HIPAA Training for Care Transitions and Discharge Planning Coordinators

Care transitions involve sharing protected health information (PHI) so patients can move safely from one care setting to another. As a discharge planning coordinator, you need to understand when HIPAA permits that sharing, what safeguards still apply, and how to follow your organization’s policies.

HIPAA’s treatment, health care operations, and minimum necessary rules are distinct. The purpose of a disclosure matters: a handoff to a treating provider may follow different rules from sharing information for quality review or administrative coordination.

When can coordinators disclose PHI for treatment and care coordination?

HIPAA generally permits a covered entity to use or disclose PHI for treatment without obtaining the patient’s authorization. “Treatment” includes coordinating or managing health care, consultations between providers, and referrals from one provider to another. For example, a hospital may send a receiving nursing facility the patient’s care instructions to support the transition. See HHS guidance on treatment, payment, and health care operations disclosures.

A coordinator may handle PHI as part of the covered entity’s workforce when authorized under the organization’s policies and assigned role. Share information with the providers or other recipients involved in the patient’s care through approved channels, and follow any applicable state law, other federal privacy requirements, and organizational rules.

HIPAA permission is not the same as a requirement to disclose. Before sending PHI, confirm the recipient and purpose, check whether a patient restriction or other applicable condition affects the exchange, and follow your organization’s procedures. A patient’s authorization may still be needed for disclosures that fall outside a HIPAA permission or are subject to a special rule.

How do treatment disclosures differ from health care operations disclosures?

A treatment disclosure supports a patient’s care—for example, sending clinical information to a clinician who will provide follow-up care. By contrast, health care operations are certain administrative, financial, legal, and quality-related activities that support a covered entity’s work. The Privacy Rule includes case management and care coordination among health care operations, but the applicable conditions depend on whose operations the disclosure supports.

A covered entity may use or disclose PHI for its own health care operations as permitted by the Privacy Rule. When one covered entity discloses PHI for the recipient covered entity’s health care operations, specific conditions apply: each entity must have or have had a relationship with the patient, the information must pertain to that relationship, and the purpose must qualify under the rule. These disclosures are subject to the HHS guidance on care coordination and continuity of care.

Do not label a disclosure “treatment” or “operations” just because it relates generally to care coordination. Identify the actual purpose and recipient, then follow your organization’s procedures for confirming that the applicable HIPAA permission and conditions are met.

When does the minimum necessary standard apply to discharge planning?

The minimum necessary standard generally requires covered entities to take reasonable steps to limit PHI used, disclosed, or requested to what is needed for the purpose. However, it does not apply to disclosures to—or requests by—a health care provider for treatment purposes. Therefore, the standard generally does not restrict a provider-to-provider treatment disclosure simply because the handoff includes information needed to support care. See HHS guidance on the minimum necessary requirement.

The exception is purpose-specific. If the disclosure is for health care operations, payment, or another purpose to which the standard applies, the covered entity must use its policies and procedures to determine what PHI is reasonably necessary. A coordinator should not assume that every discharge-related exchange is exempt just because it occurs during a transition of care.

Even when the minimum necessary standard does not apply to a provider’s treatment disclosure, role-based access policies and other privacy and security safeguards still matter. Access PHI only as authorized for your work, use approved systems, and follow your organization’s rules for handling information.

How can discharge plans reflect patient care goals and treatment preferences?

HIPAA sets rules for protecting and sharing PHI; it does not replace discharge-planning requirements. For hospitals subject to the federal hospital discharge-planning regulation, the process must focus on the patient’s goals and treatment preferences, include the patient and caregivers or support persons as active partners, and support an effective transition. The hospital must also transmit necessary medical information, including information about the current course of illness and treatment and post-discharge goals and preferences, to appropriate providers responsible for follow-up care. See 42 CFR § 482.43.

In practice, ask the patient about their goals, preferences, and desired support-person involvement, and document information according to your organization’s procedures. When sharing information with a family member or another person involved in care, apply the Privacy Rule’s requirements for those disclosures; do not treat the person’s involvement as automatic permission to share an entire record. HHS explains that disclosures to people involved in a patient’s care are generally limited to information directly relevant to that involvement. See HHS guidance on communicating with family, friends, and others involved in care.

