Permission granted by individual 
Health information may be granted to outside entities or individuals if granted by the individual. The individual must have the opportunity to agree or object to granting permission. However, an exception can be made if the individual is incapacitated, in an emergency situation, or disclosure is determined to be in the best interests of the individual as deemed by their professional judgment.

Facility Directories.
It is a common practice in many health care facilities, such as hospitals, to maintain a patient directory. A covered health care provider may rely on informal permission to list the name, general condition, religious affiliation, and location or individuals in the provider’s facility. Providers may then disclose the minimal required information to anyone asking for the individual by name, or to religious entities that are in line with the individual. Members of the clergy are not required to ask for the individual by name when inquiring about patient religious affiliation.

For Notification and Other Purposes.
Informal permission may be granted to family, relatives, or friends, or to other persons whom the individual identifies. Protected health information may also be provided to entities directly relevant to the care for an individual care for the purpose of obtaining payment for care. For example, a pharmacist to dispense filled prescriptions to a person acting on behalf of the patient. Similarly, a covered entity may rely on an individual’s informal permission to use or disclose protected health information for the purpose of notifying (including identifying or locating) family members, personal representatives, or others responsible for the individual’s care of the individual’s location, general condition, or death. In addition, protected health information may be disclosed for notification purposes to public or private entities authorized by law or charter to assist in disaster relief efforts

For example, a pharmacist is able to dispense prescription medication for the patient’s behalf based on the minimal required information.