On this page
You can disclose PHI only when the HIPAA Privacy Rule permits or requires it: to the patient, for treatment, payment or health care operations, incident to another permitted disclosure, with a valid authorization, after giving the patient a chance to agree or object, under the public interest exceptions in 45 CFR 164.512, as a limited data set, or under a few other listed provisions such as fundraising (45 CFR 164.502(a)). Anything else is an unauthorized disclosure, and HHS says sending PHI to a tracking technology vendor for marketing without the patient's authorization is one (HHS). Curve Compliance, which helps healthcare marketers keep protected health information (PHI) out of ad platforms, checked each rule on eCFR and HHS on November 2, 2026.
Book a call. A pixel on a booking or intake page can disclose PHI too. Curve Compliance replaces browser ad pixels with one script, checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
When you can disclose PHI
HIPAA defines a disclosure as “the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information” (45 CFR 160.103). The general rule is that a covered entity or business associate “may not use or disclose protected health information, except as permitted or required” by the Privacy Rule (45 CFR 164.502(a)). The permissions form a closed list:
| Permission | What it allows | Rule |
|---|---|---|
| To the patient | Sharing a patient's own information with them | 164.502(a)(1)(i) |
| Treatment, payment and health care operations | Care, billing and running the practice; see HIPAA TPO | 45 CFR 164.506 |
| Incidental | A by-product of a permitted disclosure, with safeguards and the minimum necessary standard in place | 164.502(a)(1)(iii) |
| Authorization | What the patient authorizes on a valid form; see the HIPAA release form checklist | 45 CFR 164.508 |
| Agree or object | Family or friends involved in care, facility directories and notification, if the patient agrees or does not object | 45 CFR 164.510 |
| Public interest | Twelve purposes such as public health, law enforcement and research, each with conditions | 45 CFR 164.512 |
| Limited data set | Research, public health or health care operations under a data use agreement; see HIPAA limited data set | 164.514(e) |
| Other listed provisions | Fundraising for the covered entity, health plan underwriting, and the other uses and disclosures 164.502 itself allows | 164.502(a)(1)(vi); 164.514(f) and (g) |
Two disclosures are required, not just permitted: to the patient when they ask for access or an accounting of disclosures, and to HHS when it investigates compliance (45 CFR 164.502(a)(2)). Most others carry a second limit, the minimum necessary standard, which calls for “reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose” (45 CFR 164.502(b)). See the minimum necessary rule.
The exceptions in 45 CFR 164.512
HHS describes these as “12 national priority purposes” for which the rule permits disclosure without the individual's authorization or permission (HHS). Each has its own conditions in 45 CFR 164.512:
- Uses and disclosures required by law (164.512(a)).
- Public health activities (b).
- Victims of abuse, neglect or domestic violence (c).
- Health oversight activities (d).
- Judicial and administrative proceedings (e).
- Law enforcement purposes (f).
- Decedents: coroners, medical examiners and funeral directors (g).
- Cadaveric organ, eye or tissue donation (h).
- Research (i).
- Averting a serious threat to health or safety (j).
- Specialized government functions (k).
- Workers' compensation (l).
The conditions do the work. For law enforcement, a covered entity may disclose “if the conditions in paragraphs (f)(1) through (f)(6) of this section are met, as applicable” (45 CFR 164.512(f)). HHS lists the six circumstances, from court orders, warrants and subpoenas to evidence of a crime on the covered entity's premises (HHS). For the rules after a patient dies, see does HIPAA apply after death.
Incidental disclosures
HHS: “An incidental use or disclosure is a secondary use or disclosure that cannot reasonably be prevented, is limited in nature, and that occurs as a result of another use or disclosure that is permitted by the Rule.” Its examples: “a hospital visitor may overhear a provider's confidential conversation with another provider or a patient, or may glimpse a patient's information on a sign-in sheet or nursing station whiteboard.” Incidental disclosures are allowed only when the covered entity has reasonable safeguards (45 CFR 164.530(c)) and minimum necessary policies in place, and HHS adds: “an incidental use or disclosure is not permitted if it is a by-product of an underlying use or disclosure which violates the Privacy Rule” (HHS).
Online, HHS's tracking bulletin draws the line in its own words: regulated entities “are not permitted to use tracking technologies in a manner that would result in impermissible disclosures” of PHI to tracking technology vendors (HHS).
Unauthorized disclosures: examples
An unauthorized disclosure, which HHS calls impermissible, is one no permission covers. HHS's examples of disclosures that need the patient's authorization include “disclosures to a life insurer for coverage purposes, disclosures to an employer of the results of a pre-employment physical or lab test, or disclosures to a pharmaceutical firm for their own marketing purposes” (HHS). Made without a valid authorization, each is unauthorized.
It is also the issue raised most. HHS's enforcement highlights, which run to October 31, 2024, put “Impermissible uses and disclosures of protected health information” first among the compliance issues most often alleged in complaints since the Privacy Rule's compliance date in April 2003 (HHS). For real cases, see HIPAA violation examples.
Tracking pixels as unauthorized disclosures
HHS's bulletin says “The HIPAA Rules apply when the information that regulated entities collect through tracking technologies or disclose to tracking technology vendors includes protected health information (PHI).” It gives an example: “disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures.” And it sets the bar for any vendor: a disclosure of PHI without authorizations “requires the vendor to have a signed BAA in place and requires that there is an applicable Privacy Rule permission for disclosure” (HHS).
