Confidentiality

In general, patients are entitled to decide whether and to whom their personal health information is disclosed. However, specific consent is not required in all situations.

When disclosing patients’ personal health information, physicians should:

1. Restrict disclosure to the minimum necessary information; and
2. Notify the patient of the disclosure, when feasible.
   
   Physicians may disclose personal health information without the specific consent of the patient (or authorized surrogate when the patient lacks decision-making capacity):
3. To other health care personnel for purposes of providing care or for health care operations; or
4. To appropriate authorities when disclosure is required by law.
5. To other third parties situated to mitigate the threat when in the physician’s judgment there is a reasonable probability that:
   1. the patient will seriously harm him/herself;
   2. the patient will inflict serious physical harm on an identifiable individual or individuals.

For any other disclosures, physicians should obtain the consent of the patient (or authorized surrogate) before disclosing personal health information.