HIPAA Policy Section 7.5: Requests for Restrictions on Use and Disclosure

An Individual shall have the right to request that System restrict its Use and Disclosure of PHI for Payment, Health Care Operations, and Notification Disclosures.

7.5(1) Individual’s Right to Request Restrictions on Uses and Disclosures of PHI.

1. System shall permit an Individual to request that System restrict (i) its Use and Disclosure of the individual’s PHI for purposes of Payment and Health Care Operations and (ii) its Notification Disclosures concerning the individual.
2. In accordance with Section 4.12 of this Manual, an Individual’s Personal Representative has the right to request restrictions to the same extent the Individual has a right under this Section 7.5.

7.5(2) Request for Restriction on Use and Disclosure of PHI

1. The Privacy Officer shall be responsible for receiving and processing an Individual’s request that System restrict its Use and Disclosure of PHI. The Privacy Officer has ultimate authority regarding the disposition of such requests.
2. System may agree to comply with such request but is not required to do so. System shall not agree to a request to restrict Use or Disclosure of PHI unless all of the following requirements are met:
   1. The Individual’s request is in writing;
   2. The Individual’s request identifies which PHI should not be Used or Disclosed and/or to whom such PHI should not be Disclosed (the Individual may restrict all PHI or all recipients, but not both);
   3. The Individual’s request states the special circumstances that justify the requested restriction;
   4. If compliance with the Individual’s request would affect System’s Payment operations, the Individual’s request provides a feasible alternative method for the Payment operation to be performed; and
   5. The Privacy Officer determines, in her or his discretion, that the administrative difficulty that would result from granting the Individual’s request would be reasonable, would not result in a more than modest additional cost, and is justified by the identified special circumstances. 
      
      Provided, however, that System reserves the right to not to agree to a request for a restriction even if all of these requirements are met.
3. If System agrees to an Individual’s request, System shall:
   1. notify the Individual in writing of the agreed upon restriction;
   2. file a copy of the agreed upon restriction with the Individual’s Designated Record Set, in accordance with Section 9.2 of this Manual; and
   3. not make any future Use or Disclosure of PHI in violation of the agreed restriction unless: the Use or Disclosure is permissible for reasons other than Payment, Health Care Operations or Notification Disclosures; or the restriction has been terminated in accordance with Subsection 7.5(3) of this Section.
4. If System denies an individual’s request, System shall notify the Individual in writing of the denial and the reasons therefor.

7.5(3) Termination of Agreed Restriction

An agreed restriction on Uses and Disclosures of PHI shall be terminated if:

1. The Individual agrees in writing that the restriction can be terminated; or
2. System gives the individual written notice that the restriction is terminated without the Individual’s agreement, except that such termination shall be effective only as to PHI received or created by System after the written notice is given.

7.5(4) Documentation of Agreed and Denied Restrictions

1. If a request is granted, System shall document (i) the Individual’s request; (ii)notice of the granted request; (iii) any subsequent agreed-upon modifications or revocations of the agreed restriction; and (iv) if System modification or revocation is not agreed to by the Individual, any written notification to the Individual of such unilateral modifications or revocations.
2. If an Individual’s request is denied, System shall document both the Individual’s request and System’s written denial of such request. Any such documentation shall be retained in accordance with Section 9.2 of this Manual.

REFERENCES/CITATIONS

45 C.F.R. § 164.522(a)

65 Fed. Reg. at 82,552-53, 82,726-30 (Dec. 28, 2000)