Under HIPAA, disclosure of patient information generally requires what?

• A. Patient consent or knowledge
• B. Public disclosure allowed without consent
• C. Patient consent only for financial records
• D. No consent ever required

Answer: (A)

Disclosures of protected health information (PHI) under HIPAA are not allowed to happen freely. The default is that a patient’s information can be disclosed only with the patient’s authorization or consent, unless a specific exception applies. This reflects the overarching goal of the Privacy Rule: to protect patient privacy while allowing necessary sharing for care, payment, and healthcare operations.

There are important exceptions where disclosures can occur without prior consent—for example for treatment, payment, and health care operations, or when required or allowed by law for public health reporting, safety disclosures, or certain other authorized purposes. But these are narrow, defined cases; outside of them, authorization is typically needed.

That’s why the option stating that disclosure generally requires patient consent or knowledge best fits the rule. The other choices overstate or misstate the access: public disclosure without consent is not allowed in general; consent is not limited to financial records only; and saying no consent is ever required ignores the many HIPAA-permitted disclosures without explicit individual authorization.