Under HIPAA, patient information can be shared only with those directly involved in care unless what condition is met?

• A. The patient refuses
• B. The patient signs a blanket consent
• C. The information is already public
• D. Official consent

Answer: (D)

Under HIPAA, information can be shared with people directly involved in a patient’s care without written permission because the Privacy Rule allows treatment, payment, and health care operations to proceed. The situation that changes this is when the patient provides official consent—written authorization that specifies who may receive the information and for what purpose. That written authorization is what lets disclosures occur beyond the care team.

If the patient refuses, or if the information is already public, or if a blanket consent is used, these scenarios don’t automatically authorize broader sharing. The key point is that written, specific authorization (official consent) is needed for disclosures outside those directly involved in care.