Yes. HIPAA states that Covered Entities can disclose Protected Health Information for the Treatment and Payment activities of another Covered Entity or a healthcare provider, and for certain Health Care Operations of another Covered Entity, without patient Authorization.