A patient rolls an ankle on Saturday, walks into your urgent care at 4:10 p.m., and by Monday morning four separate organizations hold a piece of that encounter: your clinic, the imaging center down the road, the orthopedic group you referred to, and the patient's primary care practice. The clinician applied the Ottawa ankle rules — a decision rule used to determine whether an ankle or midfoot X-ray is warranted — and the answer set off a chain of record transfers. None of those transfers required a signed authorization. Most staff don't know that, so they either stall the referral or over-share. This article is about running that chain correctly: which disclosures are permitted, who signs what, and where the audit exposure actually sits.

Why the Ottawa Ankle Rules Generate a Records Problem, Not Just a Clinical One

The rule itself is clinical and none of your business as an administrator. What matters to you is the branching it creates. When imaging is ordered, a record leaves your building. When imaging is not ordered, you still generate a note that a downstream provider may want, and a patient who may ask for it three weeks later when the ankle still hurts.

Practically, an ankle-injury visit at an urgent care or primary care site produces up to five artifacts: the encounter note, an imaging order, the images and radiology report, a referral packet to orthopedics, and a work or activity note the patient requested at checkout. Each of those has a different legal footing for disclosure. Your staff treat them as one pile.

That is the failure mode. Not a breach of ten thousand records — a front-desk clerk who faxes an entire chart to an employer because the patient said "they need it for my claim."

No. Under 45 CFR 164.506, a covered entity may use and disclose protected health information for treatment, payment, and health care operations without an individual's authorization. That includes disclosing PHI to another provider for that provider's treatment of the same patient. Sending a referral packet to the orthopedic group — encounter note, imaging report, relevant history — is a permitted treatment disclosure.

Three qualifiers your staff need to hold onto:

  • The disclosure must actually be for treatment. "The specialist's biller wants the whole chart" is a different question.
  • State law may be stricter for certain categories — substance use disorder records under 42 CFR Part 2, behavioral health, HIV status, minors' records in some states. Those carry their own consent rules regardless of HIPAA.
  • Your Notice of Privacy Practices must accurately describe treatment disclosures. If yours was written in 2013 and never touched, read it this week.

HHS maintains plain-language guidance on permitted uses and disclosures that is short enough to hand to a new hire on day one.

The Minimum Necessary Standard Does Not Apply Here

This trips up experienced staff. The minimum necessary requirement explicitly does not apply to disclosures to or requests by a health care provider for treatment purposes. If the orthopedist wants the full record to evaluate the ankle, you are not required to redact it down to the smallest useful slice.

Minimum necessary does apply to the payment and operations disclosures that ride alongside. Review the HHS minimum necessary guidance and make sure your release-of-information policy distinguishes the two paths in writing. If it says "always send the minimum necessary," it is wrong and it is slowing down your referrals.

The Four Handoffs, Mapped to Owners and Timelines

Assign a name to each of these. Not a department — a person, with a backup.

Handoff 1: Clinic to Imaging Center (same day)

The order goes out with demographics, the clinical indication, and insurance information. This is a treatment disclosure plus a payment disclosure. Owner: the medical assistant or scribe who closes the encounter. Timeline: before the patient leaves the building, because a patient who has to call back tomorrow becomes a complaint.

Verify the imaging center's fax number or direct address against a maintained list, not against what the patient's cousin wrote on a sticky note. Misdirected faxes remain one of the most common small-practice incidents, and they are entirely preventable with a quarterly number-verification task.

Handoff 2: Imaging Center to Clinic (24–72 hours)

The report comes back to you. Your obligation is intake tracking: does someone confirm that every order placed has a result received? Build a simple pending-results log. When a result never arrives and no one notices, that is a patient-safety event and a documentation gap that will surface in litigation, not a privacy event — but the same workflow discipline covers both.

Handoff 3: Clinic to Orthopedics (1–5 days)

The referral packet. Define the standard contents in a written procedure so staff aren't improvising: encounter note, imaging report, relevant medication and allergy list, insurance, contact information. Standardizing this is what keeps a well-meaning clerk from attaching twelve years of unrelated history.

Handoff 4: Everyone to Primary Care (ongoing)

The patient's PCP should get the loop closed. Treatment disclosure, permitted, no authorization. The practical obstacle is almost never legal — it is that nobody owns the task and it falls off the end of the day.

The Imaging Center Is Not Your Business Associate

Say this out loud at your next staff meeting, because someone on your team is about to chase a signature that isn't required.

When you send a patient to an independent imaging center and that center bills the patient's insurer under its own NPI, it is a separate covered entity performing its own treatment and billing. It is not creating or maintaining PHI on your behalf. No BAA is required between you.

