Can Doctors Talk About Patients to Other Doctors? HIPAA Rules

Yes. Doctors can talk about patients to other doctors when the conversation is for treatment, and under the federal HIPAA Privacy Rule they do not need your written permission to do it. A healthcare provider may share your protected health information with other providers involved in your care, and may also share it for billing and certain administrative functions. Outside those routine uses, stricter rules kick in, and some disclosures require your signed authorization.

Doctor-to-Doctor Sharing for Your Care

The HIPAA Privacy Rule gives providers broad permission to use or disclose your health information for treatment, payment, and healthcare operations without first getting your signed authorization.¹ This is the rule that makes coordinated care possible.

For treatment, your primary care doctor can send lab results to a specialist before your appointment. A surgeon can discuss your medication history with the anesthesiologist. An emergency room physician can call your regular doctor to ask about your history. A hospital can send your discharge summary to a rehab facility taking over your care. The regulation also allows a provider to disclose your information for another provider’s treatment activities, not only its own.¹

A point that surprises many patients: HIPAA does not require your provider to obtain your consent before sharing for treatment, payment, or operations. The regulation says a provider “may” seek consent, but it is optional.¹ The paperwork you sign at the front desk is usually an acknowledgment that you received the privacy notice, not a permission slip for records sharing.

Payment sharing covers the information your insurance company needs to process a claim. Operations sharing within an organization covers activities like quality improvement, training, compliance, and fraud detection. When two separate healthcare organizations want to share for operations, they can do so only if both have or had a relationship with you and only for specific activities such as quality assessment or fraud detection.¹

How Much They Can Share

HIPAA generally requires providers to share only the minimum amount of information needed for a given purpose, known as the minimum necessary standard.² There is an important exception: the minimum necessary standard does not apply when one provider shares information with another provider for treatment.³

When your doctor calls a specialist about your case, they can share the full picture. Forcing clinicians to guess which details might matter would compromise care. The minimum necessary rule still applies to disclosures for payment, operations, and most non-treatment purposes, so a hospital’s billing office should only access what it needs to submit a claim.²

What About Family and Friends

The rules for talking with your spouse, parent, or a friend are more nuanced than the rules between providers.

If you are present and able to make your own healthcare decisions, your provider can share information with a family member or friend if you agree, if you are given the chance to object and do not, or if the provider reasonably infers from the circumstances that you do not object. Only information directly relevant to that person’s involvement in your care or payment may be shared.⁴

If you are unconscious or otherwise unable to communicate, your provider can use professional judgment to decide whether sharing with family or friends is in your best interest, and the disclosure must be limited to what is directly relevant to their involvement or needed for notification.⁵ For someone who is not family or a close friend, the provider must be reasonably sure you previously asked that person to be involved in your care.⁴

If you want to make sure a specific person is never given information about you, tell your provider explicitly and ask that the restriction be noted in your records.

When Doctors Do Need Your Written Authorization

For a few categories, HIPAA flips the default and prohibits sharing unless you sign a specific written authorization.

Psychotherapy notes. If you see a therapist or psychiatrist, their private session notes documenting or analyzing conversation content, kept separate from your medical record, get heightened protection. With limited exceptions, a provider must get your written authorization before disclosing psychotherapy notes to anyone, including other doctors treating you. The originator can use them for your treatment, and a provider can use them for in-house training, but sharing them with an outside doctor requires your authorization.⁶
Marketing. Your provider cannot use your health information for marketing without your signed authorization, unless the communication is face-to-face or involves a promotional gift of nominal value. If a third party is paying for the marketing, the authorization form has to say so.⁶
Sale of your information. Any disclosure that amounts to a sale of your protected health information requires your written authorization, and the form must state that the disclosure will result in payment to the provider.⁶

Psychotherapy notes are different from the rest of your mental health record. Medication information, session dates and duration, diagnosis, treatment plans, and progress summaries are part of your regular medical record and can be shared under the standard treatment rules.⁷ Even psychotherapy notes can be disclosed without authorization for mandatory abuse reporting and situations involving serious, imminent threats.

Substance Use Disorder Records Are Different

If you receive treatment from a federally assisted substance use disorder program, such as an opioid treatment program or a facility receiving federal block grant funding, your records get an additional layer of protection under 42 U.S.C. § 290dd-2 and the regulations known as Part 2. These rules are stricter than standard HIPAA.

Part 2 generally requires your written consent before records can be disclosed, including to another treating doctor. Under changes that took effect in 2024, you can sign a single consent covering all future treatment, payment, and healthcare operations disclosures until you revoke it in writing.⁸ Without your consent, disclosure is only allowed in narrow circumstances: to medical personnel during a genuine medical emergency, to qualified personnel for research or audits, by a specific type of court order, or as de-identified information to a public health authority.

Your substance use disorder records generally cannot be used against you in any civil, criminal, administrative, or legislative proceeding without your consent or a Part 2 court order. A regular subpoena, search warrant, or law enforcement request is not enough to compel disclosure.⁸

Asking Your Doctor to Limit What They Share

You have the right to ask your provider to restrict how your information is used or disclosed for treatment, payment, or operations. In most cases the provider is not required to agree.⁹ If a provider does agree, they are bound by it.

One situation forces the provider’s hand. If you pay for an item or service entirely out of pocket and ask the provider not to disclose that information to your health plan, the provider must comply, as long as the disclosure is not otherwise required by law.⁹ If you want a visit or test kept off your insurance records, you can pay cash and instruct the provider not to bill your insurer or share the details with them.

Restriction requests do not apply to disclosures required by law, such as mandatory public health reporting, and you cannot restrict workers’ compensation disclosures required by workers’ compensation laws.¹⁰

If You Think Your Doctor Shared Something They Shouldn’t Have

You can file a complaint with the HHS Office for Civil Rights. Complaints can be submitted electronically through the OCR Complaint Portal or in writing, and you can file on your own behalf or on behalf of someone else.¹¹ The same process covers alleged violations of the Part 2 substance use disorder protections.

Filing is free and does not require a lawyer. OCR investigates complaints and can impose corrective action plans, financial penalties, or refer cases for criminal prosecution. If you believe a provider disclosed information they should not have, write down what was shared, when, and with whom. That record will strengthen your complaint.

1
eCFR. 45 CFR 164.506 – Uses and Disclosures to Carry Out Treatment, Payment, or Health Care Operations
2
eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information: General Rules
3
U.S. Department of Health and Human Services. Minimum Necessary Requirement
4
U.S. Department of Health and Human Services. Communicating With a Patient’s Family, Friends, or Others Involved in Care
5
eCFR. 45 CFR 164.510 – Uses and Disclosures Requiring an Opportunity for the Individual to Agree or to Object
6
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
7
U.S. Department of Health and Human Services. HIPAA Privacy Rule and Sharing Information Related to Mental Health
8
Office of the Law Revision Counsel. 42 USC 290dd-2 – Confidentiality of Records
9
eCFR. 45 CFR 164.522 – Rights to Request Privacy Protection for Protected Health Information
10
U.S. Department of Health and Human Services. Right to Request a Restriction
11
U.S. Department of Health and Human Services. Filing a Health Information Privacy Complaint