--- title: Continuity of Care | Avara description: Understand when patient records can be shared between healthcare organizations without explicit HIPAA authorization, and how to use Avara Connect for continuity of care sharing. --- Not Legal Advice This document is **not legal advice** and is **not legally binding**. It provides general guidance only. State laws vary and may impose requirements beyond federal HIPAA. We strongly recommend consulting a healthcare attorney to determine whether your specific situation qualifies as a permitted treatment disclosure. **When in doubt, request patient consent.** ## Overview Avara Connect allows your healthcare organization to share studies, documents, and appointments with other organizations through a secure, auditable workflow. Before each share, you choose how access is granted: - **Continuity of care** — Share with another healthcare organization when federal law permits disclosure for treatment without a separate patient authorization. - **Patient consent** — Share when authorization is required or when you prefer explicit patient approval. ## HIPAA and Continuity of Care Under the HIPAA Privacy Rule, covered entities generally need patient authorization before disclosing protected health information (PHI) for most purposes. See [45 CFR § 164.508](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508). There is an important exception: covered entities **may use and disclose PHI for treatment without patient authorization**. See [45 CFR § 164.506(c)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.506). HIPAA defines **treatment** broadly to include the provision, coordination, or management of health care — including consultation between providers and referrals. See [45 CFR § 164.501](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.501). In practice, providers often refer to permitted provider-to-provider sharing for ongoing patient care as **continuity of care**. That phrase describes a common workflow; the underlying legal basis is the **treatment exception** under the HIPAA Privacy Rule, not a separate statutory clause by that name. ### When Authorization Is Typically Required Patient authorization is generally required when PHI is disclosed for purposes **other than** treatment, payment, or certain health care operations — for example: - Employment or disability determinations - Life insurance or underwriting - Litigation (unless otherwise permitted by law) - Marketing - Research without an appropriate waiver or authorization Authorization may also be required for **special categories of records** even when ordinary treatment records could be shared without it — including separately maintained psychotherapy notes ([45 CFR § 164.508(a)(2)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508)), substance use disorder records under [42 CFR Part 2](https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2), and records subject to stricter **state laws** (HIV/STI, genetic testing, reproductive or behavioral health for minors, and similar). ## Sharing in Avara Connect ### Choosing a Share Type Before sharing a study, appointment, or document, select whether the share will proceed via **continuity of care** or **patient consent**. Connect applies the appropriate access controls based on your selection. ### Continuity of Care Shares When you share under continuity of care, the receiving healthcare organization is granted access without a manual authorization workflow on your end — provided your organization has determined the disclosure is permitted under applicable law. You can **revoke access at any time** after a share, regardless of how it was originally granted. ### Referral Appointments on the Clinical Platform If your organization uses the [Avara Clinical Platform](/clinical-platform/overview/index.md) and schedules a patient from a **received referral**, Connect automatically shares that appointment with the referring provider — **that appointment only**, not the patient’s other records or future visits. Because the booking flows directly from an established referral relationship, this is treated as a permitted continuity-of-care disclosure: the referring provider receives access without a manual share step or patient consent workflow for that specific appointment. You can still revoke access afterward if needed. ### Patient Consent Shares When authorization is required — or when you prefer explicit patient approval — select **patient consent**. Connect sends the patient an email with a one-time link to sign into the platform and approve or reject the release of records. The consent form includes clauses for **federally extra-protected information**, including HIV/AIDS-related records, psychiatric/mental health records, and other specially protected categories as applicable. Once the patient signs, the receiving organization is automatically granted access with no additional work on your end. ## What Qualifies as Continuity of Care The following situations commonly qualify as permitted treatment disclosures between healthcare providers **without a separate HIPAA authorization**. This list is illustrative, not exhaustive. ### Permitted Situations 1. **Referral sent to or from your organization** When one provider refers a patient to another, relevant records may be shared to support that referral and subsequent treatment. On the Clinical Platform, appointments booked from a received referral are shared automatically — see [Referral Appointments on the Clinical Platform](#referral-appointments-on-the-clinical-platform) above. 2. **Another treating provider requests records** A PCP, specialist, surgeon, emergency physician, radiologist, or other provider involved in the patient’s care requests prior imaging, reports, or labs for current treatment. 3. **Proactive results sent to a known treating provider** You send reports or images to a patient’s listed PCP, ordering physician, or referring provider for follow-up — even without a formal referral on file, when the purpose is treatment or care coordination. 4. **Consultation or second opinion between providers** A provider shares records with another provider for clinical consultation, co-management, or second-opinion review. 5. **Emergency or urgent care handoff** Records are shared during transitions such as ambulance to hospital, urgent care to ER, or ER to admitting physician. 6. **Discharge, transition, or follow-up planning** Discharge summaries, abnormal finding reports, or consult notes sent to a patient’s primary or follow-up provider. 7. **Care coordination or case management** Multiple providers coordinating medications, imaging, surgical clearance, chronic disease management, or similar treatment activities. 8. **Health information exchange for treatment** Provider-to-provider exchange through an HIE, EHR network, or platform such as Avara Connect when the purpose is treatment — subject to applicable opt-out rules, BAAs, and state law. 9. **Any reasonable treatment disclosure channel** HIPAA does not require treatment disclosures to occur through a specific medium. Phone, fax, secure email, portal, Direct messaging, and platform-based sharing are all acceptable when reasonable safeguards are used. ### Situations That Do Not Qualify The following are **not** continuity of care and should use **patient consent** (or may not be permitted at all): - **Non-healthcare organizations** — Family members, employers, law firms, insurance companies (for non-treatment purposes), schools, and similar recipients are not covered by the treatment exception. Connect treats non-healthcare recipients as requiring patient consent. - **Non-treatment purposes** — Requests for employment, litigation, underwriting, marketing, or general curiosity. - **Unverified recipients** — If you cannot reasonably verify that the requester is a healthcare provider involved in the patient’s care, do not share under continuity of care. Verify the destination (known fax, Direct address, portal, callback to a verified number, existing referral, or provider directory) before releasing records. - **Special record categories** — Psychotherapy notes, Part 2 SUD records, and state-restricted categories may require authorization or separate consent even when ordinary clinical records could be shared for treatment. ## Revoking Access After a study, appointment, or document has been shared — under either continuity of care or patient consent — you can **revoke the receiving organization’s access at any time** from Connect. Revocation takes effect immediately for future access; audit logs retain a record of the original share and revocation.