Undersea Medicine Referrals: HIPAA Considerations and Best Practices

HIPAA Privacy Rule and Treatment Referrals

Under the HIPAA Privacy Rule, covered health care providers may use and disclose Protected Health Information (PHI) for treatment without obtaining written authorization. A treatment referral from a dive clinic to a hyperbaric specialist, emergency department, or consulting physician falls within this core allowance.

The Minimum Necessary Requirement does not apply to disclosures for treatment. Even so, you should share only the information the receiving clinician needs to evaluate the diver, coordinate hyperbaric oxygen therapy, and manage risks such as decompression sickness, barotrauma, oxygen toxicity, or carbon monoxide exposure.

In most provider-to-provider referrals, the recipient is another covered entity rather than a business associate. That means a Business Associate Agreement is generally not required for the disclosure itself; however, vendors that transmit, store, or process PHI for you (e.g., eFax, cloud storage, telehealth platforms) do require one for Covered Entity Compliance.

Undersea-specific clinical elements commonly included

• Incident narrative, dive profiles, and dive computer downloads relevant to the presentation.
• Onset timeline, symptoms, and in-water or surface first aid provided (e.g., oxygen duration and flow).
• Chamber treatment logs, tables used, observed response, and any complications.
• Medical history that affects risk (recent infections, asthma, ENT issues, medications).
• Imaging, labs (e.g., COHb when CO exposure suspected), and fitness-to-dive considerations.

Minimum Necessary Standard in Referrals

The Minimum Necessary Requirement applies to uses and disclosures for payment and health care operations, and to many non-treatment purposes. It does not restrict disclosures for treatment between providers. Still, well-designed referral workflows help staff consistently send what is appropriate for the clinical question.

Practical ways to operationalize “minimum necessary”

• Use role-based access so staff can assemble referral packets without opening unrelated records.
• Standardize referral templates that preselect the data elements typically needed for hyperbaric consults.
• When the purpose is operations (e.g., quality review) or payment, tailor disclosures to the Minimum Necessary Requirement.
• Redact extraneous materials (e.g., unrelated specialty notes) when they do not support the referral’s clinical objective.

Examples

• Acute DCS referral: incident summary, neurologic exam, dive profiles, oxygen given, and chamber availability details.
• Fitness-to-dive consult: targeted problem list, medications, relevant imaging, prior barotrauma history, and exam findings.

Safeguards for PHI Transmission

PHI Transmission Security requires administrative, technical, and physical safeguards that match the risk environment—especially important for maritime, offshore, and expeditionary settings where connectivity is limited. Your goal is confidentiality, integrity, availability, and timely access for patient care.

Approved channels for sending referral packets

• EHR-to-EHR Direct secure messaging or a secure provider portal.
• Encrypted email (TLS end-to-end, with message-level encryption such as S/MIME or PGP when possible).
• SFTP or VPN to a secure folder controlled by the receiving facility.
• Fax with a cover sheet to a verified number when digital options are unavailable; confirm receipt by phone.
• Encrypted removable media or secure file-transfer links for large imaging studies when bandwidth is constrained.

Transmission hygiene and error prevention

• Verify the recipient’s identity, address, and role before sending; use test messages for new endpoints.
• Label packets clearly with patient identifiers and the clinical question; avoid mixing multiple patients in one transmission.
• Enable multifactor authentication and maintain audit logs for all ePHI transfers.
• Have a misdirected-PHI protocol: immediate notification, retrieval or deletion request, and incident assessment.

Remote and vessel operations

• Pre-stage encrypted referral kits (forms, checklists) on secured devices for offline use.
• Use store-and-forward with compression for imaging; synchronize via satellite links secured by VPN.
• Assign a privacy liaison on each vessel or site to oversee PHI handling and maintain chain-of-custody.

Patient Authorization Requirements

HIPAA allows most provider-to-provider treatment referrals without written authorization. You generally need Patient Authorization Forms when the disclosure is not for treatment, payment, or health care operations, or when other law requires additional consent. Common triggers include disclosures to an employer or dive operator for clearance, marketing uses, some research, and certain specially protected records under applicable federal or state law.

Essential elements of Patient Authorization Forms

• Specific description of the PHI to be disclosed and the purpose of the disclosure.
• Names (or classes) of the disclosing party and the recipient.
• Expiration date or event, the individual’s signature and date, and a copy for the patient.
• Statements about the right to revoke, potential for redisclosure, and whether treatment is conditioned on signing.
• Separate or heightened consent when required by law for particularly sensitive information.

