Under HIPAA, which disclosure does not require patient consent?

• A. Disclosures to the patient’s employer.
• B. Marketing communications.
• C. Disclosures for research without authorization.
• D. Disclosures for treatment, payment, and healthcare operations.

Answer: (D)

The key idea is that HIPAA allows certain uses and disclosures of protected health information without the patient’s explicit consent. Specifically, for activities that keep care moving and the healthcare system functioning, disclosures are permitted without needing the patient to sign a consent: for treating the patient, for obtaining or providing payment for care, and for healthcare operations such as quality improvement and administrative tasks. These “TPO” disclosures are meant to support ongoing care and the efficient operation of health care, so consent isn’t required in these situations.

Other options involve uses that do typically require patient authorization or are only allowed without consent under strict, limited conditions (like research with a waiver or marketing with authorization). That’s why disclosures for treatment, payment, and healthcare operations are the ones that do not require patient consent.