A comprehensive metabolic panel lands in the inbox at 4:40 p.m. on a Tuesday with a high bilirubin flag. Within twenty minutes, the ordering clinician has placed a referral to gastroenterology, and your referral coordinator is assembling a packet: the panel, the last two office notes, an imaging report from a hospital across town, and the problem list. That packet leaves your organization tonight. Nobody signs an authorization. Nobody calls you. And if it goes to the wrong fax number, you own the breach.

This post is about that transfer — the permitted-disclosure rules that make it lawful, the four channels it can travel on, the vendors who touch it, and the log entries you should have when someone asks six months later. It is not clinical guidance. The lab value is here only to explain why the records move.

Why a High Bilirubin Result Generates Cross-Organization Records Traffic

Elevated bilirubin is a nonspecific finding. In practice that means the workup often does not stay inside one building: it commonly involves a specialist consult, imaging performed at a facility your practice does not own, and follow-up labs read by a reference laboratory. Three or four organizations end up holding pieces of the same episode.

From a privacy operations standpoint, that is the whole story. Every one of those handoffs is a disclosure of protected health information. Each one has a lawful basis, a transmission channel, a vendor relationship behind it, and a failure mode. Your job is not to evaluate the lab value. Your job is to make sure the packet arrives at the right specialist, complete, on a channel you can defend.

Volume matters here too. A mid-size primary care practice may generate dozens of these outbound referral packets a week across all conditions. The controls you build for a high bilirubin referral are the same controls that carry every other referral you send.

Do You Need a Signed Authorization to Send Records to a Specialist?

No. Under 45 CFR 164.506(c)(2), a covered entity may disclose protected health information to another health care provider for that provider's treatment activities without patient authorization. A referral packet sent to a gastroenterologist for the treatment of a patient with a high bilirubin result is a treatment disclosure. No authorization form is required, and the minimum necessary standard does not apply to disclosures to a provider for treatment.

Three qualifiers your staff must know:

  • State law can be stricter. Several states impose consent requirements on specific data categories regardless of HIPAA's treatment exception. Know which categories your state protects.
  • 42 CFR Part 2 records follow their own rules. If your chart contains records you received from a federally assisted substance use disorder program, those records carry Part 2 restrictions with them. The 2024 Part 2 final rule, whose compliance date arrived in February 2026, allows a single patient consent to cover treatment, payment, and operations — but consent is still the mechanism, not the treatment exception.
  • Minimum necessary not applying is not permission to dump the chart. Sending 400 pages when the specialist needs 12 is a workflow defect, not a legal one, but it buries clinically relevant material and increases the blast radius if the transmission goes astray.

HHS publishes plain-language guidance on permitted uses and disclosures for care coordination and treatment. Print it. Put it in the referral coordinator's binder. Ninety percent of the "can we send this?" questions that reach your desk are answered on that page.

What About Sending Records the Other Direction?

The gastroenterology practice returning a consult note to you is making the same category of disclosure, on the same basis. If a specialist's office insists on a signed authorization before returning a consult note, that is their internal policy, not a HIPAA requirement — and depending on the circumstances, refusing to share records for treatment can raise information blocking exposure under the 21st Century Cures Act rules. Escalate those to your privacy officer rather than letting the coordinator chase signatures for two weeks.

The Four Channels a High Bilirubin Referral Packet Travels On

Every outbound packet uses one of four transport methods. Each has a distinct control set. Map yours before you need to.

1. Fax

Still the default in most referral workflows, and still the leading source of small-scale disclosure incidents in ambulatory practices. Misdirected faxes happen when a coordinator types a number by hand at the end of a shift.

Controls that actually work: preloaded destination entries for your top 30 referral partners, no manual keying for those destinations, a cover sheet with a callback number, retention of the transmission confirmation attached to the referral order, and a quarterly re-verification of stored fax numbers against the receiving offices. If you use a cloud fax service, that vendor is a business associate.

2. Direct Secure Messaging

Provider-to-provider messaging through a Health Information Service Provider. Cleanest audit trail of the four. The HISP handling your PHI is a business associate and needs a signed agreement. Confirm that your directory entries for referral partners are current — messages bounced to a decommissioned Direct address are a delivery failure your coordinator may not notice for days.

3. Health Information Exchange or Network Query

Regional HIEs and national frameworks let the receiving specialist pull records rather than wait for you to push them. ONC's overview of health information exchange is a reasonable orientation for staff. Your obligations here live in the participation agreement: what you contribute, what you may query, how patient opt-out is honored, and how you respond when the exchange reports a suspected misuse of your data by another participant.

Assign one person ownership of that participation agreement. In most practices, nobody has read it since the day it was signed.