For fitness-to-dive determinations sent to non-clinical parties (e.g., an employer, training agency, or vessel operator), obtain authorization that narrowly describes what will be shared and for what purpose.

Business Associate Agreements in Referral Processes

A Business Associate Agreement (BAA) is required with vendors that create, receive, maintain, or transmit PHI on your behalf. Examples in undersea medicine include telehealth platforms used to coordinate care with a hyperbaric center, image-hosting services, secure messaging tools, and eFax providers. Another provider acting in its role as a treating clinician is typically not your business associate.

Key BAA components to verify

• Permitted and required uses/disclosures of PHI, tied to your documented instructions.
• Administrative, technical, and physical safeguards aligned with HIPAA Security Rule requirements.
• Prompt breach and security-incident notifications, with defined timelines and cooperation duties.
• Subcontractor compliance, flow-down obligations, and right to audit or obtain attestations.
• Individual rights support (access, amendment, accounting) where applicable.
• Termination provisions, including return or destruction of PHI and ongoing protections if destruction is infeasible.

Referral Process Best Practices

Translate rules into a reliable playbook. Build a standard referral workflow that protects privacy, accelerates care, and produces clean documentation for audits and quality improvement.

Standard referral packet

• Cover page with patient identifiers, referring clinician, and the precise consult question.
• Incident and dive history, exam findings, vitals, and on-scene care (oxygen, fluids, medications).
• Relevant labs, imaging, and chamber treatment logs; avoid unrelated materials.
• Allergies, current medications, and key comorbidities that affect hyperbaric risk.
• Availability, transport status, and callback details for rapid clinical discussion.

Workflow and compliance controls

• Use checklists that map each data element to its purpose (supports Minimum Necessary Requirement).
• Maintain Referral Disclosure Documentation: what was sent, to whom, when, how (channel), and by whom; attach authorizations when used.
• Confirm receipt and close the loop with a documented read-back of the plan.
• Train staff on PHI Transmission Security, misdirected-PHI remediation, and device handling in remote environments.
• Perform periodic audits and mock drills; update contact directories and on-call rosters quarterly.

Criteria for Undersea Medicine Referral Networks

Choose partners who can deliver timely, secure, and evidence-based care. Evaluate both clinical capability and privacy posture before routinely sharing PHI.

Selection criteria

• Clinical depth: board-certified undersea/hyperbaric physicians, 24/7 consult coverage, and recompression capability.
• Operational readiness: defined intake pathways, rapid image review, and established escalation contacts.
• Security maturity: strong PHI Transmission Security controls, encryption, access management, and incident response.
• Compliance posture: clear policies for Covered Entity Compliance, completed BAAs with their vendors, and audit transparency.
• Coordination strength: telemedicine options, transport coordination, and reliable handoff communication.
• Patient-centered practices: education materials, timely follow-up, and clear return-to-dive guidance communicated to the treating team.

FAQs.

What HIPAA rules apply when referring undersea medicine patients?

Disclosures of PHI for treatment between health care providers are permitted under the HIPAA Privacy Rule without written authorization. The Minimum Necessary Requirement does not limit treatment disclosures, but you should still send only what the receiving clinician needs for safe, effective hyperbaric or dive-related care.

When is patient authorization required for medical referrals?

You generally need authorization when the disclosure is not for treatment, payment, or operations—such as sending fitness-to-dive determinations to an employer or dive operator, certain research disclosures, marketing uses, or when other federal or state laws impose stricter consent rules. Use narrowly scoped Patient Authorization Forms that specify what will be shared and for what purpose.

How should PHI be securely transmitted during referrals?

Use secure channels like EHR-to-EHR Direct messaging, encrypted email, secure portals, SFTP/VPN, or verified fax with a cover sheet. Apply multifactor authentication, keep audit logs, verify recipient details, and have a protocol for misdirected PHI. In remote or maritime environments, pre-stage encrypted referral kits and synchronize over secured satellite links.

What are the key elements of a Business Associate Agreement?

A solid Business Associate Agreement defines permitted uses, requires HIPAA-aligned safeguards, mandates timely breach notifications, flows obligations to subcontractors, supports individual rights where applicable, and sets termination and PHI return/destruction terms. Remember, another treating provider is typically not your business associate; vendors that handle PHI on your behalf are.