At 4:40 on a Thursday, a sleep medicine practice calls your front desk. They have a new patient consult on Monday, the referring physician is one of yours, and they want the chart — office notes, the medication list including the Rozerem your prescriber started, prior sleep study reports, and the last two years of problem-list updates. Your medical assistant asks whether the patient signed a release. The sleep clinic says they don't need one.

The sleep clinic is right, and your MA is not wrong to ask. This post is about that gap: how records legitimately move between organizations when a patient is referred for a sleep-related evaluation, what your staff should verify before the fax goes out, and which of the vendors in that chain need a signed agreement on file. No clinical guidance here — the prescribing decisions belong to your clinicians. The workflow belongs to you.

The Referral Packet: What Actually Leaves Your Building

Sleep complaints generate cross-organization traffic. A patient may see primary care, get referred to sleep medicine, undergo a study at a third facility, and end up back with a behavioral health clinician for cognitive behavioral therapy for insomnia. Each handoff moves a packet.

Build a standing referral packet definition so your staff isn't improvising at 4:40 on a Thursday. A typical outbound packet for a sleep referral contains:

  • Demographics and current insurance
  • The referring note and reason for referral
  • Active medication list and allergies
  • Relevant prior notes — not the entire chart by reflex
  • Prior sleep study reports or imaging your practice holds
  • Relevant labs

Name the role that assembles it. In most practices that's a referral coordinator or a designated MA, not whoever answers the phone. Name the role that reviews it before transmission. Those should be two different people when volume allows.

Do You Need an Authorization to Send Rozerem Records to a Specialist?

No. Under 45 CFR 164.506(c)(2), a covered entity may disclose protected health information to another covered entity for that entity's treatment activities without a patient authorization. A referral to a sleep specialist is a treatment disclosure. The chart, the medication list showing Rozerem or any other therapy, and the prior study results can go without a signed release form.

Two conditions still apply. First, you must verify the identity and authority of the person requesting the records if you don't already know them — 45 CFR 164.514(h). Second, you must transmit securely, which is a Security Rule obligation, not a Privacy Rule one. HHS has published specific guidance on permitted uses and disclosures for exchange of information for treatment that your privacy officer should keep printed and handy for exactly this argument.

What counts as "treatment"

Treatment includes the provision, coordination, or management of care by one or more providers, plus consultation and referral. A sleep clinic evaluating a patient your physician referred is squarely inside that definition. A wellness vendor asking for the same chart to "help your patients sleep better" is not.

Minimum Necessary Doesn't Apply — But Your Habits Should

The minimum necessary standard at 45 CFR 164.502(b) carves out disclosures to a health care provider for treatment. You are not legally required to trim the packet down for a treating specialist.

Send the full record anyway only when it's clinically useful, and let the clinician — not the front desk — make that call. Practices that reflexively dump the entire longitudinal chart into every referral create three downstream problems: they surface behavioral health content that may carry separate protection, they bury the specialist in noise, and they widen the blast radius when the receiving fax number turns out to be wrong.

Write the rule down in your policy: full chart on clinician request or specialist request; defined packet by default. An undocumented habit is not a policy, and an auditor will treat it accordingly.

Three Record Types That Break the Simple Rule

Psychotherapy notes

Separately maintained psychotherapy notes require a patient authorization even for treatment disclosures, with narrow exceptions. Insomnia referrals frequently touch behavioral health, and a CBT-I clinician in your organization may keep process notes distinct from the progress note. Confirm with your behavioral health staff whether they maintain separated notes, and flag those charts in your referral workflow so the coordinator stops rather than sends.

Part 2 substance use disorder records

If any portion of the chart originates from a federally assisted substance use disorder program, 42 CFR Part 2 governs it. The 2024 final rule aligning Part 2 more closely with HIPAA carried a compliance date of February 16, 2026 — which means as of this writing your consent forms, notices, and redisclosure handling should already be operating under the aligned framework. Aligned is not identical. Part 2 still requires patient consent in circumstances where HIPAA alone would permit disclosure, and it still travels with redisclosure restrictions.

State law that is more protective

Several states require written consent for the disclosure of mental health records, HIV status, or genetic information regardless of the HIPAA treatment exception. HIPAA sets a floor. If your practice operates across state lines or refers across them, your referral coordinator needs a one-page matrix — not a memory — for the states you touch.

The Vendor Layer: Fax Lines, Referral Portals, and E-Prescribing

The Rozerem prescription and the referral packet almost never move by hand. They move through vendors, and each one is a decision point on your business associate list.

Cloud fax services. A vendor that stores fax images, even briefly, is a business associate. Get the agreement signed. The old "conduit exception" is narrow — it was written for the postal service and telecom carriers moving data without persistent storage, not for a SaaS platform with a searchable archive.

Referral management platforms and HIEs. These hold PHI by design. Confirm the agreement is current, confirm which participants can query your data, and confirm what your organization's opt-out or restriction handling looks like when a patient asks that a specific practice not see a specific record.

