"A HIPAA authorization - individual consent - is already required before HIPAA-covered entities or business associates disclose any protected health information, including about reproductive health, in any circumstances not specifically permitted by the HIPAA Privacy Rule," says privacy attorney Iliana Peters of the law firm Polsinelli.