You receive a call from staff at a local hospital stating that they need information regarding a former client of yours who is scheduled for surgery. They fax you a release of information form which…

Releasing all requested information is incorrect because the verbal request for dates and diagnoses exceeds what the signed, legally binding authorization permits, regardless of the requestor's identity.

Release information regarding medications only. The signed release of information form is a legal document that authorizes disclosure solely for medication information, and releasing any additional data - such as dates of treatment or diagnoses - would exceed the scope of that authorization and constitute an impermissible HIPAA disclosure. Staff must strictly honor the terms of the written authorization, regardless of verbal requests from the receiving party for more information.

Refusing to release any information is incorrect because a valid, signed authorization exists for medication information, which the covered entity is both permitted and obligated to honor.