Contrast that with the vendors who genuinely are business associates in this same workflow:

  • Your transcription service
  • Your release-of-information vendor, if you outsource records requests
  • Your fax-to-email or secure messaging provider
  • Your referral-management or e-referral platform
  • Your document storage and backup vendor
  • Your billing company and any clearinghouse acting on your behalf

Every one of those needs an executed agreement on file with the required terms. If you have vendors onboarded in the last eighteen months whose paperwork you cannot locate in under five minutes, close that gap now — a signature-ready Business Associate Agreement built through a guided wizard takes less time than the email thread you were going to start about it.

The Requests That Are Not Treatment Disclosures

Here is where an ankle injury gets administratively interesting, because these encounters attract non-clinical requesters at unusual volume.

Employers

An employer asking for records because the injury happened at work is not automatically entitled to them. If it is a workers' compensation claim, 45 CFR 164.512(l) permits disclosure as authorized by and to the extent necessary to comply with your state's workers' comp laws. Know what your state actually permits. If it is not a comp claim and the employer just wants documentation, you need a valid authorization signed by the patient.

Schools, Coaches, and Athletic Trainers

Sports injuries produce phone calls from people who genuinely believe they are part of the care team. A high school athletic trainer employed by the school is generally not a covered-entity provider treating your patient. Get an authorization. Train your front desk on the exact sentence to say when a coach calls: "I can't confirm or deny that anyone is a patient here. If the family wants us to share information, we'll need a signed release from them."

Attorneys and Insurers

Personal injury attorneys move fast on fall and sports injuries. Treat every attorney request as requiring either a patient authorization or valid legal process, and log it. Liability insurers are not treatment providers.

The Patient

The patient's own request is the one with a hard clock: 30 days from receipt, with one permitted 30-day extension and written notice of the delay. Fees must be reasonable and cost-based. Right of access has been the single most consistently enforced area of OCR's small-practice activity for years, and the fact patterns are boring — someone asked for their imaging report, nobody responded, they filed a complaint. Review the HHS individuals' right of access guidance and make sure your intake form captures the request date, not the date someone got around to logging it.

Matching the Channel to the Record

Imaging is the complication. A radiology report is a small text document. The images themselves are large DICOM files, and how they move between organizations determines your risk profile.

Rank your channels honestly:

  1. Direct secure messaging or an interoperability network — best case, encrypted in transit, addressed to a verified endpoint, produces an audit trail.
  2. Portal-to-portal or image-exchange platform — good, but confirm the vendor relationship and the BAA.
  3. Encrypted email with a verified recipient — acceptable with policy support.
  4. Fax — still legal, still ubiquitous, still the leading source of small misdirection incidents. If you fax, verify numbers on a schedule and use a cover sheet with a misdirection notice.
  5. CD handed to the patient — legal and often practical. Document what you gave and to whom. An unencrypted disc handed to the correct patient is not a breach; an unencrypted disc left at the front desk overnight is a different conversation.

Also know that unreasonably slowing a legitimate request from another provider can raise information blocking questions under the 21st Century Cures Act. ONC maintains information blocking resources worth reading alongside your privacy policy, because "we're being careful" is not one of the recognized exceptions.

Documenting All of This Before Someone Asks You To

Every workflow above should map to a written policy, a named owner, and evidence that staff were trained on it. That is the actual deliverable when OCR, a health plan auditor, or a hospital system's vendor review team comes calling — not your good intentions about the Ottawa ankle rules referral pathway, but the document set that proves the pathway is governed.

You also need a current security risk analysis that accounts for these specific transmission channels: the fax line, the image exchange platform, the referral portal, the CD burner nobody has thought about since 2019. If your last risk analysis predates half your vendor list, it is not a risk analysis, it is a historical artifact. Practices that would rather not spend a quarter assembling this by hand can generate the risk analysis and full policy set through hipaa.app and spend the saved time on the part that actually reduces incidents — training the people who answer the phone.

A 20-Minute Tabletop You Can Run This Month

Gather your front desk, your MAs, and whoever handles records. Present this: a patient was seen for an ankle injury Saturday. Today, four requests arrive.

  • The orthopedic office wants the encounter note and imaging report. Permitted treatment disclosure. Send it. No authorization.
  • The patient's employer wants "the file." Determine whether it is a workers' comp claim. Otherwise, authorization required.
  • The patient's spouse calls for results. Depends on whether the patient agreed or is present; default to declining and documenting.
  • The patient emails asking for a copy of the X-ray report. Right of access. 30-day clock starts today. Log it.

If your team gets fewer than three of four right, you have found your next training priority. Run it again in ninety days with a different injury and the same four requester types — the answers travel; the scenario doesn't matter.

Start With the Referral Packet

Pick the narrowest thing you can fix this week: write down exactly what goes into a specialist referral packet, name the person who assembles it, and post it where they work. Then check whether the vendors touching that packet have current agreements on file, and whether your risk analysis reflects how records actually move today. If either answer is uncomfortable, build the documentation set before the next records request forces the question.