Health Information Compliance Alert

Question: Does our practice have to honor a patient’s request to limit or restrict disclosures of their protected health information (PHI)?

Vermont Subscriber

Answer: Yes. HIPAA “allow[s] individuals to request that a covered entity restrict the use or disclosure of their PHI for treatment, payment, health care operations,” HHS Office for Civil Rights (OCR) guidance indicates. “The Privacy Rule also grants individuals the right to request restrictions for other uses and disclosures, such as disclosures made to family members or persons involved in the individual’s care.”

But: Even though patients can ask providers to limit or nix the sharing of their PHI, covered entities (CEs) still have the option of disagreeing with the request. For example, if there is a medical emergency and the disclosure of an individual’s PHI is necessary to adequately treat the patient, then the CE may share the data, OCR explains. The clinician, who shares the patient’s PHI, must also remind the emergency treatment provider that the data is restricted and only to be used for treatment purposes.

Bottom line: These two actions must be met for the CE to honor the request, according to OCR guidance:

1. The disclosure is for payment or health care operations and is not otherwise required by law; and
2. The PHI pertains solely to a health care item or service for which the individual, or a person other than the health plan on behalf of the individual, has paid the covered entity in full.