Q&A: Obtaining consent for disclosure of medical records

Q. Does a hospital need to obtain the patient's written consent before obtaining physician office notes? Can I contact the physician office and request the needed information without obtaining a written consent from the patient? The office notes are needed for payment purposes.

A. HIPAA permits covered entities (CE) to share PHI for treatment, payment, and healthcare operations without the patient’s authorization or consent. You may contact the physician’s office and request copies of the notes you need for payment purposes without submitting written authorization from the patient. You should limit your request to the minimum amount of information needed.