At 1:07 a.m. a patient types how to make tonsil stones fall out into a search bar. At 8:40 a.m. that same patient is on hold with your front desk. By Thursday, three organizations hold a piece of the record: your primary care practice, the ENT group you referred to, and whatever imaging or lab site sat in the middle. This post is about that trail — who may send what to whom without an authorization, what belongs in the referral packet, which clocks start, and where your staff most often break the chain. It is an administrative post for the people who run the practice, not clinical guidance.

Three Handoffs Hide Inside One Routine Referral

Symptom-driven calls about throat complaints are ordinary volume. The administrative shape is predictable: a triage note, a visit, a referral to otolaryngology, and results flowing back. Each of those steps is a disclosure or a use, and each has an owner in your practice.

Handoff one — intake. Whoever answers the phone creates the first PHI record of the encounter. A patient who describes what they read online and asks about how to make tonsil stones fall out has now generated a documented complaint. If your scheduler types that into a free-text field that syncs to an appointment-reminder vendor, you have a downstream disclosure you did not plan.

Handoff two — the outbound referral. Your clinician sends demographics, insurance, the visit note, relevant history, and a reason for referral to the specialist. Provider-to-provider, for treatment.

Handoff three — the return. The consult note, procedure report, and any follow-up instructions come back. This handoff is the one that fails most often, because nobody in either office is explicitly assigned to close the loop.

Assign names, not roles-in-theory. Referral coordinator owns outbound. Records staff owns inbound reconciliation. A supervisor reviews open referrals weekly.

Does a Referral for Tonsil Stones Need a Signed Authorization?

No. Under the HIPAA Privacy Rule, a covered entity may disclose protected health information to another covered entity for that entity's treatment activities without patient authorization. A primary care practice sending a chart to an ENT group for evaluation is a treatment disclosure. The same applies to the specialist sending the consult note back.

HHS is explicit on this point in its guidance on permitted uses and disclosures. What you still need: verification of the recipient's identity and authority, a secure transmission channel, an accurate address or endpoint, and a Notice of Privacy Practices that describes treatment disclosures.

What you do not need: a signed release form, a fax cover sheet with a magic disclaimer, or an authorization on file. Practices that demand authorizations for routine treatment referrals slow care and, in some fact patterns, create an information blocking exposure.

Minimum Necessary Does Not Apply Here

The minimum necessary standard has a carve-out for disclosures to or requests by a health care provider for treatment. HHS states this directly in its minimum necessary guidance. The treating specialist decides what is clinically relevant, not your records clerk.

That is a permission, not an instruction to dump the entire longitudinal chart into a fax queue. Two practical limits still bite: sensitive category records governed by state law or 42 CFR Part 2 may require separate handling, and a 900-page PDF buries the referral question. Set an internal packet standard and let clinicians override it.

What Belongs in the Outbound Referral Packet

Write this down as a one-page standard and post it where the referral coordinator works. A defensible default packet for an outpatient specialty referral:

  • Patient demographics and current insurance
  • Reason for referral, in the referring clinician's words
  • The relevant office visit note
  • Active problem list, medication list, allergies
  • Results directly related to the referral question
  • Referring clinician name, direct callback number, and secure endpoint for the return note

What does not belong by default: unrelated specialty notes, behavioral health records that carry heightened protection, billing collection correspondence, and scanned identity documents. If the specialist wants more, they can request it — and that request is itself a permitted treatment request.

Timing standard: routine referrals go out within two business days of the order. Urgent referrals go out same day and get a phone confirmation. Log both.

The Channel Problem: Fax, Direct, Portal, HIE

The disclosure is permitted. The channel is where practices get hurt. Every route carries a distinct control set and a distinct failure mode.

Fax

Still the default in specialty referral for a lot of the country. The recurring failure is the misdirected fax — a transposed digit sending a chart to a hardware store. Maintain a verified fax directory owned by one person, require callback confirmation for new numbers, and treat every misdirect as a potential breach requiring risk assessment, not an "oops." If you use a cloud fax service, that vendor is a business associate and needs a signed agreement.

Direct secure messaging and EHR-to-EHR

Better audit trail, better addressing, fewer wrong-recipient events. The administrative work is endpoint hygiene: stale Direct addresses for clinicians who left the specialty group are a real and boring source of failed handoffs.

Health information exchanges and networks

Participation agreements often govern more than HIPAA does. Read what your HIE agreement says about downstream redisclosure, patient opt-out mechanics, and how your practice is notified of a participant-side incident.

Portal and email

Patients may ask you to email their records to themselves in the clear after being warned of the risk — that is their right. Emailing a specialist's front desk from a personal account is a different animal. Set the rule: no PHI leaves the practice through unmanaged email.

