protected health information pursuant to
any Authorization that meets
the Privacy Rule’s requirements at 45 CFR 164.508.
HIPAA can allow health care providers to share
protected health information (PHI) with other entities that
are involved in a patient's care, including businesses that
provide services for those providers.
This is known as a major exception to the need for
specific authorization to release PHI.
For example, a doctor can share information with a billing service that
prepares their bills, a lab that performs medical testing, or a specialty consultant.
HIPAA also allows health care providers to disclose PHI for treatment purposes
WITHOUT the patient's authorization.
This includes coordinating or managing health care with a third party.]
https://www.hhs.gov/hipaa/for-professionals/faq/472/
does-hipaa-permit-a-covered-entity-to-use-or-disclose-
protected-health-information/index.html
위 링크 참고해보시고