At 32 weeks, an OB in your practice documents an estimated fetal weight below the tenth percentile and orders a maternal-fetal medicine consult for that same week. Within 72 hours, records connected to that pregnancy and that IUGR baby will move between your practice, an MFM group, a hospital labor and delivery unit, and — depending on how the pregnancy progresses — a NICU and a pediatric office. That is four or five covered entities, at least three EHR instances, a fax line somebody still uses, and a set of business associates that may not appear anywhere on your vendor inventory.

This post is about that administrative machinery, not about the clinical picture. Growth restriction is relevant here only because it reliably triggers cross-organization referral, serial imaging, and a newborn record that spawns fast. If your referral workflow has soft spots, this is the kind of case that finds them.

Why an IUGR Baby Case Puts Four Record Sets in Motion at Once

Most outbound referrals from a primary care or general OB practice are one-directional: you send a packet, the specialist sends back a consult note, done. Growth-restriction referrals are not that. They generate recurring imaging, repeat visits at short intervals, and a delivery plan coordinated across organizations that each maintain their own legal record.

Count the record sets. There is the mother's prenatal chart in your system. There is the MFM group's consult and imaging record. There is the hospital's inpatient record for the delivery admission. There is a separate newborn record that starts at birth. And if the infant goes to a NICU under a neonatology group that bills independently, there may be a professional record distinct from the facility record.

Each of those has its own custodian, its own release-of-information process, and its own answer to the question "who can request this?" Your staff will be asked to feed all of them, sometimes on the same afternoon.

Do You Need an Authorization to Send Records for an IUGR Baby Referral?

No. Under the HIPAA Privacy Rule, a covered entity may disclose protected health information to another covered entity or health care provider for that provider's treatment activities without patient authorization. That permission lives at 45 CFR 164.506(c)(2). Sending prenatal notes, ultrasound reports, and lab results to a maternal-fetal medicine specialist you referred to is a textbook permitted treatment disclosure.

Two more points your front desk should have memorized:

  • The minimum necessary standard does not apply to disclosures to a health care provider for treatment. See 45 CFR 164.502(b)(2)(i). You are not required to whittle the packet down to a handful of pages before the consult.
  • An authorization form is not "safer" as a default. Requiring one where the rule does not, and delaying the referral until it comes back signed, creates its own operational and information-blocking exposure.

HHS publishes a plain-language fact sheet series on this at Permitted Uses and Disclosures. Print the treatment-exchange page and put it in the release-of-information binder, because the objection you will hear from staff is not legal, it is cultural — someone was trained years ago that everything needs a signature.

Where the Simple Answer Stops Applying

Three carve-outs matter in obstetric referrals. Psychotherapy notes require authorization regardless of purpose. Records from a federally assisted substance use disorder program fall under 42 CFR Part 2, and the 2024 final rule aligning Part 2 more closely with HIPAA carried a February 2026 compliance date, so those provisions are live — if your practice hosts or receives such records, treat them on a separate track. And several states impose stricter consent requirements for categories like HIV status or genetic testing results. Your privacy officer should maintain a one-page state overlay, not leave it to whoever is covering the fax queue.

The Mother's Chart and the Newborn's Chart Are Two Different Designated Record Sets

This is the single most common failure point in the workflow. Prenatal documentation about an IUGR baby lives in the mother's record. After delivery, the infant has a record of their own. Staff who mentally treat these as one continuous file will disclose the wrong thing to the wrong requester.

A practical example: a father calls the pediatric office six weeks after delivery and asks for "the growth records from the pregnancy." Some of what he wants is in the infant's chart — birth weight, discharge summary, NICU course. Some of it is the mother's prenatal record, which the pediatric practice may hold as received records but does not own, and which the father has no independent right to under the child's access right.

Personal Representatives and Received Records

Under 45 CFR 164.502(g), a parent is generally the personal representative of an unemancipated minor, with exceptions driven by state law and specific consent situations. For a newborn, that analysis is usually straightforward. What is not straightforward is the mother's information embedded in the infant's chart.

Write the rule down and train to it: records received from another provider about a different patient are not automatically releasable to this patient's representative. Your release-of-information staff should be able to identify, in the child's chart, which documents originate with the mother's care and route those requests back to the originating practice or apply your state's rules. Build a flag in the document-management step so this is a field, not a judgment call at the counter.

The Vendor Layer Nobody Maps Until There's a Breach

Run the same referral again and count the business associates. Ultrasound images move to a cloud archive or a PACS hosted by someone. A teleradiology or remote-overread group may touch the imaging. A transcription service handles the consult dictation. A referral-management platform sits between your EHR and the MFM group. A patient-communication vendor sends appointment reminders for weekly follow-up visits. An answering service takes the after-hours call. A courier or transport service physically moves paper for the hospital.