E-prescribing networks and the pharmacy. Transmitting a prescription to a dispensing pharmacy is a treatment disclosure to another covered entity. The intermediary network is a business associate. Your EHR vendor's agreement usually covers this, but "usually" is the word that ends up in a breach report — verify it in writing.

Transcription and scribe services. Business associates. Same drill.

If your vendor inventory is a spreadsheet somebody built in 2023 and nobody has opened since, that is the gap. Building the inventory, mapping where PHI actually sits, and producing the risk analysis and policy set that HHS expects is exactly what automated HIPAA risk analysis and policy generation exists to compress from weeks into an afternoon. When you find a vendor operating without a signed agreement, you can generate a signature-ready business associate agreement and close the gap the same day rather than waiting on a legal queue.

Inbound Requests: Verify Before the Chart Moves

Most improper disclosures in referral workflows are not sophisticated. They are a request that looked routine and wasn't.

Give your front desk a four-step verification script for any inbound records request from an organization you don't have a standing relationship with:

  1. Confirm the requesting organization is a health care provider with a treatment relationship or a pending appointment with this patient. A pending appointment is enough.
  2. Call back on a number you independently look up, not the number on the request form. Document who you spoke with and when.
  3. Confirm the destination. Fax number or portal address, read back digit by digit, logged.
  4. Route anything unusual to the privacy officer rather than guessing. Attorney requests, employer requests, and requests from an entity you cannot identify are all "unusual."

Set the expectation that step four carries no penalty. Staff who fear looking slow will send the fax.

Accounting of Disclosures, and What You Log Anyway

Treatment disclosures are excluded from the accounting of disclosures requirement at 45 CFR 164.528. You do not have to hand a patient a list of every specialist you sent their chart to.

Log it regardless. When a patient calls in October asking why a practice they never visited has their records, the only thing that resolves the conversation quickly is a timestamped entry showing what was sent, to whom, by whom, and on whose request. Your EHR probably captures this if the disclosure went through the referral module. If your staff faxes from a standalone machine, you have no log — fix the workflow, not the log.

When the Patient Directs the Transfer: the 30-Day Clock

Different rule, different clock. If the patient submits a written request directing you to send their records to another provider or to a third party, that's a right-of-access request under 45 CFR 164.524. You have 30 days, with one 30-day extension available if you notify the patient in writing of the reason and the new date.

Fees are limited to a reasonable, cost-based amount. OCR has brought a long series of enforcement actions under its Right of Access Initiative, and the pattern is consistent: small practices, slow responses, penalties that dwarf the cost of just sending the records. HHS maintains detailed guidance on the individual right of access, including what you may and may not charge.

Train your team to distinguish the two paths on intake. Provider-to-provider referral: no authorization, send now. Patient-directed transfer: right of access, 30-day clock starts today, log the date.

Information Blocking Sits on Top of All of This

Refusing or unreasonably delaying a lawful request for electronic health information can constitute information blocking under the 21st Century Cures Act rules, separate from any HIPAA analysis. "We require a signed release for everything" is a policy that feels safe and may not be. If HIPAA permits the disclosure and no exception applies, an added paperwork barrier is a delay you may have to justify.

Review the information blocking exceptions published by ONC with your privacy officer, and make sure your written policy names which exception you're relying on when you do decline. "We've always done it this way" is not an exception.

A Worked Example: Nine Days, Four Handoffs

Day 1. Primary care physician refers a patient to sleep medicine and, at that visit, starts a sleep medication. Referral coordinator builds the standard packet, verifies the receiving clinic's portal address, transmits, logs the disclosure. No authorization needed — treatment.

Day 1, same afternoon. The Rozerem prescription routes to the patient's pharmacy through the e-prescribing network. Treatment disclosure to the pharmacy; business associate relationship with the network, already papered.

Day 4. Sleep clinic requests two additional years of notes. Coordinator confirms the caller against the known contact on file, sends, logs.

Day 6. Sleep clinic refers the patient to a behavioral health practice for CBT-I and asks your office to forward its records directly. Coordinator flags it — the chart contains a behavioral health episode. Privacy officer checks whether separated psychotherapy notes exist and whether state law requires consent. Answer determines whether the packet goes or an authorization gets sent to the patient.

Day 9. Patient calls and asks for a copy of everything for their own records. That is a right-of-access request. Clock starts. Different workflow, different form, different owner.

Four handoffs, three distinct legal pathways, one patient. Practices that treat all four as "records requests" get one of them wrong.

Assign the Roles Before the Next Referral

Three names on a page: who assembles referral packets, who verifies unfamiliar requesters, who owns right-of-access requests and the 30-day clock. Then a fourth: who reviews the business associate list quarterly and confirms every vendor touching a Rozerem prescription, a sleep study, or a referral packet has a current signed agreement.

If you can't fill those four slots from memory, start with the underlying documentation — generate your risk analysis, policy set, and vendor inventory in one pass, then assign the names. The workflow follows the paperwork, not the other way around.