The Federal HIPAA law regulates the use and disclosure of personally identifiable health information as needed for diagnosis, treatment and billing of healthcare services, limiting any such disclosure only to properly qualified persons, and to the minimum information necessary to accomplish these purposes (unless required otherwise by a government agency or court of law).
Patients can request additional restrictions on release of their information and have the right to request explanation of these policies from the provider.