Your rheumatology office receives eleven referral packets on a Monday. Three of them concern patients already on Savella, and each packet arrives differently: one by fax from a primary care office, one through your state health information exchange, one as a 47-page PDF emailed by a patient's spouse. Your intake coordinator has to decide, in about ninety seconds per packet, whether the record can be accepted, filed, and acted on — and whether anything needs to go back the other direction. This post is about that decision and the workflow around it. It is not clinical guidance; it is the records, vendor, and disclosure plumbing that sits underneath a specialty referral.

What Actually Moves Between Offices in a Savella Referral

Fibromyalgia care tends to involve more than one organization. A primary care practice initiates the workup, a specialist confirms the picture, a pharmacy dispenses, and a payer reviews. Savella is one of the medications that shows up in that chain, which means a Savella entry in a medication list is often a signal that the chart has already crossed at least two organizational boundaries.

From an administrative standpoint, that produces a predictable set of artifacts your staff will handle:

  • Referral order and consult request, with the referring provider's NPI and clinical question
  • Problem list, medication list, allergy list, and recent progress notes
  • Labs and imaging reports, often duplicated across three sources
  • Prior authorization correspondence and payer determination letters
  • Pharmacy fill history or benefit investigation results
  • Consult note going back to the referring provider

Six artifact types, four organizations, and one patient who expects all of it to just work. Your job is to make the routing defensible after the fact.

Do You Need Patient Authorization to Send Savella Records to Another Provider?

No. Under the HIPAA Privacy Rule, a covered entity may disclose protected health information to another health care provider for that provider's treatment activities without patient authorization. The authority is 45 CFR 164.506(c)(2). It covers sending a consult note back to the referring PCP, sending the chart forward to a specialist, and sending the prescription and clinical context to the dispensing pharmacy.

Three practical corollaries your staff should memorize:

  1. The minimum necessary standard does not apply to disclosures to a health care provider for treatment purposes (45 CFR 164.502(b)(2)(i)). Sending the full relevant record is permitted.
  2. Treatment disclosures are excluded from the accounting of disclosures a patient can request under 45 CFR 164.528. You still log them for your own operational tracking, but they are not accountable disclosures.
  3. Verification is still required. 45 CFR 164.514(h) obligates you to verify the identity and authority of the person requesting the disclosure. "A fax came in on letterhead" is not verification.

HHS publishes plain-language guidance on disclosures for treatment, payment, and health care operations that is worth printing and putting in your front-desk binder. Most of the friction in referral workflows comes from staff believing a signed release is required when it is not, and then delaying records while a patient chases down a signature.

Where scope discipline still matters

"Minimum necessary does not apply" is not the same as "send everything you have." If your release-of-information process defaults to exporting the complete longitudinal chart for every referral, you inflate the blast radius of every misrouted fax. Define a standard referral packet by specialty and let staff add to it deliberately. It's a risk-reduction move, not a legal requirement.

The Four Recipients Your Staff Will Confuse

Savella-related records tend to travel to four destinations, and only three of them follow the same rule. Train to the distinction.

1. Another treating provider

Permitted for treatment. No authorization. No minimum necessary limit. Verify the recipient, confirm the fax number or Direct address against your master directory, and document the send.

2. The health plan, for prior authorization

Permitted for payment. A covered entity may disclose PHI to another covered entity for that entity's payment activities under 45 CFR 164.506(c)(3). Here the minimum necessary standard does apply — send the clinical documentation the plan's criteria actually require, not the whole chart. If your prior authorization staff routinely attach a 60-page export because it is faster than curating, you have a minimum necessary problem waiting for a complaint.

Payer-side prior authorization timeframes have tightened under CMS interoperability policy, which means your documentation packets are being processed on shorter clocks. Build the intake so a clean packet goes out the first time.

3. The dispensing pharmacy

A pharmacy is a health care provider. Disclosure for dispensing is a treatment disclosure. Where practices get sloppy is with specialty pharmacy intake forms that request far more than the prescription — full demographics, insurance, household contacts, and sometimes a blanket consent that your staff sign on the patient's behalf. Never sign a patient-facing consent for a patient. Route those forms to the patient.

4. A manufacturer copay or patient support program

This one breaks the pattern. A pharmaceutical manufacturer running a copay assistance or patient support program is generally not a covered entity and is not receiving the information for treatment, payment, or your health care operations. Enrolling a patient by transmitting their PHI to that program requires a valid HIPAA authorization under 45 CFR 164.508 — signed by the patient, naming the recipient, describing the information, and carrying an expiration.

If your medical assistants are faxing enrollment forms for Savella support programs because "the rep left a stack of them," audit that this week. Confirm a signed authorization exists for each one, confirm the form used is your authorization form and not the manufacturer's marketing-adjacent version, and confirm the signed original lands in the chart.

Behavioral Health Overlays That Change the Answer

Chronic pain charts frequently carry behavioral health content, and two categories carry heavier protection than the rest of the record.

Psychotherapy notes. If a psychologist or therapist in your organization keeps process notes separated from the medical record, those notes require a specific authorization even for treatment disclosures (45 CFR 164.508(a)(2)). They should never be swept into a bulk referral export. Verify that your record system flags them as a separate document class and that your release-of-information queue cannot select them by default.