4. Patient-Mediated Transfer

The patient requests their own records and carries or forwards them. This is a right of access request, not a treatment disclosure, and it runs on a different clock — 30 days, with one 30-day extension available if you notify the patient in writing of the reason and the new date. HHS maintains detailed guidance on the individual right of access, including fee limits. Note that the 2020 Ciox decision narrowed the fee cap's application to patient-directed transmissions to third parties; get your fee schedule reviewed rather than assuming the flat-fee option covers every scenario.

Which Vendors in This Workflow Need a Business Associate Agreement

Walk the packet from creation to delivery and name every entity that touches it:

  • Your EHR or practice management host — BAA required
  • Cloud fax provider — BAA required
  • HISP for Direct messaging — BAA required
  • Release of information vendor handling records requests — BAA required
  • Referral management or e-referral platform — BAA required
  • Transcription service producing the note in the packet — BAA required
  • Document shredding vendor for the printed copy — BAA required
  • The receiving gastroenterology practice — no BAA; it is a covered entity receiving PHI for its own treatment purposes
  • An HIE acting as an organized health care arrangement participant — depends on structure; read the participation agreement

That last distinction trips people up constantly. Front desk staff sometimes ask referral partners to sign BAAs, which delays care and signals to the partner that your compliance program is confused. Provider-to-provider treatment disclosures do not require one. If you need to paper a genuine business associate relationship quickly, a six-step BAA generator that exports a signature-ready agreement beats retyping a decade-old template with the wrong entity name in three places.

A Worked Referral Workflow, Role by Role

Here is the sequence for a single high bilirubin referral, with owners named. Adapt the titles to your org chart.

  1. Ordering clinician places the referral order and specifies the clinical documents to include. Not "send everything." A named list.
  2. Referral coordinator assembles the packet from the named list, checks for Part 2 or state-protected content, and selects the transport channel based on the receiving practice's directory entry.
  3. Referral coordinator transmits, then attaches the confirmation — fax receipt, Direct message ID, or HIE transaction ID — to the referral order in the EHR.
  4. Front desk documents the patient notification: who they were referred to, and that records were sent.
  5. Referral coordinator runs a pending-referrals report at day 7 and day 21. Unacknowledged referrals get a phone call, not another fax.
  6. HIM or privacy officer reviews misdirected-transmission reports monthly and reconciles them against the incident log.
  7. Privacy officer conducts an annual walkthrough of the entire path, including a live test send to two referral partners.

If you cannot name a person for each of those seven steps today, that gap is your finding. It also belongs in your risk analysis, which under the Security Rule must be an ongoing, documented assessment of risks to electronic PHI — including PHI in motion between organizations. Practices that need to get that documentation built without a six-month consulting engagement can use automated HIPAA risk analysis and policy generation to produce the assessment, the transmission security policy, and the supporting document set as one coherent package rather than a folder of mismatched PDFs.

What You Log, Even Though You Don't Have To

Treatment disclosures are excluded from the accounting of disclosures requirement under 45 CFR 164.528. You do not owe a patient a six-year list of every specialist who received their chart for treatment.

Log it anyway. Three reasons:

  • Complaint defense. When a patient tells OCR their records were sent somewhere they never authorized, the transmission ID and the referral order tie the disclosure to a treatment purpose in about ninety seconds.
  • Breach scoping. If a receiving practice suffers a breach, you need to know which of your patients' records were in their possession.
  • Care coordination. Referral loops that close are a quality metric in most value-based contracts. The same log serves both functions.

Keep the field set minimal: date, patient ID, recipient organization, documents included, channel, transmission confirmation, and the staff member who sent it. Seven fields. Any more and the coordinator stops filling it in.

Three Failure Modes Worth Auditing This Quarter

Stale destination data. A referral partner moves offices, keeps the old fax line for three months, then releases the number. Your stored entry still points at it. Re-verify quarterly.

Over-inclusive packets. Coordinators default to the full chart because it is one click. Every extra page is extra exposure and extra work for the receiving clinician. Build document templates per specialty.

Unmonitored inbound channels. The consult note comes back on a fax line that only one person checks, and she is on vacation. Records sitting unread in a shared inbox are still records you hold, and still records subject to an access request.

Pull ten completed high bilirubin referrals from the last quarter and trace each one end to end. You will find at least one of these three. Most practices find all three.

Start With the Path, Not the Policy

The mistake is writing a records-disclosure policy first and mapping the workflow later. Do it the other way. Trace one real referral, name every system and vendor it touches, confirm the BAAs, then write the policy that describes what you actually do.

If your risk analysis, transmission security policy, and vendor documentation are older than your current referral workflow — and for most practices they are — generate a current, documented compliance set and use this quarter's referral audit as the evidence that supports it. That is a defensible file, and it takes days rather than quarters.