6.4 HIPAA, EMTALA, and Federal Patient-Protection Rules
Key Takeaways
HIPAA lets a hospital disclose protected health information to another provider for treatment and care coordination, including post-acute referrals, without the patient's written authorization (45 CFR § 164.506).
Family or friends involved in care may receive information relevant to that involvement if a capable patient agrees or does not object, or, if the patient is incapacitated, when staff judge it to be in the patient's best interest (45 CFR § 164.510(b)).
The minimum necessary standard applies to payment and operations disclosures such as utilization review with payers, but not to disclosures to other providers for treatment.
EMTALA requires a medical screening examination for anyone who comes to a Medicare-participating hospital's emergency department requesting care and, if an emergency medical condition exists, stabilizing treatment or an appropriate transfer.
An appropriate EMTALA transfer of an unstable patient needs a physician certification or the patient's written request, a receiving hospital that has accepted the patient, records sent with the patient, and qualified transport staff and equipment.
HIPAA, EMTALA, and Federal Patient-Protection Rules
Task 2E of the ACM outline asks case managers to apply regulatory compliance to practice and names HIPAA, CMS, and EMTALA. CMS rules on status, notices, and discharge planning appear throughout this guide. This section covers the privacy and emergency-care laws that shape what a case manager may say, send, and do, especially in the emergency department and at discharge.
HIPAA Privacy Rule Basics
The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR Part 164, Subpart E) governs how covered entities, including most hospitals and health plans, use and disclose protected health information (PHI). Case managers move PHI all day: to post-acute providers, payers, community agencies, and families. The rule is more permissive for care coordination than many clinicians assume, and stricter in a few places that commonly cause errors.
| Disclosure | Written authorization needed? | Key condition |
|---|---|---|
| To a SNF, home health agency, equipment supplier, or another hospital for treatment | No (45 CFR § 164.506) | Treatment includes care coordination and referral; the minimum necessary standard does not apply to provider-to-provider treatment disclosures. |
| To a health plan for payment (prior authorization, concurrent review) | No | Limit the information to the minimum necessary for the purpose. |
| To family or friends involved in care | No, within limits (45 CFR § 164.510(b)) | If the patient is present and capable, share when the patient agrees, does not object after being given the chance, or you can reasonably infer no objection. If the patient is incapacitated or absent, share only what is relevant to the person's involvement and in the patient's best interest. |
| To a personal representative (health care agent acting under a DPOA-HC, or a guardian) | No | Treat the representative as the patient for matters within their authority. |
| To Adult Protective Services about suspected abuse or neglect | No, when required or permitted by law (45 CFR § 164.512(c)) | Promptly tell the patient that a report was made unless that would put the patient at risk or the person to be told is the suspected abuser. |
| To a community organization that is not a health care provider (for example, a housing program) | Usually yes, unless another exception applies | Many closed-loop referral platforms rely on documented patient consent. |
| Records from a 42 CFR Part 2 substance use disorder treatment program | Stricter rules | Most disclosures need patient consent. The 2024 Part 2 final rule (compliance date February 16, 2026) allows a single consent for treatment, payment, and health care operations and aligns penalties and breach notification with HIPAA. |
Practical Rules for Case Managers
- Verify identity and authority before sharing information with, or taking direction from, someone who calls or visits. Is this person the patient's agent, a guardian, or a relative with no legal authority? (See Chapter 4.)
- Psychotherapy notes, meaning a mental health professional's separately kept session notes, require a specific authorization; ordinary mental health information in the record does not carry this extra protection.
- Right of access: Patients may obtain copies of their records; the covered entity must act on a request within 30 days, with one 30-day extension allowed.
- Incidental disclosures that happen despite reasonable safeguards (such as a quiet bedside conversation overheard) are not violations. Discussing a patient in a hallway or posting about a patient online is. The ACM Code of Conduct separately bars certificants from posting anything that could identify a patient.
EMTALA: Screening, Stabilization, and Transfer
The Emergency Medical Treatment and Labor Act (EMTALA) (42 U.S.C. § 1395dd; 42 CFR § 489.24) applies to every Medicare-participating hospital with a dedicated emergency department. It was enacted to stop hospitals from refusing or "dumping" patients who cannot pay.
The Three Core Duties
- Medical screening examination (MSE): Anyone who comes to the emergency department and requests examination or treatment must receive an appropriate screening examination, within the hospital's capability, to determine whether an emergency medical condition exists. Screening may not be delayed to ask about insurance or method of payment.