42 CFR Part 2 records. If any portion of the chart originated from a federally assisted substance use disorder program, Part 2 applies on top of HIPAA. The 2024 final rule aligning Part 2 more closely with HIPAA reached its compliance date in February 2026, and it permits a single patient consent covering treatment, payment, and operations — but it still requires that consent, and it still requires the recipient to honor redisclosure restrictions. If you receive Part 2 records into your chart, you inherit obligations. Know whether your intake process segregates them or merges them.

Every Vendor Standing in the Path Needs a Contract

Walk the path a Savella referral packet takes and count the third parties. A typical mid-size practice finds five or six:

  • Cloud fax service
  • Release-of-information or record-retrieval vendor
  • Health information exchange or interoperability network
  • Transcription or scribe service
  • Secure messaging or Direct messaging provider
  • Document scanning and shredding contractor

Each of these creates, receives, maintains, or transmits PHI on your behalf, and each needs a business associate agreement before the first packet moves. The exception people misapply is the conduit exception — it covers entities like the postal service or a telecom carrier that transport data without accessing it other than transiently. A cloud fax provider that stores your faxes in a web portal is not a conduit. It is a business associate.

If your vendor inventory is a spreadsheet somebody started in 2022 and nobody has reconciled against your accounts payable ledger, that is the gap. You can generate a signature-ready business associate agreement in a few minutes for the vendors you find missing one, but the harder work is the inventory itself — pull the AP ledger, circle every line item that touches patient data, and match it against your executed agreements.

Transmission Controls: The Fax Number Nobody Re-Verified

Misdirected faxes remain one of the most common small-practice breach categories, and referral traffic is where they happen. The pattern is always the same: a fax number entered once during a busy afternoon, saved to a directory, and reused for three years after the receiving office moved.

Concrete controls that work:

  1. Quarterly directory verification. Assign one staff member to call the top 25 referral destinations and confirm fax numbers and Direct addresses. Document the date of each verification.
  2. Cover sheet with a callback line. Standard, but only useful if someone answers the callback number.
  3. Two-person confirmation for any first-time destination. The second person reads the number back from the source document, not from the screen.
  4. Prefer structured exchange. Where the receiving practice supports Direct messaging or your HIE, use it. Fewer human keystrokes, fewer wrong numbers.
  5. Log every misdirect, including the ones you catch. Near-misses tell you where your directory is rotting.

Each of these controls maps to a Security Rule safeguard, and each belongs in your written risk analysis with an owner and a review date. If your current risk analysis is a PDF you inherited and cannot map to your actual referral workflow, tools that automate HIPAA risk analysis and generate the full policy set will get you to a document that reflects how records actually move through your practice — including the fax queue, the ROI vendor, and the HIE connection.

When the Patient Asks for the Records Instead

Referral traffic and patient access requests use different rules, and staff conflate them constantly.

Under 45 CFR 164.524, a patient has a right of access to their designated record set. You have 30 calendar days to act, with one permitted 30-day extension if you notify the patient in writing of the reason and the new date. Fees must be reasonable and cost-based; you cannot charge for search and retrieval time.

A patient may also direct you in writing to send a copy to a third party — a new specialist, an attorney, a family member. That direction must be signed, must clearly identify the recipient, and must state where to send it. HHS maintains detailed right of access guidance, and OCR's enforcement history on access requests is long enough that no practice should still be treating a records request as a low-priority task.

Set the clock at intake, not at fulfillment

The 30-day clock starts when the request is received by your organization — not when it reaches the person who processes it. If a request sits in a general voicemail for eleven days, you have eleven days left, not thirty. Date-stamp every request at the point of first contact and put it in a tracked queue with a named owner.

Information Blocking: Refusing to Share Has Its Own Penalty

Since the Cures Act rules took effect, declining to release electronic health information without a qualifying exception can constitute information blocking. Providers face disincentives under the framework finalized in 2024. The practical translation for referral workflow: "we don't release records until the patient comes in and signs something" is not a policy, it is a risk.

Review the eight exceptions on HealthIT.gov's information blocking resource and confirm your written policy names which exception applies in which scenario. If your staff are delaying releases for reasons that do not map to an exception, fix the policy before someone files a complaint.

A Referral Records Checklist You Can Hand to the Front Desk

  1. Identify the recipient category: treating provider, payer, pharmacy, or non-covered third party.
  2. Categories one through three: proceed without authorization. Category four: obtain a signed 164.508 authorization first.
  3. Verify the destination against the directory. First-time destination gets two-person confirmation.
  4. Screen the packet for psychotherapy notes and Part 2 material before export.
  5. For payer packets, curate to the plan's stated criteria. Minimum necessary applies.
  6. Transmit by the most structured channel the recipient supports.
  7. Log the send: date, recipient, contents, staff initials, channel.
  8. If the request came from the patient, date-stamp at first contact and start the 30-day clock.

Eight steps, and every one of them is auditable. That is the point — a referral workflow you can reconstruct six months later under an OCR inquiry is worth more than one that merely feels efficient on a Monday.

Start With the Inventory

Before your next policy review, do two things. Walk one Savella referral end to end and write down every system, vendor, and human that touched it. Then compare that list to your business associate agreements and your risk analysis. The gaps you find in that hour will be more useful than any generic template.

If the comparison shows a risk analysis that no longer describes your actual workflow, build a current one and the supporting document set before your next referral volume increase makes the gap harder to close.