A radiologist flags a pulmonary nodule on a CT that was ordered for something else entirely — a rib injury, a pre-op clearance, an ER visit for chest wall pain. Within nine days, that single line in an impression section has moved through four organizations: the imaging center, the ordering primary care practice, a pulmonology group, and probably a second imaging facility for follow-up. Nobody signed an authorization. Nobody had to. But your practice still owns every one of those transmissions, and if one lands in the wrong fax queue, you own that too.

This post is for the person who runs the referral desk, signs the vendor contracts, and answers the phone when a patient asks why their scan went to a doctor they never chose. It maps the disclosure logic, the handoffs, and the documentation trail.

Why a Pulmonary Nodule Generates More Outbound Records Than a Routine Visit

Most encounters stay inside one building. An incidental lung finding does not. The clinical reality — that these findings frequently prompt specialist evaluation and interval imaging — is not your department's problem. The administrative consequence is: your practice becomes a records hub for a multi-month, multi-organization episode of care.

Concretely, a single pulmonary nodule referral typically pushes out the radiology report, the underlying DICOM images (not just the report — the specialist wants the pixels), the referring note, the problem list, the medication list, a smoking and occupational exposure history, prior imaging for comparison, and insurance information for prior authorization. That is seven or eight distinct payloads, often through three different channels.

Each channel has its own failure mode. Fax goes to a stale number. Portal upload sits unclaimed. A CD gets handed to the patient and never arrives. The image-sharing platform your radiology partner uses may or may not have a signed agreement with you.

Does a Pulmonary Nodule Referral Need Patient Authorization?

No. Under the HIPAA Privacy Rule, a covered entity may disclose protected health information to another covered entity for that provider's treatment activities without patient authorization. Sending imaging, reports, and history to the pulmonologist you are referring to is a permitted treatment disclosure. You do not need a signed release, and you should not delay the referral waiting for one.

Three qualifiers your staff needs to hold onto:

  • Minimum necessary does not apply to disclosures to a health care provider for treatment purposes. HHS is explicit on this in its minimum necessary guidance. Send the full relevant record; do not let a well-meaning HIM clerk redact the chart into uselessness.
  • State law may be stricter. Several states require patient consent before releasing records even between treating providers, and specially protected categories (behavioral health, HIV status, substance use treatment under 42 CFR Part 2) carry their own rules that ride along in the same chart. Your release process has to screen for those, not the diagnosis.
  • Patient restriction requests under 45 CFR 164.522 can apply. If a patient previously asked you to restrict disclosures to a particular organization and you agreed, that agreement binds you.

Train the front desk to say it plainly: "We're sending your records to the specialist as part of your care. That's part of the treatment relationship, and you can ask us in writing to restrict specific disclosures."

The Seven Handoffs in One Referral — and Who Owns Each

Write these down and assign a name to each row. Ambiguity here is where records go missing.

Day 0 to Day 2: Result Receipt and Flagging

The imaging report arrives — interface, fax, or portal. Owner: clinical results desk. The compliance question is not who reads it but who confirms receipt. If a result arrives by fax and nobody logs it, you have no record that it entered your custody, which matters enormously if a patient later alleges you sat on it. Log receipt with a timestamp regardless of channel.

Day 1 to Day 3: Patient Notification

Owner: clinical staff, documented by the referral coordinator. Notification method matters for privacy. If your practice uses SMS or email to tell patients results are available, confirm the patient's communication preference is documented and that the message itself contains no clinical detail. "Your provider has results to discuss; please call" is a safe message. The specific finding is not.

Day 2 to Day 5: Referral Order and Packet Assembly

Owner: referral coordinator. This is the highest-risk step. The coordinator selects a destination from a directory that may be years out of date, pulls documents, and sends. Two controls: verify the destination fax number or Direct address against the specialist's current listing at the moment of send, and build a standing packet template for pulmonary referrals so document selection is not improvised.

Day 3 to Day 7: Image Transfer

Owner: imaging liaison or HIM. Reports are text; images are gigabytes. Practices route them through a cloud image exchange, a regional HIE, physical media, or the patient. If a third party stores or transmits those images on your behalf, that party is a business associate. See the next section.

Day 5 to Day 14: Prior Authorization

Owner: billing. Disclosures to a health plan for payment purposes are permitted, but minimum necessary does apply here. Sending the entire chart to a payer because it was easier than pulling three documents is a real finding in real audits.

Ongoing: Specialist Reports Back

Owner: results desk. Inbound consult notes and follow-up imaging need the same receipt logging as the original. Closing the referral loop is a quality metric and a records-retention obligation at the same time.