- Stabilization: If an emergency medical condition exists, the hospital must provide treatment to stabilize it within its capability, or arrange an appropriate transfer.
- Appropriate transfer: An unstable patient may be transferred only if the patient, informed of the risks, requests transfer in writing, or a physician certifies that the expected benefits outweigh the risks. The receiving hospital must have space and qualified staff and must agree to accept the patient. The sending hospital treats to minimize the risks, sends available medical records, and uses qualified personnel and equipment for transport. Hospitals with specialized capabilities, such as burn units or neonatal intensive care, may not refuse an appropriate transfer when they have capacity.
Where EMTALA Meets Case Management
- Payer checks: A hospital may not seek authorization from the patient's insurer for screening or stabilizing services until it has provided the screening examination and begun any needed stabilizing treatment. Registration may continue as long as it does not delay care, and case managers can notify the plan in parallel once care is under way.
- Leaving the ED: Once a patient is screened and found not to have an emergency medical condition, or has been stabilized, EMTALA's duties end. Ordinary discharge planning then applies, including the 42 CFR § 482.43 requirements for emergency department patients a practitioner identifies as needing a discharge plan.
- Inpatients: EMTALA generally ends when a patient is admitted in good faith as an inpatient. Transfers of inpatients fall under the Conditions of Participation, including the § 482.43 transfer-protocol standard effective July 1, 2025, which requires written transfer policies and annual staff training.
- No ABNs for emergencies: Hospitals must not give an Advance Beneficiary Notice to a patient who needs emergency screening or stabilization.
- Penalties: Violations can bring civil monetary penalties against hospitals and physicians and termination of the hospital's Medicare provider agreement.
Tip
Vignette: A man with chest pain arrives at a community hospital ED, and registration asks whether his Medicare Advantage plan needs authorization before he is seen. Screening starts at once; registration may gather information but cannot delay the examination. If he has a myocardial infarction needing a catheterization the hospital cannot perform, the physician certifies the transfer, a receiving hospital accepts, records travel with him, and a qualified critical care crew transports. The case manager then notifies the plan as its contract requires.
A case manager is arranging transfer of a hospitalized patient to a skilled nursing facility. The SNF admissions coordinator asks for recent physician progress notes, therapy notes, and the medication list. The alert patient has agreed to go to this SNF but has not signed a release. Under the HIPAA Privacy Rule, what may the case manager do?
Send the information, because disclosures to another provider for treatment and care coordination do not need written authorization
Wait for the patient to sign a HIPAA authorization form, because any disclosure outside the hospital requires written consent
Send only the face sheet, because the minimum necessary standard limits disclosures between providers for treatment
Ask the SNF to obtain a subpoena, because medical records leave the hospital only under court order or patient request
An alert older patient with decision-making capacity tells the case manager that a neighbor drives the patient to appointments and is welcome to know the discharge plans. The neighbor later calls to ask when the patient will be discharged so the neighbor can arrange pickup. What does HIPAA permit?
Refuse to share anything, because only a spouse or a legally appointed health care agent may receive protected health information
Send the neighbor a copy of the full medical record, because anyone the patient trusts may receive any of the patient's information
Share the discharge date and pickup details, because the patient agreed and the information relates to his role
Require him to come in with photo identification and a notarized release before sharing even the discharge time
A patient with severe abdominal pain arrives at the emergency department of a Medicare-participating hospital. Registration learns that his Medicare Advantage plan wants notification within 24 hours and that he owes a large past-due balance to the hospital. What must happen next under EMTALA?
He is asked to pay a deposit toward the past-due balance before triage and screening continue
The case manager calls the plan for authorization and holds the screening examination until it is approved
He is given an Advance Beneficiary Notice so the hospital can bill him if the visit is not covered
Screening proceeds at once; payer contact and payment questions wait until screening and stabilizing care begin
A patient with an acute ischemic stroke arrives at a small hospital's emergency department and needs a thrombectomy that the hospital cannot perform. The patient remains unstable. Which set of steps makes the transfer appropriate under EMTALA?
The case manager first confirms the receiving hospital is in the patient's insurance network before anyone calls it
A physician certifies that benefits outweigh risks, the receiving hospital accepts, records go along, and qualified transport is used
Family drives the patient to the receiving hospital after signing an against-medical-advice form so no transfer is recorded
The patient is admitted as an inpatient for one night so EMTALA no longer applies, and then transferred the next day
Sections you finish are checked off in the contents.