Every one of those is a business associate if it creates, receives, maintains, or transmits PHI on your behalf. Every one needs a signed agreement on file before the data flows, and every one belongs in your risk analysis under 45 CFR 164.308(a)(1)(ii)(A) — the requirement that has appeared in more OCR resolution agreements than any other single Security Rule provision. HHS proposed a substantial Security Rule overhaul in January 2025 that would tighten documentation expectations further; whatever its final shape, the direction of travel is toward more evidence, not less.

If your vendor inventory is a spreadsheet somebody updated during last year's audit, the referral workflow above will outrun it. Practices that keep this current usually do it by generating the risk analysis and policy set from a system that tracks vendors and safeguards together, so that adding a new imaging archive updates the inventory, the risk register, and the policy references in one pass rather than three. When a new vendor shows up mid-referral and you need paper the same day, a signature-ready business associate agreement is faster than routing a redline to outside counsel and hoping it comes back before the imaging does.

The Access Clock, and Why Referral Volume Makes It Harder

Parents of a NICU infant request records. Frequently. They request them from the hospital, from the neonatology group, from the pediatric office, and from your practice, often in the same week, often for insurance appeals or early-intervention program enrollment.

The right of access at 45 CFR 164.524 gives you 30 days from receipt of the request, with one 30-day extension available if you notify the requester in writing of the reason and the new date. Fees must be reasonable and cost-based. Verbal requests count. A request routed to the wrong staff member still starts the clock. OCR's individuals' right of access guidance remains the operative reference, and the enforcement initiative built around it has produced dozens of settlements — the pattern in nearly all of them is a practice that took months, not a practice that refused outright.

Information Blocking Sits Alongside This, Not Inside It

Separately from HIPAA, the information blocking regulations at 45 CFR Part 171 prohibit practices that unreasonably interfere with access, exchange, or use of electronic health information. "We only release records on Tuesdays" and "we require a notarized form for anything from another practice" are the kinds of policies that draw attention. Review the exceptions — they are specific and they require documentation you actually created at the time, not a rationale you construct afterward. The federal information blocking resources lay out each exception's conditions.

A 72-Hour Referral Timeline With Names Attached

Generic workflows fail because nobody owns a step. Assign roles.

  1. Hour 0 — Ordering provider. Places the referral in the EHR and selects the receiving organization from a maintained list, not free text. Free-text destinations are how packets end up at the wrong practice with the same name.
  2. Hour 2 — Referral coordinator. Verifies the destination's current secure address (Direct address, HIE participation, or verified fax). Verification means checked this quarter, not "it worked last year."
  3. Hour 4 — Referral coordinator. Assembles the packet under the treatment exception. No authorization requested. Documents the disclosure in the EHR's disclosure log with date, recipient, and content category.
  4. Hour 6 — Privacy officer, by exception only. Reviews if the chart contains Part 2 records, psychotherapy notes, or a state-restricted category flagged by the EHR. This is a filter, not a bottleneck.
  5. Hour 24 — Referral coordinator. Confirms receipt. Unconfirmed transmissions get re-sent through a second channel and logged.
  6. Hour 48 — Front desk. Confirms the patient has the appointment and knows what was sent. Patients who ask "did you send my records?" and get "I think so" file complaints.
  7. Hour 72 — Records staff. Files the inbound consult note and, if it contains imaging from a vendor archive, confirms that vendor is on the BAA inventory.

Note that a misdirected fax appears at step two and step five, not step four. Wrong-recipient disclosure remains one of the most frequently reported small-breach causes; you can scan the pattern yourself in the HHS breach portal. Address verification is cheap insurance.

Five Artifacts to Have on File Before the Next Referral

  • A one-page permitted-disclosure reference for treatment exchange, posted where records staff sit, citing 164.506(c)(2) and the minimum-necessary carve-out.
  • A verified destination list for every MFM group, hospital, and NICU you refer to, with a review date on it.
  • A state overlay covering minor representation, restricted record categories, and any consent requirements stricter than HIPAA.
  • A current business associate inventory that includes imaging archives, transcription, referral platforms, and transport — with executed agreements matched to each line.
  • A dated risk analysis that reflects the systems actually in use this year, including anything added during the last twelve months of referral growth.

None of this changes how a growth-restriction case is managed clinically. It changes whether the records arrive on time, go to the right place, and hold up when a parent files a complaint or a regulator asks what your process was.

If your vendor inventory and risk analysis have drifted behind your actual referral volume, close that gap before the next complicated case rather than during it — generate the risk analysis and policy set, reconcile it against the vendors touching your obstetric and newborn records, and give your referral coordinator a workflow that does not depend on institutional memory.