HIPAA: what you may disclose without authorization, and the minimum necessary rule

The CCMA does not ask you to recite HIPAA. It hands you a caller, a fax, a subpoena, or an answering machine and asks what is allowed to leave the office. Nearly every miss comes from one of two overcorrections: releasing to someone who sounds entitled to the information, or refusing a release the Privacy Rule actually permits. Learn the permitted disclosures as a short list, because everything not on it needs a signed authorization.

Treatment, payment, operations	No authorization needed (45 CFR 164.506) — but you must still verify the identity AND the authority of a requester you do not know (45 CFR 164.514(h))
Minimum necessary	Limit every use, disclosure and request to the least PHI needed for the purpose (45 CFR 164.502(b))
Where minimum necessary does NOT apply	Provider-to-provider for treatment, disclosure to the patient, anything under a signed authorization, disclosures required by other law, and reporting to HHS for compliance
Family members	Spouse, adult child or parent is not authorization. 45 CFR 164.510(b) permits only information directly relevant to that person's involvement in the care, with the patient's agreement — a full release needs authorization or personal-representative status
Public health reporting	A notifiable disease such as active TB goes to the state or local health department without authorization (45 CFR 164.512(b)). The health department, not your office, transmits it to CDC, and the patient's objection does not suspend the report
Subpoena signed by an attorney	Not a court order. Release requires satisfactory assurances — notice to the patient with a chance to object, or a qualified protective order (45 CFR 164.512(e)). Route it to the provider or privacy officer
Breach notice to individuals	Without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.404); 500+ residents of a state also triggers prominent media notice and notice to HHS within the same 60 days
Right of access	Act on the request within 30 days, with one 30-day extension (45 CFR 164.524). An unpaid balance is never a reason to withhold — that is also information blocking under 45 CFR Part 171
Voicemail and answering machines	Permitted: practice name, callback number, request to call. Not permitted: test results, the specialist's name, the reason for a referral
Disposal	Shred, burn or pulp so PHI cannot be read or reconstructed (45 CFR 164.530(c)). A recycling bin is a reportable breach

Where the point is lost: Two numbers get swapped constantly: 60 calendar days is breach notification to individuals, 30 days is acting on a right-of-access request. And identity is not authority — a caller who correctly recites the patient's date of birth has proved who he is, not that he is entitled to anything. Verification and authorization are two separate gates, and a question that offers you "ask for the date of birth first" is testing exactly that.