build the current documentation set, assign the owners named above, and put a calendar reminder on the quarterly review. The workflow only protects you if it's written down and someone is accountable for running it.