Continuity of Care

Connect

Understand when patient records can be shared between healthcare organizations without explicit HIPAA authorization, and how to use Avara Connect for continuity of care sharing.

Overview

Avara Connect allows your healthcare organization to share studies, documents, and appointments with other organizations through a secure, auditable workflow. Before each share, you choose how access is granted:

Continuity of care — Share with another healthcare organization when federal law permits disclosure for treatment without a separate patient authorization.
Patient consent — Share when authorization is required or when you prefer explicit patient approval.

HIPAA and Continuity of Care

Under the HIPAA Privacy Rule, covered entities generally need patient authorization before disclosing protected health information (PHI) for most purposes. See 45 CFR § 164.508.

There is an important exception: covered entities may use and disclose PHI for treatment without patient authorization. See 45 CFR § 164.506(c). HIPAA defines treatment broadly to include the provision, coordination, or management of health care — including consultation between providers and referrals. See 45 CFR § 164.501.

In practice, providers often refer to permitted provider-to-provider sharing for ongoing patient care as continuity of care. That phrase describes a common workflow; the underlying legal basis is the treatment exception under the HIPAA Privacy Rule, not a separate statutory clause by that name.

When Authorization Is Typically Required

Patient authorization is generally required when PHI is disclosed for purposes other than treatment, payment, or certain health care operations — for example:

Employment or disability determinations
Life insurance or underwriting
Litigation (unless otherwise permitted by law)
Marketing
Research without an appropriate waiver or authorization

Authorization may also be required for special categories of records even when ordinary treatment records could be shared without it — including separately maintained psychotherapy notes (45 CFR § 164.508(a)(2)), substance use disorder records under 42 CFR Part 2, and records subject to stricter state laws (HIV/STI, genetic testing, reproductive or behavioral health for minors, and similar).

Before sharing a study, appointment, or document, select whether the share will proceed via continuity of care or patient consent. Connect applies the appropriate access controls based on your selection.

Continuity of Care Shares

When you share under continuity of care, the receiving healthcare organization is granted access without a manual authorization workflow on your end — provided your organization has determined the disclosure is permitted under applicable law.

You can revoke access at any time after a share, regardless of how it was originally granted.

Referral Appointments on the Clinical Platform

If your organization uses the Avara Clinical Platform and schedules a patient from a received referral, Connect automatically shares that appointment with the referring provider — that appointment only, not the patient’s other records or future visits.

Because the booking flows directly from an established referral relationship, this is treated as a permitted continuity-of-care disclosure: the referring provider receives access without a manual share step or patient consent workflow for that specific appointment. You can still revoke access afterward if needed.

When authorization is required — or when you prefer explicit patient approval — select patient consent. Connect sends the patient an email with a one-time link to sign into the platform and approve or reject the release of records.

The consent form includes clauses for federally extra-protected information, including HIV/AIDS-related records, psychiatric/mental health records, and other specially protected categories as applicable. Once the patient signs, the receiving organization is automatically granted access with no additional work on your end.

What Qualifies as Continuity of Care

The following situations commonly qualify as permitted treatment disclosures between healthcare providers without a separate HIPAA authorization. This list is illustrative, not exhaustive.

Permitted Situations

Referral sent to or from your organization When one provider refers a patient to another, relevant records may be shared to support that referral and subsequent treatment. On the Clinical Platform, appointments booked from a received referral are shared automatically — see Referral Appointments on the Clinical Platform above.
Another treating provider requests records A PCP, specialist, surgeon, emergency physician, radiologist, or other provider involved in the patient’s care requests prior imaging, reports, or labs for current treatment.
Proactive results sent to a known treating provider You send reports or images to a patient’s listed PCP, ordering physician, or referring provider for follow-up — even without a formal referral on file, when the purpose is treatment or care coordination.
Consultation or second opinion between providers A provider shares records with another provider for clinical consultation, co-management, or second-opinion review.
Emergency or urgent care handoff Records are shared during transitions such as ambulance to hospital, urgent care to ER, or ER to admitting physician.
Discharge, transition, or follow-up planning Discharge summaries, abnormal finding reports, or consult notes sent to a patient’s primary or follow-up provider.
Care coordination or case management Multiple providers coordinating medications, imaging, surgical clearance, chronic disease management, or similar treatment activities.
Health information exchange for treatment Provider-to-provider exchange through an HIE, EHR network, or platform such as Avara Connect when the purpose is treatment — subject to applicable opt-out rules, BAAs, and state law.
Any reasonable treatment disclosure channel HIPAA does not require treatment disclosures to occur through a specific medium. Phone, fax, secure email, portal, Direct messaging, and platform-based sharing are all acceptable when reasonable safeguards are used.

Situations That Do Not Qualify

The following are not continuity of care and should use patient consent (or may not be permitted at all):

Non-healthcare organizations — Family members, employers, law firms, insurance companies (for non-treatment purposes), schools, and similar recipients are not covered by the treatment exception. Connect treats non-healthcare recipients as requiring patient consent.
Non-treatment purposes — Requests for employment, litigation, underwriting, marketing, or general curiosity.
Unverified recipients — If you cannot reasonably verify that the requester is a healthcare provider involved in the patient’s care, do not share under continuity of care. Verify the destination (known fax, Direct address, portal, callback to a verified number, existing referral, or provider directory) before releasing records.
Special record categories — Psychotherapy notes, Part 2 SUD records, and state-restricted categories may require authorization or separate consent even when ordinary clinical records could be shared for treatment.

Revoking Access

After a study, appointment, or document has been shared — under either continuity of care or patient consent — you can revoke the receiving organization’s access at any time from Connect. Revocation takes effect immediately for future access; audit logs retain a record of the original share and revocation.