Under HIPAA, which disclosures may occur without patient authorization?

• A. Disclosures for treatment, payment, health care operations, and when required by law or for public health reporting.
• B. Privacy notices are optional.
• C. Any purpose as long as staff know.
• D. Only physicians may disclose PHI.

Answer: (A)

Under HIPAA, there are specific PHI disclosures that don’t require patient authorization because they support essential health care processes and legal obligations. The main situations are for treatment, payment, and health care operations, plus disclosures required by law or for public health reporting. These categories are intentionally permitted so providers can coordinate care, bill for services, and comply with public health or legal requirements without needing a separate patient authorization each time.

That’s why the option listing those exact categories is the best answer. Privacy notices themselves are not disclosures; they’re information provided to patients about how their data is used. And disclosures beyond these allowed purposes aren’t permitted without authorization. Also, it isn’t limited to physicians—any member of the covered entity’s workforce may disclose PHI when the disclosure falls within these permitted categories.