What privacy safeguards apply to referrals and post-discharge follow-up?

Before a referral or follow-up exchange, verify the recipient and confirm the purpose. Use the contact details and communication methods approved by your organization, and check that information is being sent to the intended provider or service. When a disclosure is permitted for treatment, avoid unnecessary barriers to the handoff while still protecting PHI against accidental or unauthorized exposure.

For calls or messages to patients, follow the patient’s communication preferences and organizational procedures for identity verification, voicemail, text, and other channels. HIPAA provides individuals with a right to request reasonable confidential communications, such as contact at an alternative location or by an alternative means. See HHS guidance on confidential communications and permitted disclosures.

Use approved systems and safeguards for electronic PHI, including authorized access, appropriate transmission security, and procedures for recognizing and responding to security incidents. The HIPAA Security Rule requires regulated entities to implement reasonable and appropriate administrative, physical, and technical safeguards for electronic PHI; HHS summarizes these requirements in its HIPAA Security Rule guidance.

How should coordinators document and securely handle PHI?

Record discharge-planning and transition information in the approved record system, following your organization’s documentation policies. Where relevant to your role and workflow, document the referral or handoff, the recipient and purpose, patient preferences or restrictions, and any follow-up needed. HIPAA does not prescribe one universal note format for every care transition, so use your organization’s requirements and applicable regulations.

Protect PHI in all forms. Keep paper records and devices secure, limit access to authorized users, use approved channels to transmit information, and avoid discussing patient details where others can overhear. For electronic systems, do not share credentials or bypass access controls. HHS describes requirements for workforce access, security training, audit controls, and transmission safeguards in its summary of the HIPAA Security Rule.

If information is misdirected, lost, or accessed in a way that may violate policy, promptly follow your organization’s incident-reporting process. Do not try to conceal or independently resolve a suspected privacy or security incident; timely reporting helps the organization assess and respond under its procedures.

What are the limits of HIPAA-permitted care coordination disclosures?

HIPAA’s permissions are not blanket permission to share PHI with anyone who requests it. The disclosure must fit a permitted purpose and satisfy any applicable conditions. For health care operations disclosures to another covered entity, for example, the covered-entity relationship requirements and minimum necessary standard may apply.

Other rules can impose additional limits. Psychotherapy notes receive special protection: with limited exceptions, an individual’s authorization is generally required before those notes are disclosed, including for many treatment-related disclosures. See HHS guidance on psychotherapy notes.

Patients may also request restrictions on certain uses or disclosures, and a covered entity must comply with restrictions it has agreed to. State law or other federal requirements may provide additional protections. When a request does not fit a clear permission, involves sensitive information, or conflicts with patient preferences or organizational policy, pause and consult your supervisor, privacy officer, or compliance team.

For a safe discharge transition of care, identify the purpose of each exchange, involve the patient in planning, share PHI through approved channels, and follow the safeguards and policies that apply to your role.

FAQs

Can providers share PHI for treatment without patient authorization?

Generally, yes. HIPAA permits covered entities to disclose PHI for treatment without the patient’s authorization, including for provider consultations, referrals, and coordination of care. Other laws, patient restrictions, or special protections may affect a particular disclosure, so follow your organization’s procedures. See HHS treatment-disclosure guidance.

Does the minimum necessary standard apply to treatment disclosures?

Not to disclosures to, or requests by, a health care provider for treatment purposes. The standard generally applies to uses and disclosures for other purposes, such as health care operations, when no exception applies. See HHS minimum necessary guidance.

When may care coordination qualify as a health care operation?

Case management and care coordination are included in the Privacy Rule’s definition of health care operations. A disclosure for another covered entity’s operations must also meet applicable conditions, including that each entity has or had a relationship with the patient and that the PHI pertains to that relationship. These disclosures are subject to the minimum necessary standard. See HHS guidance on care coordination and continuity of care.

What privacy practices should coordinators follow during discharge follow-up?

Verify the recipient and purpose, use approved communication channels, follow the patient’s communication preferences and your organization’s identity-verification procedures, and access or share only as authorized for your role. Secure paper records and devices, protect electronic PHI during transmission, and promptly report suspected privacy or security incidents according to organizational policy.