Category: Uses and Disclosures

Opportunity to Agree or Object

Also known as: Uses and Disclosures Requiring an Opportunity to Agree or Object, Informal Permission

Simply put

Under the HIPAA Privacy Rule, certain uses and disclosures of health information are allowed only if the patient is first given a chance to agree to or object to them. Rather than requiring a signed authorization form, a covered entity can generally obtain this informal permission by simply asking the individual or by giving them a reasonable opportunity to say no. This applies to specific situations, such as listing a patient in a facility directory or sharing information with family members involved in the patient's care.

Formal definition

"Opportunity to Agree or Object" refers to a category of permitted uses and disclosures of protected health information (PHI) under the HIPAA Privacy Rule for which neither a written authorization nor the standard informal permission process is dispensed with, but for which the individual must be given the chance to agree to or prohibit the use or disclosure. Under the general rule at 45 CFR 164.510, informal permission may be obtained by asking the individual directly or by circumstances that clearly give the individual the opportunity to agree, acquiesce, or object. This standard is distinct from (1) uses and disclosures requiring written authorization, and (2) uses and disclosures for which no authorization or opportunity to object is required (45 CFR 164.512), such as certain disclosures required by law. This term is specific to the Privacy Rule and governs PHI in all forms; it does not apply to the Security Rule's ePHI safeguards. Practitioners should note that additional or more stringent requirements may apply under state law or other frameworks, and should verify the precise regulatory text and scope of each provision against the current version of the applicable CFR sections.

Why it matters

The "Opportunity to Agree or Object" standard occupies an important middle ground in the HIPAA Privacy Rule's framework for permitted uses and disclosures. On one end are disclosures requiring a signed written authorization; on the other are disclosures that require neither authorization nor any opportunity to object, such as certain disclosures required by law under 45 CFR 164.512. Understanding where a particular use or disclosure falls in this spectrum is essential, because applying the wrong standard can lead a covered entity to either improperly withhold information from a patient's family or, conversely, disclose PHI without the informal permission the rule requires.

This category governs everyday, high-frequency situations in clinical settings, including listing a patient in a facility directory and sharing information with family members or others involved in the patient's care. Because these interactions happen constantly and often informally, the risk of error is practical rather than theoretical: staff may share information with a relative without giving the patient a reasonable chance to object, or may include a patient in a directory who would have preferred not to be listed. Getting the process right supports both patient trust and Privacy Rule compliance.

Because this standard is specific to the Privacy Rule and applies to PHI in all forms, it does not address the Security Rule's safeguards for ePHI. Covered entities should also be aware that state law or other frameworks may impose additional or more stringent requirements, and the precise scope of each provision should be verified against the current version of the applicable CFR sections.

Who it's relevant to

Privacy Officers

Privacy officers are responsible for designing policies and staff training that correctly distinguish disclosures requiring written authorization, those requiring an opportunity to agree or object, and those requiring neither. They should ensure front-line procedures for facility directories and family involvement give patients a genuine, reasonable opportunity to object.

Clinical and Front-Desk Staff

Nurses, physicians, admissions staff, and others who interact directly with patients frequently apply this standard in real time, for example, when a family member asks about a patient's condition or when deciding whether to list a patient in a directory. They need clear guidance on how to obtain informal permission, whether by asking directly or through circumstances that give the patient a chance to object.

Compliance and Legal Teams

Compliance and legal professionals advising covered entities must confirm the correct category for a given disclosure under the Privacy Rule and account for state law or other frameworks that may impose additional or more stringent requirements. They should verify the precise regulatory text and scope against the current version of 45 CFR 164.510 and related sections.

Health Information Management (HIM) Professionals

HIM staff who handle records requests and directory information rely on this standard to determine when a signed authorization is unnecessary and informal permission suffices. Because the standard applies to PHI in all forms, it is relevant to oral, paper, and electronic records alike.

Inside Opportunity to Agree or Object

Informal Permission Standard

Under the HIPAA Privacy Rule, the opportunity to agree or object is a mechanism by which a covered entity may use or disclose certain PHI based on the individual's informal agreement, rather than requiring a signed written authorization. The individual may agree or object orally.

Facility Directories

A covered entity generally may maintain and disclose limited directory information (such as name, location in the facility, general condition, and religious affiliation) after giving the individual an opportunity to agree or object, subject to the conditions in the Privacy Rule.

Disclosures to Those Involved in Care

A covered entity may disclose PHI relevant to a person's involvement in the individual's care or payment for care (such as family members or friends), where the individual has had the opportunity to agree or object and does not object.

Notification Purposes

PHI may be used or disclosed to notify or assist in notifying a family member, personal representative, or another person responsible for the individual's care about the individual's location, general condition, or death, subject to the agree-or-object framework.

