This is also untrue, depending on how that information will be shared, and to whom, and of course, these rules are also confusing to providers. That means these rights may get violated, whether that is intentional or unintentional.
An example of when information can be shared for marketing purposes is when a hospital uses its patient list to inform you of a new service it provides, a new doctor who has joined the staff, or a fund raising program.
An example of when information cannot be shared without an additional authorization from you is when an insurer who has obtained your information from one of your providers, then uses or sells your information to sell you additional insurance, or another product related to services you have already received.
You can see how these examples are confusing, and how the various entities that do have access to your records might take advantage of that confusion.
