Privacy Rule

• According to HIPAA's Privacy Rule, a covered entity must obtain written authorization from a patient, consenting to have their medical information disclosed for purposes beyond the scope of treatment or billing. If the patient does not give their consent or authorization, the covered entity must not disclose health information.
  
  

Minimum Necessary

• The concept of "Minimum Necessary" is integral to HIPAA disclosure standards. Minimum necessary means that when patient health care information is being disclosed, covered entities should disclose only the minimum amount of information necessary to fulfill the need. Providing too much information on a patient becomes unnecessary and is not in the patient's best interest.
  
  

Exceptions

• Exceptions exist for times when it is not necessary to obtain patient authorization to disclose their health information. For instance, health care information can be subpoenaed by a judge and the covered entity does not need the patient's authorization to disclose it to the courts.