Does HIPAA permit sharing PHI with third parties providing social services to support case management?

• A. Yes; to public or private-sector entities providing social services in specified circumstances.
• B. No; PHI cannot be shared with non-medical entities.
• C. Only with patient authorization.
• D. Only in emergencies.

Answer: (A)

HIPAA allows sharing PHI with entities that provide social services when doing so supports coordinating or managing a patient’s care. In practice, when a social services provider (public or private) is involved in the patient’s case management, sharing the minimum necessary PHI can be appropriate so that those services can be integrated into the treatment plan. The recipient may be a business associate if they are performing duties on behalf of the covered entity, and safeguards must be in place (such as a business associate agreement) to protect the information. This kind of disclosure is about care coordination and treatment, not a general release of information for unrelated purposes. So, sharing PHI with third-party social service providers to support case management is permitted under specified circumstances.