Your front desk gets the call at 9:40 on a Tuesday. The general surgery office won't schedule the patient for a lipoma removal until they have the chart, and they want it before noon. Your medical assistant asks whether the patient needs to sign an authorization first. Someone else suggests just faxing the whole record to be safe. Both instincts create work you don't need, and one of them creates risk.

This post walks the administrative path a soft-tissue mass referral takes through your practice: what you may disclose without authorization, what belongs in the outbound packet, which transport channels hold up under audit, which vendors in the chain need a business associate agreement, and how results come back without landing in a pile nobody owns. No clinical guidance here — the clinical detail matters only because these encounters routinely cross organizational lines, which is exactly when records move and privacy programs get tested.

Do You Need Patient Authorization to Send Records for a Lipoma Removal?

No. Under the HIPAA Privacy Rule, a covered entity may disclose protected health information to another covered health care provider for that provider's treatment of the patient without a signed authorization. See 45 CFR 164.506(c)(2) and HHS's guidance on permitted uses and disclosures. The minimum necessary standard also does not apply to disclosures to a health care provider for treatment purposes — 45 CFR 164.502(b)(2)(i). Four things still constrain you: psychotherapy notes (authorization required), substance use disorder treatment records covered by 42 CFR Part 2, any state law that is more protective, and a granted restriction request under 45 CFR 164.522.

That last one matters more than people expect. If a patient pays out of pocket for a procedure and asks you to restrict disclosure of that service to their health plan, you must honor it. That's a claims and billing constraint, not a referral constraint — but the referral is often where staff first learn the patient is self-paying.

What Belongs in the Outbound Referral Packet

"Minimum necessary doesn't apply" is a legal ceiling, not an operating instruction. Sending 340 pages of unrelated encounters to a surgical office wastes their intake staff's time, buries the relevant material, and expands your exposure if the transmission goes to the wrong number. Build a defined packet and let the referring clinician add to it.

The standard packet

  • Referral form with the referring provider's name, NPI, callback number, and reason for referral
  • Current problem list, medication list, and allergy list
  • Relevant imaging reports and a pointer to where the images themselves live
  • Relevant pathology or prior procedure reports, if any exist
  • Insurance and demographic face sheet, and prior authorization status if your payer requires one
  • The single progress note documenting the encounter that generated the referral

What stays behind unless specifically requested

  • Unrelated specialty consults from prior years
  • Behavioral health notes, and anything meeting the definition of psychotherapy notes
  • Part 2-protected records absent the required consent
  • Full billing ledgers and collections correspondence

Write this list into a one-page work instruction and put a named role on it. In most practices the right owner is the referral coordinator, with the release-of-information staff member as backup. If your packet definition lives only in one long-tenured employee's head, you have a continuity problem, not a privacy program.

Where the Records Actually Travel

Channel selection is where most referral workflows quietly fail. Rank yours by how well you can prove where the data went.

Direct secure messaging and EHR-to-EHR exchange

The strongest option when both organizations support it. You get an addressed, authenticated exchange and a machine-generated log. Confirm the receiving address annually — surgical practices change groups and their endpoints move.

Provider portal upload

Many surgical and imaging groups run their own referral portals. These are fine, with two caveats: confirm the portal is the receiving organization's system and not a third-party intermediary you've never assessed, and record the confirmation number in your referral log.

Fax and e-fax

Still the workhorse, still the number one source of wrong-recipient disclosures in ambulatory practice. If you fax, use stored entries only, require a second-person confirmation for any manually keyed number, and keep the transmission report with the referral record. Cloud fax services are business associates; treat them accordingly.

Patient hand-carry

Perfectly permissible and sometimes fastest. Document what you handed over and to whom. Do not use hand-carry as a workaround for a channel you never bothered to set up.

Health information exchange

If your practice participates in a regional or national network, the query-based retrieval path may already cover most of the packet. Know what your participation agreement obligates you to publish and what it lets you pull.

The Vendor Layer: Who Needs a BAA and Who Doesn't

Two organizations exchanging records for treatment are not in a business associate relationship with each other. Your practice does not need a BAA with the surgical group receiving the referral, and the surgical group doesn't need one with you. Asking for one signals a program that hasn't read the rule, and it delays care while two administrators email PDFs back and forth.

