Yes, doctors share medical records, and in many cases they can do so without asking your permission first. Under federal privacy law, health care providers are allowed to exchange your health information for treatment, payment, and routine health care operations without obtaining your written consent. This surprises many people who assume every disclosure requires a signature, but the system is designed to let information flow where it’s needed for your care.
When Doctors Can Share Without Your Consent
The HIPAA Privacy Rule, which governs how your health data is handled in the U.S., permits doctors and other covered entities to use and disclose your protected health information in three broad categories: treatment, payment, and health care operations. Written consent for these purposes is optional, not required.
Treatment covers the provision, coordination, and management of your care. That includes one doctor consulting with another about your condition, a primary care physician referring you to a specialist, or a hospital sharing your records with a rehab facility after discharge. If the sharing is related to taking care of you, it generally doesn’t require your sign-off.
Payment means the activities involved in getting reimbursed for your care. Your doctor’s office can send diagnostic codes, procedure details, and other clinical information to your insurance company so the claim gets processed. Your insurer can use that information to determine coverage, calculate what it owes, and handle billing disputes.
Health care operations is a broader bucket that includes quality improvement, staff training and credentialing, audits, fraud detection, and certain insurance functions like underwriting and risk rating. If two providers have both treated you, they can share information about you for quality assurance or compliance purposes.
What Gets Shared in a Referral
When your primary care doctor refers you to a specialist, the information that travels with you can be extensive. Your designated record set, the legal term for everything a provider maintains about you, includes medical records, billing records, lab results, medical images like X-rays, clinical notes, and disease management files. In practice, a referring doctor typically sends what’s relevant: your recent lab work, imaging, medication list, and a summary of the problem being referred.
If you’re switching providers entirely and want your full record transferred, you have the right to direct your old doctor’s office to send your information to the new one. That request needs to be in writing and must clearly identify who should receive the records and where to send them. Electronic signatures and secure portal requests count. Once the office receives your written request, it has 30 days to complete the transfer, with a possible 30-day extension in certain situations.
How Records Move Between Health Systems
Much of this sharing now happens electronically, often without you even noticing. The largest electronic health record platform in the U.S., Epic Systems, uses a tool called Care Everywhere that automatically attempts to match your identity across institutions. The evening before a scheduled appointment, the system searches for your records at other organizations using your name, phone number, and date of birth. If it finds a confident match, it links your files so your new doctor can pull up relevant history from another hospital system.
This kind of automated exchange has measurable benefits: faster service times, lower costs, fewer duplicate lab tests and imaging studies, and reduced emergency room admissions. On a national level, the federal government has been building the Trusted Exchange Framework and Common Agreement (TEFCA), an initiative designed to let different health information networks talk to each other securely, even when they use different technology platforms.
When a Formal Authorization Is Required
Not all sharing falls under the treatment-payment-operations umbrella. For uses that go beyond those purposes, your doctor needs a signed HIPAA authorization, which is a more detailed document than a simple consent form. An authorization must specify exactly what information will be shared, who will receive it, an expiration date, and the purpose of the disclosure. You can’t be denied treatment for refusing to sign one, with limited exceptions.
Psychotherapy notes get extra protection. These are a therapist’s personal process notes kept separate from your main medical record, and they almost always require a specific authorization before anyone else can see them. Other sensitive categories, like substance abuse treatment records, carry additional federal protections under a separate regulation (42 CFR Part 2) that historically required explicit patient consent for any disclosure, even for treatment purposes.
Sharing in Emergencies
If you arrive at an emergency room unconscious or otherwise unable to communicate, providers can still share your health information. HIPAA permits covered entities to disclose information that is directly relevant to the involvement of family members, friends, or other people responsible for your care. If you’re incapacitated, providers can use their professional judgment to decide what to share and with whom, based on what they believe is in your best interest.
Emergency physicians can also access your records from other institutions through the electronic exchange systems described above. If your records are in a connected system, the ER team can potentially pull up your medication list, allergy history, and recent diagnoses within minutes.
When a Doctor Can Withhold Records
The 21st Century Cures Act made it illegal for health care providers to engage in “information blocking,” meaning they generally can’t refuse to share your electronic health information. But the law recognizes a few exceptions. A provider can delay or decline to share records if doing so is reasonably necessary to prevent harm to a patient or another person, to protect an individual’s privacy, to maintain the security of the data, or when fulfilling the request is genuinely infeasible. These exceptions have specific conditions attached, so a provider can’t simply cite one of them as a blanket reason to refuse.
Your Right to Control the Flow
You have the right to request a copy of nearly everything in your medical record: clinical notes, lab results, imaging, billing records, insurance information, and wellness program files. You also have the right to direct where that information goes. Some states and regional health information exchanges allow you to opt out of electronic data sharing entirely, though the process and availability vary by location.
If you want to request your records or have them sent to another provider, submit the request in writing through your doctor’s patient portal or front desk. The office can accept electronic signatures and PDF copies of signed requests. Federal law caps what providers can charge for electronic copies at a reasonable, cost-based fee, and they cannot impose unreasonable barriers to slow the process down. If your request isn’t fulfilled within 30 days, the provider is in violation of HIPAA’s access requirements.