Every one of these channels sits on top of a vendor, and every vendor that creates, receives, maintains, or transmits PHI on your behalf needs a signed business associate agreement before the first transmission. If your vendor inventory has gaps — and most inventories built more than eighteen months ago do — you can generate a signature-ready business associate agreement rather than recycling a PDF someone downloaded in 2019.

When the Patient Skips You and Calls the Specialist

A meaningful share of throat-complaint traffic self-refers. The patient reads about how to make tonsil stones fall out, books directly with an ENT group, and then calls your office asking you to send their chart. That request is not a treatment disclosure. It is an individual access request, and different rules apply.

Under the right of access, you must act within 30 calendar days, with one 30-day extension available if you notify the patient in writing of the reason and the new date. Fees are limited to a reasonable, cost-based amount. HHS maintains detailed individual right of access guidance, and access failures have been the most consistently enforced category on the OCR docket for years — you can review resolved matters on the OCR portal.

Two Different Clocks, One Front Desk

Train staff to sort the request at the moment it arrives:

  1. Specialist's office calls asking for records to treat the patient. Treatment disclosure. Verify the caller, send the packet, no authorization, no 30-day clock — send it promptly because the patient is waiting.
  2. Patient asks you to send their records to a third party. Patient-directed disclosure under the access right. Requires a written, signed direction identifying the recipient. 30-day clock applies.
  3. Patient asks for their own copy. Access request. 30-day clock, cost-based fee only, format of their choosing where readily producible.

Misrouting category one into your release-of-information queue is the single most common way a two-day handoff becomes a three-week delay.

Sitting on the Request Is Its Own Risk

The information blocking rules under the 21st Century Cures Act reach practices that unreasonably interfere with access, exchange, or use of electronic health information. HHS finalized disincentives for providers found to have committed information blocking, and "we require a signed release for every outbound record, no exceptions" is exactly the kind of policy that draws attention. The information blocking overview lays out the exceptions, including the Privacy Exception and the Infeasibility Exception.

Practical translation for your policy binder: if you decline or delay a request, document which exception you are relying on and why. An undocumented refusal is indistinguishable from obstruction.

Logging: Treatment Disclosures Are Excluded, Log Them Anyway

An accounting of disclosures must cover six years back, but treatment, payment, and health care operations disclosures are excluded from that accounting. So no, you do not have to log every referral packet to satisfy 164.528.

Log them anyway. When a patient calls in eight months asking who sent what to which ENT group, or when a misdirected fax surfaces, the referral log is the artifact that resolves the question in ten minutes instead of two days. Fields: date, patient, sending staff member, recipient organization and endpoint, packet contents, transmission confirmation.

A Worked Timeline

Monday 8:40 a.m. — Patient calls describing symptoms after searching how to make tonsil stones fall out. Scheduler books Wednesday and enters a neutral chief complaint. No clinical opinion typed into the scheduling field.

Wednesday — Visit occurs. Clinician places an ENT referral order and specifies the referral question.

Thursday — Referral coordinator assembles the standard packet, verifies the ENT group's endpoint against the maintained directory, transmits, logs, and sets a 14-day tickler for the return note.

Friday — ENT front desk calls requesting one additional prior result. Verified caller, treatment request, sent same day, logged.

Two weeks later — No consult note received. Tickler fires. Coordinator calls, obtains the note, reconciles it into the chart, closes the referral.

Five steps, one owner each, three log entries. That is the entire compliance content of a routine specialty referral.

Where This Breaks in Real Offices

  • Portal message sent to the wrong patient record because two patients share a surname. Require date-of-birth confirmation before sending any portal message containing clinical content.
  • Stale fax directory. One owner, quarterly verification, no exceptions for "the number we've always used."
  • Referral coordinator on vacation. Named backup, documented, with the same system access.
  • Specialist requests "the whole chart" reflexively. Permitted, but ask the referral question first — it usually narrows the packet and speeds the read.
  • No BAA with the fax or messaging vendor. Check before the next transmission, not after the next incident.

Most of these are policy and documentation gaps rather than technology gaps. If your written policies, risk analysis, and vendor documentation have not been refreshed since the last time your referral volume changed, you can automate the risk analysis and the full compliance document set instead of rebuilding it from templates each year. Note that no vendor, including any compliance platform, issues a government-recognized HIPAA certification — HHS does not certify or endorse compliance products.

Your Next Two Hours

Pull your last twenty outbound referrals. Check three things: was the packet consistent, was the channel one you have a signed BAA for, and did the consult note come back. Whatever fails is your workflow project for this quarter. Then get the referral standard on paper and put a name next to each step — that single page prevents more disclosure problems than any amount of annual training.