Pathology/Lab Coding Alert

Question: Are we required to honor a patient’s request to limit or restrict disclosures of their protected health information (PHI)?

Vermont Subscriber

Answer: Yes. HIPAA “allow[s] individuals to request that a covered entity restrict the use or disclosure of their PHI for treatment, payment, health care operations,” Department of Health & Human Services (HHS) Office for Civil Rights (OCR) guidance indicates. “The Privacy Rule also grants individuals the right to request restrictions for other uses and disclosures, such as disclosures made to family members or persons involved in the individual’s care.”

But: Even though patients can ask providers to limit or nix the sharing of their PHI, covered entities (CEs) still have the option of disagreeing with the request. For example, if there is a medical emergency and the disclosure of an individual’s PHI is necessary to adequately treat the patient, then the CE may share the data, OCR explains. The clinician who shares the patient’s PHI must also remind the emergency treatment provider that they should use the data only for treatment purposes because it is restricted.