Professional Judgment When Individual Is Incapacitated

When the individual is not present or is unable to agree or object due to incapacity or an emergency, the covered entity may, in most cases, use professional judgment to determine whether the disclosure is in the individual's best interest, rather than relying on express agreement.

Scope: Privacy Rule Only

This is a Privacy Rule concept governing PHI in all forms (oral, paper, electronic). It is distinct from the Security Rule, which addresses safeguards for ePHI and does not itself establish permission standards for uses and disclosures.

Common questions

Answers to the questions practitioners most commonly ask about Opportunity to Agree or Object.

Does the opportunity to agree or object require written authorization from the individual?

No. The opportunity to agree or object is a distinct, more informal standard than a written HIPAA authorization. Under the Privacy Rule, certain uses and disclosures, such as those involving facility directories or notifying persons involved in an individual's care, may proceed based on the individual's informal agreement, or on the covered entity's professional judgment where the individual is not present or is incapacitated. This is generally permitted without the formal signed authorization required for other uses and disclosures. Readers should confirm the specific conditions against the current regulatory text, as the applicable standard depends on the type of disclosure involved.

Does 'opportunity to object' mean the individual must actively give permission before any such disclosure can occur?

Not necessarily. The standard is generally that the individual must be given the opportunity to agree or object, which can include informal permission or simply not objecting when informed. In addition, the Privacy Rule generally permits a covered entity to use professional judgment to make certain disclosures when the individual is not present, is incapacitated, or an emergency exists, and it is in the individual's best interest. Active affirmative permission is not always a precondition. The precise conditions should be verified against the current Privacy Rule provisions.

How should we give a patient the opportunity to agree or object in practice?

In most cases this can be done through an informal, documented conversation, orally informing the individual of the intended use or disclosure (for example, inclusion in a facility directory) and giving them a chance to agree or object. Some organizations capture the individual's response in the record for accountability, though a signed form is generally not required for these categories. Your organization's policies and workflows should define how staff present the choice and how the response is noted, consistent with the current regulatory requirements.

What should staff do when the individual is not present or is unable to agree or object?

When the individual is incapacitated, not present, or an emergency situation exists, the Privacy Rule generally allows the covered entity to exercise professional judgment to determine whether the use or disclosure is in the individual's best interest, and to disclose only the PHI directly relevant to the person's involvement in the individual's care. Organizations typically train staff to document the basis for that judgment. The specific conditions and limits should be confirmed against the current regulatory text.

Which categories of disclosures typically rely on the opportunity to agree or object?

This standard generally applies to specific categories such as facility directory listings and disclosures to family members, relatives, close personal friends, or others identified by the individual who are involved in the individual's care or payment for care. It also commonly applies in certain notification situations. It does not extend to most other uses and disclosures, many of which require a written authorization or fall under separate permitted-use provisions. Verify the applicable category against the current Privacy Rule before relying on this standard.

How should we document that the opportunity was provided?

While the Privacy Rule generally does not mandate a signed form for these categories, many organizations maintain internal documentation, such as a note in the record indicating the individual was informed and their response, to support accountability and demonstrate their policies were followed. The appropriate level of documentation should be defined in your organization's policies and procedures. Note that state law or other frameworks may impose additional documentation expectations beyond HIPAA, and requirements should be confirmed against current guidance.

Common misconceptions

The opportunity to agree or object requires a signed written authorization from the individual.

It is an informal permission mechanism. Agreement or objection may generally be expressed orally, and it operates separately from the more formal written authorization required for other uses and disclosures under the Privacy Rule.

If the individual is not present or cannot respond, the covered entity is prohibited from making the disclosure.

When the individual is incapacitated, absent, or in an emergency, the covered entity may generally use professional judgment to determine whether a use or disclosure is in the individual's best interest, within the limits set by the Privacy Rule.

This standard lets a provider share any PHI with any family member who asks.

The permission is limited to PHI directly relevant to that person's involvement in the individual's care or payment, or to notification purposes. It is not a general-purpose disclosure authority, and the individual retains the right to object.

Best practices

Document how and when the individual was given the opportunity to agree or object, and note any objection, so the basis for a use or disclosure can be demonstrated later.

Train workforce members to recognize which situations (facility directories, involvement in care, notification) fall under this standard versus those requiring a written authorization.

Establish clear internal guidance for exercising professional judgment when an individual is incapacitated, absent, or in an emergency, and limit disclosures to information relevant to the person's involvement in care.

Limit disclosures to the PHI directly relevant to the recipient's involvement in the individual's care or payment, consistent with minimum necessary considerations where applicable.

Verify that this Privacy Rule mechanism is applied only to permitted purposes and confirm whether applicable state law or other frameworks impose additional or stricter requirements before disclosing.

Periodically review policies and procedures against the current Privacy Rule text, as regulatory language and interpretive guidance can change over time.