Which scenario is typically an allowed access to PHI without consent?

• A. Access to a friend
• B. Access to insurance company for billing purposes
• C. Access to employer for payroll
• D. Access when posted publicly

Answer: (B)

Access to PHI without patient consent is permitted mainly for activities that keep health care functioning, especially for payment and billing. When a health plan or provider needs to process claims and obtain payment, sharing the minimum necessary PHI with the insurer for billing is allowed under HIPAA. This is the typical scenario where no prior consent is required because it directly supports payment for care.

Sharing PHI with a friend isn’t allowed because that person isn’t involved in treatment, payment, or health care operations and there’s no authorized exception. Access to an employer for payroll isn’t generally permitted under HIPAA, since payroll processing isn’t a covered function that justifies disclosing health information without authorization. Posting PHI publicly would violate privacy and isn’t allowed. So the scenario involving the insurer for billing purposes aligns with the allowed, consent-free disclosure.