The rules
Nine stakeholders, nine classes of data, one matrix
This page is the product. Everything else is plumbing that implements it. Each cell below resolves to a state, an authority that permits or forbids it, and the mechanism that actually carries the data. Where the answer is no, the reason is stated rather than implied.
| stakeholder → data class ↓ | Patient | Ordering clinician | Consulting specialist | Referring practice | Billing and coding | Attorney of record | Payer and UM | Public health | Research sponsor |
|---|---|---|---|---|---|---|---|---|---|
| Requisition | |||||||||
| Discrete results | |||||||||
| Narrative report | |||||||||
| Images and slides | |||||||||
| Molecular and genomic | |||||||||
| Part 2 substance use | |||||||||
| State-protected | |||||||||
| Charge and lien ledger | |||||||||
| Raw interface message |
Toxicology and treatment-linked results that originated in a federally assisted substance use disorder program, which carry consent obligations that survive every downstream hop.
Part 2 requires patient consent specific to the recipient
How it happensA general medical authorization is not sufficient and will not release it.
This stakeholderNothing moves without a signed authorization naming the categories. Treatment relationship does not create attorney access.
Three legal postures, and they are not interchangeable
- Permitted without authorization
- Treatment, payment, and health care operations. Covers the clinical and billing core: the ordering clinician, the coder, the payer adjudicating a claim. Bounded by the minimum necessary standard for everything except treatment.
- Requires authorization
- Anyone outside that circle, most importantly counsel. A signed authorization that names the categories, the recipient, and an expiry. A treatment relationship does not create attorney access and no amount of urgency substitutes for the form.
- Directed by the patient
- The patient's own right of access, and their right to direct a copy elsewhere. This is not a favor and it is not conditioned on a balance being paid. It runs on a clock.
The category that breaks naive designs
Substance use records from a federally assisted program carry consent obligations that follow the data through every downstream hop, and a redisclosure notice that cannot be stripped. A platform that treats them as ordinary toxicology results will violate Part 2 the first time a general medical authorization is honored.
Sharing with counsel, specifically
Personal injury is where Metaclinic operates today, and it is the sharing relationship most often done badly. A firm needs the record to prove causation and damages. The provider needs the lien protected. The patient signed something at intake that may or may not cover what is being asked for.
- A firm tenant is linked to a matter, never to a patient. Access lives on the matter and dies with it.
- Production is a dated set with a certification page and a manifest, not a live feed into the record.
- Categories the authorization does not name are withheld and the omission is reported, so the firm can go get a proper authorization instead of discovering the gap at deposition.
- The lien ledger is released because the firm is a party to it. That is a different basis from the clinical record and it is tracked separately.
What a release event records
| Field | Why it exists |
|---|---|
| Requesting identity and tenant | Who asked, under what organization |
| Purpose of use | Stated at request time, not inferred afterward |
| Legal basis | The specific authority relied on, from a fixed vocabulary |
| Data classes released | Per class, not per document |
| Data classes withheld and why | Makes an incomplete production defensible |
| Authorization reference | Where one was required, the document that supplied it |
| Delivery mechanism | Portal, API, interface, media, or produced document set |
| Timestamp and version | Which version of the result was current at release |
Which stakeholder is currently asking you for data you cannot easily give them?
That is the useful first conversation, and it is a short one. Bring the laboratories, the practices, and the thing that breaks today.
service@meta.clinic Read the release model first