It's 10:40 on a Tuesday. An ENT office three towns over faxes your front desk a one-page request: send everything you have on a patient your physicians have been managing for persistent nasal symptoms. No signed authorization is attached. Your medical records clerk pauses, because someone told her two years ago that nothing leaves the building without a signature.

She's wrong, and the delay costs the practice a week and a frustrated referral partner. Chronic rhinitis is a good lens for this problem precisely because it is unglamorous: it is a persistent condition often co-managed across primary care, allergy/immunology, and otolaryngology, which means charts move between organizations constantly. This article is about that movement — the permissions, the channels, the logs, and the role assignments — not about the condition itself.

Why a Chronic Rhinitis Referral Generates Three Separate Records Requests

Follow one patient through a typical year. The primary care office refers out. The specialist requests prior visit notes and any outside testing results. Testing gets performed by a third organization, which sends results back to both. The patient then asks for a copy of everything to bring to a new employer's health plan or a second opinion.

That's four organizations and at least three distinct disclosure events, each governed by a different part of the Privacy Rule. Two are provider-to-provider treatment disclosures. One is a patient-directed access request. If your staff treats all three identically — either demanding authorizations for everything or releasing everything to anyone who asks — you have a policy problem, not a paperwork problem.

Multiply that by every chronic condition your practice co-manages and you get the actual volume: for a mid-sized primary care group, hundreds of outbound clinical disclosures per month, most of them handled by staff earning less than the person who will have to explain them later.

Do You Need Patient Authorization to Send Records to a Specialist?

No. Under 45 CFR 164.506, a covered entity may use or disclose protected health information for treatment, payment, and health care operations without the individual's written authorization. Disclosing a patient's chart to another health care provider for that provider's treatment of the same patient is expressly permitted. HHS says so directly in its guidance on permitted uses and disclosures for exchange of health information.

Three caveats your staff needs memorized:

  • You must still verify the identity and authority of the requester under 164.514(h). A fax cover sheet with a clinic logo is not verification.
  • Your Notice of Privacy Practices must describe treatment disclosures — and it does, if you're using a compliant NPP.
  • Stricter state law or specially protected content can override the default. More on that below.

What about a patient who asked you not to share?

Requests for restriction under 164.522 are generally optional for you to accept — with one mandatory exception involving services paid entirely out of pocket, where the restriction applies to disclosures to a health plan, not to another treating provider. If your practice has agreed to a restriction, it has to be flagged in the chart in a way a records clerk will actually see, not buried in a scanned PDF from 2021.

Minimum Necessary Doesn't Apply Here — Scope Discipline Still Does

The minimum necessary standard at 164.502(b)(2)(i) explicitly excludes disclosures to a health care provider for treatment purposes. The receiving clinician decides what's clinically relevant, not your release-of-information clerk. That exclusion exists so that a specialist isn't handed a redacted fragment and forced to practice around the gaps.

Operationally, though, "send the whole chart" is a bad default. A 400-page dump for a chronic rhinitis consult buries the three documents the specialist actually needs, and it enlarges your breach surface if the transmission goes sideways. Build a standard referral packet definition into your policy: problem list, medication list, relevant encounter notes within a defined lookback, prior outside testing, and imaging reports.

Write it down as a workflow standard, not a Privacy Rule requirement. Those are different things, and conflating them is how staff end up refusing legitimate requests because they believe the law requires a signature it doesn't require.

The Six-Step Referral Records Workflow, With Names Attached

A workflow without a named owner is a suggestion. Assign each step to a role, put the role in your policy, and re-verify at annual training.

  1. Intake (front desk or ROI clerk). Log the request in a single tracking system the same day it arrives — fax, portal message, phone, or Direct message. Record requester, date, method, and requested scope.
  2. Verification (ROI clerk). Confirm the requesting organization by an independently sourced phone number or a known Direct address. Not the number printed on the incoming fax.
  3. Purpose classification (ROI clerk, escalate to privacy officer if unclear). Treatment? Payment? Attorney, insurer, employer, or research? Only the first two move without authorization. Anything ambiguous goes up a level.
  4. Content review (records staff, with clinician input on request). Apply the standard packet definition. Screen for embedded content that carries separate consent rules.
  5. Transmission (records staff). Use an approved channel from a written list. See the next section.
  6. Close-out (ROI clerk). Record what was sent, when, by whom, to whom, and by what method. Save the transmission confirmation.

Target turnaround for a treatment disclosure should be measured in business days, not weeks. HIPAA sets no deadline for provider-to-provider disclosures, but your referral partners will notice, and slow records handoffs are the most common reason specialists stop sending patients back.