The vendors sitting between you are a different story:

  • Referral management platforms that hold or route PHI on your behalf
  • Cloud fax and secure messaging services
  • Release-of-information and copy-service companies
  • Transcription and documentation services, including AI-assisted scribes
  • Document management and scanning vendors handling inbound referral paperwork
  • Courier services that transport paper charts, unless they qualify as conduits — a narrow category

Inventory these by name, not by category. If you can't produce a signed agreement for each within ten minutes, that's your first project. A signature-ready business associate agreement generated through a guided wizard closes the paperwork gap faster than routing a redline through counsel for every small vendor, and gives you an exportable PDF for the file.

Information Blocking Cuts the Other Direction

Privacy officers spend most of their attention on improper disclosure. Referral workflows also expose you to the opposite failure: unreasonably withholding records another provider or the patient has asked for. The information blocking provisions of the 21st Century Cures Act apply to health care providers, and "our policy is to require an authorization for everything" is not one of the recognized exceptions. Review the information blocking rules and exceptions and make sure your release policy doesn't manufacture a violation in the name of caution.

The Results Loop: Pathology, Op Notes, and Who Closes It

After a lipoma removal, records flow back: an operative note, a pathology report if tissue went to the lab, and follow-up instructions. The pathology report is the piece that most often falls into a gap. The lab has a relationship with the surgeon, not with you, so the report may arrive at your practice as a courtesy copy, on a delay, or never.

Assign the closure step explicitly. A workable pattern:

  1. Referral coordinator logs the referral with an expected-response date, typically 30 days out.
  2. At the expected-response date, an open-referral report is worked by name — not "whoever has time."
  3. Inbound op notes and pathology reports are matched to the log entry, filed to the chart, and routed to the referring clinician's review queue.
  4. The log entry closes only after clinician acknowledgment is recorded.

That loop is a patient safety control and a records-integrity control at the same time. When a patient later requests "everything you have," a chart missing the specialist's report generates a complaint you can't win.

The 30-Day Clock When the Patient Asks for the Chart

Separate from provider-to-provider exchange, patients have a right of access under 45 CFR 164.524. You have 30 days from the request, with one 30-day extension available if you notify the patient in writing of the reason and the new date. Patients may also direct you to send a copy to a third party of their choosing, and fees must be limited to reasonable, cost-based charges. HHS's right of access guidance is the reference to keep bookmarked, and OCR has pursued a long line of enforcement actions specifically on access delays.

Practical consequence for referral workflows: if a surgical office asks you for records and cites "the patient told us to send it," that's a patient-directed request with different documentation requirements than a treatment disclosure. Pick a lane and paper it accordingly.

Documenting All of This So It Survives an Audit

Everything above is a set of policies, work instructions, role assignments, and vendor records. The Security Rule also requires a documented, current risk analysis under 45 CFR 164.308(a)(1)(ii)(A) that accounts for how PHI actually moves — including the fax line, the referral portal, and the scanning workstation at the front desk. NIST SP 800-66r2 is the practical companion for scoping that work.

If your current documentation is a 2021 template with the prior practice manager's name in the header, that gap is worth closing before it surfaces during a complaint investigation. Tools that generate your risk analysis report, policies, and the full compliance document set get a small practice from "we do this correctly but can't prove it" to a defensible file without a six-month consulting engagement. Nothing certifies you — HHS does not endorse or certify any product — but documentation you can hand over is the difference between a short inquiry and a long one.

Five Failure Points to Audit This Quarter

  1. Stored fax entries. Pull the list. Verify every specialty office number against a current directory. Delete the stale ones.
  2. Open referrals older than 45 days. Run the report. If it doesn't exist, that's the finding.
  3. Vendor inventory versus signed BAAs. Reconcile line by line, including the e-fax service and any AI documentation tool added in the last year.
  4. Access request log. Sample ten requests. Check the date received, date fulfilled, and any extension letters.
  5. Packet discipline. Sample five outbound referrals. Did anything unrelated ride along?

Also make a habit of scanning the OCR breach portal for incidents at practices your size. The recurring ambulatory patterns — misdirected transmissions, unencrypted devices, unmanaged vendor access — are the same ones your referral workflow touches every day.

Your Next Step

Take one hour this week. Write the packet definition, name the owner, and reconcile the vendor list against your signed agreements. Then make sure your risk analysis and policy set reflect what your staff actually do when a lipoma removal referral goes out the door. If that documentation doesn't exist yet, build the compliance document set for your practice and stop rebuilding it from memory every time someone asks.