Month 3 to Month 24: Interval Follow-Up Coordination

Owner: referral coordinator or population health. Because pulmonary nodule follow-up often stretches across months and multiple facilities, your tracking list is itself PHI. If it lives in a spreadsheet on a shared drive or in a scheduling tool outside your EHR, it needs to be in your asset inventory and covered by your risk analysis.

Where Business Associate Agreements Actually Attach

Provider-to-provider treatment disclosures do not require a BAA. The pulmonologist is a covered entity receiving PHI for their own treatment purposes, not a vendor performing a function on your behalf. Practices waste weeks chasing agreements they do not need while ignoring the ones they do.

You need a signed BAA with, at minimum:

  • The cloud image-exchange platform that stores or routes DICOM studies
  • Your electronic fax provider — a fax service that holds transmissions on its servers is a business associate, even though a physical fax machine is not
  • Any referral-management or care-coordination software sitting outside your EHR
  • Transcription, scanning, and release-of-information vendors
  • Your document shredding and media destruction contractor
  • IT support with access to systems containing PHI

An HIE may operate under a participation agreement that functions as the BAA — read it rather than assuming. If you find a vendor in this workflow with no executed agreement on file, you can generate a signature-ready Business Associate Agreement and close the gap the same day rather than waiting on a vendor's legal department to circulate their template.

The Misdirected Fax Is Still the Most Common Way This Goes Wrong

Browse the HHS breach portal and the pattern is unmistakable: unauthorized access and disclosure incidents dominate the small-and-midsize provider entries, and a meaningful share of them are mundane transmission errors. A referral coordinator sends a chest imaging packet to the pulmonology group's old number, which now belongs to a real estate office.

When that happens, run the four-factor risk assessment under 45 CFR 164.402 and document it whether or not you conclude notification is required. The factors: the nature and extent of the PHI involved, who received it, whether the PHI was actually acquired or viewed, and the extent to which risk has been mitigated. A written confirmation of destruction from the receiving fax owner is mitigation evidence — get it in writing, not by phone.

If notification is required, the clock is 60 days from discovery for affected individuals, with annual reporting to HHS for incidents affecting fewer than 500 people and 60-day reporting for larger ones.

A Verification Step That Takes Forty Seconds

Before any outbound referral packet leaves: confirm the destination against the specialist's current directory entry, confirm the patient name on the cover sheet matches the first page of the enclosed record, and log the send in the referral tracker with the destination and document list. Three checks. Make them a required field, not a habit.

Information Blocking: When "We Don't Release Outside Reads" Becomes a Problem

Some practices have an unwritten rule against forwarding imaging performed elsewhere, or route every outside request through a manual review that adds two weeks. Under the information blocking provisions of the 21st Century Cures Act, that practice pattern is exposure. Delay itself can constitute interference with access, exchange, or use of electronic health information.

There are defined exceptions — infeasibility, privacy, security, content and manner — but each has conditions you have to actually meet and document. The exceptions are not a general escape hatch for "we'd rather not." Review the current framework on HealthIT.gov's information blocking resources and write down which exception, if any, your practice relies on and why.

Practical test: if a pulmonology group requests prior comparison imaging electronically and your answer is "mail us a signed release and we'll put it in the queue," ask whether that friction is justified by a documented exception or is just how it has always been done.

Patient Right of Access Is a Different Clock Entirely

Do not confuse provider-to-provider transfer with the individual right of access. When the patient asks for their own imaging and reports, you have 30 days to respond, with one permitted 30-day extension if you notify the patient in writing of the reason and the new date. Fees are limited to reasonable, cost-based charges. The patient may also direct you to send a copy to a third party of their choosing.

OCR's Right of Access enforcement initiative has produced dozens of settlements since 2019, most of them against small practices, most for delays measured in months. Review the HHS guidance on individuals' right to access and confirm your fee schedule and turnaround are documented in policy, not in one staff member's head.

What Goes in the Accounting of Disclosures

Treatment, payment, and operations disclosures are excluded from the accounting requirement. So the referral packet to the pulmonologist does not appear. What does: disclosures required by law, public health reporting, disclosures to law enforcement, and research disclosures without authorization — six years back, produced within 60 days of request. If your only disclosure log is the referral tracker, you are logging the wrong things.

Close the Loop on Documentation

Every workflow above depends on documents most practices cannot produce on demand: a current risk analysis that includes the image-exchange platform and the follow-up tracking spreadsheet, a records release policy that distinguishes treatment disclosures from access requests, a vendor inventory with BAA status, and a breach response procedure with the four-factor assessment built in. If assembling those has been on your list since the last time someone asked, automated HIPAA risk analysis and policy generation will get you a defensible document set faster than a consultant engagement will.

Pick one referral from last month, trace all seven handoffs, and see how many you can evidence. That gap list is your next quarter's work.