The same page notes that a federal court vacated part of the bulletin on June 20, 2024: the part saying HIPAA applies when a tool connects an IP address with a visit to an unauthenticated public page about specific health conditions or providers (HHS). HHS keeps the rest of the bulletin posted; see the annotated bulletin and what counts as PHI on a website.
Book a call. Not sure what your pages send? Curve's team reviews what your website sends to Meta, Google and TikTok with you and shows what's likely triggering a flag. Curve's free website scan lists the pixels and trackers on a page. Book a call with Curve.
The accounting of disclosures
“An individual has a right to receive an accounting of disclosures of protected health information made by a covered entity in the six years prior to the date on which the accounting is requested,” with exceptions (45 CFR 164.528(a)). Left out are disclosures for treatment, payment and health care operations; to the patient; incidental disclosures; disclosures under an authorization; disclosures under 164.510; national security and custody disclosures; limited data sets; and disclosures before the compliance date. None of the exceptions covers a disclosure the rule does not permit.
For each disclosure, the accounting lists the date, the recipient's name and, if known, address, a brief description of the PHI and a brief statement of the purpose, including disclosures to or by business associates (45 CFR 164.528(b)). The covered entity must act on a request within 60 days, and the first accounting in any 12 month period is free (45 CFR 164.528(c)).
What to do after an unauthorized disclosure
Mitigate first. A covered entity “must mitigate, to the extent practicable, any harmful effect that is known to the covered entity” of a use or disclosure that broke its policies or the rule, including one by its business associate (45 CFR 164.530(f)). It must also apply sanctions to workforce members who broke the policies, and document them (45 CFR 164.530(e)).
Then assess the breach question. A disclosure “in a manner not permitted under subpart E is presumed to be a breach” unless the covered entity or business associate shows a low probability that the PHI has been compromised, based on at least four factors: the nature and extent of the PHI, who received it, whether it was actually acquired or viewed, and how far the risk has been mitigated (45 CFR 164.402). The notification steps are in the breach notification rule guide. Each case turns on its facts, so talk to your counsel before deciding a disclosure was not a breach.
How Curve Compliance helps
Curve Compliance works on the tracking side of disclosure risk. Curve replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve detects PHI-like patterns, such as condition names, form answers and emails in URLs, before data reaches an ad platform, and flags them so they can be stopped at the source.
Event Logs show what Curve sent to each platform and what the platform accepted, so you can see what Curve sent. Curve is SOC 2 Type II and signs a BAA on every plan (Directory entry), and Curve's team does the setup, typically live in about a week.
Sources, checked November 2, 2026: 45 CFR 160.103; 45 CFR 164.402; 45 CFR 164.502; 45 CFR 164.506; 45 CFR 164.508; 45 CFR 164.510; 45 CFR 164.512; 45 CFR 164.514; 45 CFR 164.528; 45 CFR 164.530; HHS, Summary of the HIPAA Privacy Rule; HHS, Incidental Uses and Disclosures; HHS, Enforcement Highlights; HHS, Your Rights Under HIPAA; HHS, Use of Online Tracking Technologies.
Frequently Asked Questions
Under which circumstances can you disclose PHI?
When the Privacy Rule permits or requires it: to the patient, for treatment, payment or health care operations, with a valid authorization, with the patient's chance to agree or object, under a 164.512 exception, as a limited data set, under a few other listed provisions such as fundraising, or incident to one of these (45 CFR 164.502(a)). Every other disclosure is unauthorized.
What PHI can be disclosed?
In most cases, only what the purpose needs. The minimum necessary standard applies to most uses and disclosures, though not to several kinds, including disclosures to providers for treatment, to the patient, under an authorization, to HHS, or as required by law (45 CFR 164.502(b)).
In which circumstances is it not permissible to disclose PHI?
Whenever no permission in the rule covers the disclosure. HHS says that without your authorization, your provider generally cannot give your information to your employer or use or share it for marketing or advertising purposes (HHS).
What is an incidental disclosure under HIPAA?
A secondary disclosure that can't reasonably be prevented, is limited in nature and results from a permitted disclosure, such as a visitor overhearing a conversation. It is allowed only with reasonable safeguards and minimum necessary policies in place (HHS).
What may be an unauthorized disclosure of PHI?
Any disclosure no permission covers. HHS's tracking bulletin gives one example: disclosures of PHI to tracking technology vendors for marketing without HIPAA-compliant authorizations (HHS).
What is an accounting of disclosures?
A list a patient can request of certain disclosures of their PHI in the six years before the request, with the date, recipient, description and purpose of each. Disclosures for treatment, payment and health care operations, under an authorization and in several other categories are left out (45 CFR 164.528).
Is every unauthorized disclosure a breach?
It is presumed to be one unless a risk assessment shows a low probability that the PHI has been compromised, apart from three narrow exclusions in the definition (45 CFR 164.402).
Talk to Curve Compliance
Book a call. Want your ad tracking off the list of disclosures to worry about? Curve Compliance strips PHI before data reaches an ad platform, sends conversions server-side and signs a BAA on every plan. Book a call with Curve.