HIPAA Training for Inpatient Rehabilitation Admissions Liaisons

As an inpatient rehabilitation admissions liaison, you help move referral information between care teams so they can assess and coordinate a patient’s care. Your workflow may involve protected health information (PHI), so you need to understand when HIPAA permits disclosures, how to confirm recipients, and how to follow your organization’s safeguards and reporting procedures.

What HIPAA requires when sharing referrals with prospective rehabilitation facilities

The HIPAA Privacy Rule generally permits a covered health care provider to disclose PHI to another provider for treatment without obtaining the patient’s HIPAA authorization. Treatment includes coordinating or managing health care. A referral sent to a prospective inpatient rehabilitation facility for clinical evaluation or care planning may qualify when the disclosure is genuinely for treatment. The receiving provider and purpose matter; do not assume every transfer of referral information is a treatment disclosure. See HHS guidance on treatment, payment, and health care operations disclosures.

Follow your employer’s referral procedures, access controls, and any applicable state or other federal privacy requirements. Confirm that the request and intended use are consistent with the patient’s care, and check for any patient-requested restrictions your organization has agreed to honor. HIPAA permits treatment disclosures without authorization; it does not require you to send information through an unapproved channel or to a recipient whose identity or authority is uncertain.

Which patient information is relevant to anticipated inpatient rehabilitation treatment

HIPAA does not prescribe a single referral packet or universal list of documents for inpatient rehabilitation admissions. Your organization’s clinical workflow and the receiving facility’s legitimate care needs help determine what to send. A practical referral may include the patient’s identifying and contact information, the reason for referral, relevant diagnoses and medical history, the acute-care course, current functional abilities, therapy evaluations, medications and allergies, precautions, anticipated rehabilitation goals, and outstanding clinical needs.

Include information that helps the receiving team evaluate or coordinate care, and follow your organization’s process for any administrative or payment-related documents. Use approved forms and workflows, and ask a clinician or supervisor when you are unsure whether a record belongs in the referral. Even when the minimum necessary standard does not apply to a provider-to-provider treatment disclosure, thoughtful, accurate referral preparation supports safer care coordination.

When the minimum necessary standard applies to admissions liaison workflows

The minimum necessary standard generally requires covered entities to make reasonable efforts to limit PHI used, disclosed, or requested to what is needed for the intended purpose. However, HIPAA expressly excludes disclosures to, or requests by, a health care provider for treatment from this standard. That means a qualifying provider-to-provider treatment referral is not subject to the minimum necessary rule. HHS minimum necessary guidance explains both the treatment exception and situations where the standard does apply.

The exception depends on the disclosure’s purpose and the parties involved—not simply on your job title or the fact that a document is called a referral. For example, some internal access, payment, or health care operations activities may still be subject to minimum necessary policies. Follow role-based access rules and your organization’s procedures for workflows that are not provider-to-provider treatment disclosures.

When patient authorization is required for disclosures

For a disclosure by a covered provider to another provider for treatment, HIPAA authorization is generally not required. A separate consent may be part of an organization’s own process, but that does not make authorization a universal HIPAA condition for treatment disclosures. HHS’s HIPAA Privacy Rule summary describes treatment disclosures and the circumstances in which written authorization is generally required.

Authorization may be necessary when a disclosure is not otherwise permitted by the Privacy Rule—for example, when information is requested for a purpose that is not treatment, payment, or health care operations and no other permission applies. Other federal or state laws, or a restriction the organization has agreed to honor, may also affect a particular referral. If you cannot confirm that a disclosure is permitted, pause and contact your privacy officer or supervisor rather than assuming that a signed form is—or is not—needed.

How to securely transmit referral records and verify recipients

Use the referral portal, health information exchange, encrypted email, fax, or other channel approved by your organization. HIPAA does not ban electronic treatment communications, including email, but covered entities must apply reasonable safeguards and meet applicable Security Rule requirements. HHS guidance on safeguards for electronic health information exchange discusses electronic sharing for treatment and the need for appropriate protections.

Before sending, check the recipient’s name, facility, destination address or fax number, and the patient identifiers against your approved directory or referral workflow. When the recipient or their authority is not known, HIPAA requires the covered entity to verify identity and authority as applicable. A call to a known, verified facility number can help resolve uncertainty; do not rely on an unfamiliar contact detail in an unexpected message. See HHS guidance on verifying identity and authority.

Use safeguards appropriate to the method: review attachments and recipient fields before sending, use secure access controls, avoid public or shared devices for PHI, and follow your organization’s rules for printing, storing, and disposing of referral records. When faxing to a number not regularly used, confirm it with the intended recipient; HHS identifies this as an example of a reasonable safeguard. HHS guidance on sharing information by fax, email, or phone explains that safeguards depend on the communication method.

What safeguards and incident reporting procedures admissions liaisons must follow

Use only the PHI needed for your assigned duties, protect login credentials, lock screens and paper files, and follow your employer’s policies for remote work, printing, messaging, and record disposal. The HIPAA Security Rule requires appropriate safeguards for electronic PHI, security awareness and training for workforce members, and procedures to identify, respond to, mitigate, and document security incidents. See HHS’s summary of the HIPAA Security Rule.

Report suspected privacy or security incidents, such as a misdirected referral, lost device, unauthorized access, or suspicious email, promptly through your organization’s reporting process. Share the facts—such as what information was involved, when it happened, who may have received it, and what steps you took—without delaying the report while you investigate. Follow instructions from your privacy or security team to help contain the incident and preserve relevant records. The organization, not an individual liaison acting alone, assesses whether an event is a reportable breach and handles required notifications under the HIPAA Breach Notification Rule.

HIPAA workforce training must be appropriate to your duties and your employer’s policies; training should help you carry out your referral responsibilities safely. A training completion certificate documents that a course was completed, but it does not by itself establish that an organization is HIPAA compliant. Follow employer-specific training and policy requirements, and do not assume that federal HIPAA rules universally require an annual certificate renewal. HHS guidance on Privacy Rule requirements explains that workforce training is tailored to the organization and employees’ functions.

In practice, safe referral work means confirming that the disclosure supports care, following the correct authorization and minimum necessary rules for the specific workflow, verifying recipients, using approved transmission safeguards, and promptly reporting concerns. Apply your organization’s HIPAA workforce training and procedures to each referral.

FAQs

Do admissions liaisons need patient authorization to send a rehabilitation referral?

Generally, no, when a covered provider discloses PHI to another health care provider for treatment, such as evaluating or coordinating a rehabilitation referral. Other laws, patient restrictions, or the specific purpose of a disclosure may change the answer, so follow your organization’s process when the circumstances are unclear.

Does the minimum necessary standard apply to provider-to-provider treatment disclosures?

No. HIPAA exempts disclosures to, and requests by, a health care provider for treatment from the minimum necessary standard. Other liaison workflows—such as certain payment or internal operations activities—may still be subject to the standard and your organization’s policies.

What information should an inpatient rehabilitation referral include?

There is no single HIPAA-mandated referral packet. Follow your organization’s approved process and include information relevant to the receiving team’s clinical evaluation and care coordination, such as pertinent diagnoses, medical and functional status, therapy assessments, medications, allergies, precautions, and outstanding needs.

How should an admissions liaison report a suspected PHI disclosure incident?

Promptly notify your supervisor or the privacy or security contact identified in your organization’s procedures. Provide the known facts and follow instructions to contain the issue and preserve relevant records. Do not wait to decide whether the incident meets the legal definition of a breach; the organization’s designated team evaluates the event and any notification obligations.