Where the Handoff Actually Breaks: The Transmission Channel

Permission is rarely the failure point. Transmission is. Review the OCR breach portal for any recent quarter and you'll see the same categories repeating: misdirected transmissions, unauthorized access, and vendor incidents.

Fax and e-fax

Analog fax still moves an enormous share of referral traffic. Its failure mode is the misdial, and the fix is procedural: verified number lists, a confirmation callback for first-time recipients, and a cover sheet with recipient verification. If you use an internet fax service, that vendor is creating, receiving, maintaining, or transmitting PHI on your behalf. It is a business associate and it needs a signed agreement. If your BAA file has a gap there, a six-step business associate agreement generator will get a signature-ready document out the door faster than a redline cycle with a vendor's legal team.

Direct secure messaging and interoperability networks

If your EHR supports Direct messaging or participation in a health information exchange, that's the cleanest path for treatment disclosures — encrypted, addressed, and logged automatically. ONC's interoperability resources are worth handing to whoever manages your EHR configuration. The compliance work here is confirming that the audit trail is retrievable when you need to prove what left the building.

Email

Unencrypted email to another provider is a defensible choice almost never. Unencrypted email to a patient who has been warned of the risk and asked for it anyway is permitted — but document the warning and the request. Those are two completely different rules and staff routinely blur them.

Paper handed to the patient

Still common and still fine. Verify identity, log it, and don't hand a stack to a family member without confirming personal representative status.

When the Patient Asks for the Chart Themselves

This is where practices get penalized. The right of access under 164.524 gives you 30 calendar days from receipt of the request, with one 30-day extension available if you notify the individual in writing of the reason and the new date. Not 30 business days. Not 30 days from when the scanning backlog clears.

Fees are limited to a reasonable, cost-based amount — labor for copying, supplies, postage, and preparing a summary if the individual agreed to one. Search and retrieval time is not chargeable. HHS's right of access guidance is the definitive reference, and OCR's enforcement initiative on this provision has produced dozens of settlements with small and mid-sized practices — the kind of organizations that assumed enforcement only lands on hospital systems.

A patient can also direct you in writing to send their records to a third party. Treat that as an access request with a delivery instruction, not as a disclosure requiring your independent judgment about the recipient.

What You Log and What You Don't

The accounting of disclosures requirement at 164.528 excludes disclosures made for treatment, payment, and health care operations. So a chronic rhinitis referral packet sent to a specialist does not go in the accounting you'd produce if a patient requested one.

Log it anyway. Your internal tracking log serves three purposes the accounting doesn't: it lets you answer "did we ever send that?" during a dispute, it demonstrates that your verification step actually runs, and it becomes the evidence base for a breach risk assessment if a transmission goes to the wrong recipient. Keep the two logs conceptually separate so staff don't accidentally hand a patient a list of every treatment disclosure ever made.

The Overrides: State Law, Minors, and Embedded Sensitive Content

HIPAA is a floor. Several states require written consent for disclosures that HIPAA would permit freely, and some impose specific consent forms with expiration dates. Your privacy officer should maintain a one-page state-law summary for every state where you have patients — not a memory.

Within the chart, watch for content that carries its own rules regardless of the referral purpose. Substance use disorder treatment records from a Part 2 program, certain behavioral health notes, HIV-related information in some states, and psychotherapy notes under 164.508(a)(2) all have separate handling requirements. A rhinitis-related note is unlikely to contain any of that, but a full-chart export absolutely might. That's a second reason the standard packet definition beats the full dump.

Minor patients add a third layer: whether the parent is the personal representative depends on state law and on the type of service. Build the decision into your intake script rather than leaving it to a clerk's judgment at the counter.

Audit Your Referral Path Before Someone Else Does

Take one afternoon and trace a single referral end to end. Pull the request, the verification note, the packet contents, the transmission receipt, and the log entry. If any of those five artifacts doesn't exist, you've found the gap — and it's the same gap an OCR investigator would find after a misdirected fax.

Then check the infrastructure underneath it. Every channel in your approved list should map to a vendor with a current signed BAA, and every one of those systems should appear in your Security Rule risk analysis under 164.308(a)(1)(ii)(A). NIST's SP 800-66r2 implementation guide is the practical reference for scoping that analysis if yours hasn't been refreshed since the last EHR migration.

If the honest answer is that your risk analysis is a spreadsheet someone started in 2022, fix that before you fix anything else — the automated HIPAA risk analysis and policy document platform will produce the full document set, including the policies your referral workflow depends on, in the time it would take to schedule a consultant's kickoff call. Start with the risk analysis, then write the referral policy against what it finds. Doing it in that order means your policy describes systems you actually have.