Can an individual restrict who has access to their protected health information during a medical procedure?

Answer

Yes, if their health care provider agrees to the restriction. The Health Insurance Portability and Accountability Act of 1996 (HIPAA)¹ Privacy Rule² requires covered entities³ to allow individuals⁴ to request that the covered entities restrict the use and disclosure of their protected health information (PHI) for treatment, payment, or health care operations.⁵ A covered entity generally is not required to agree to the requested restrictions.⁶ However, if a covered entity agrees to an individual’s requested restriction, it must comply with the agreed-upon restriction, except for purposes of treating the individual in a medical emergency or under certain other circumstances specified in the Privacy Rule.⁷ The covered entity must also document the agreed-upon restriction.⁸

• Example 1: An individual who is scheduled for abdominal surgery and concerned about medical trainees observing a pelvic exam without their consent, while they are unconscious, may request that a covered health care provider not use or disclose their PHI to medical trainees. If the covered health care provider agrees to the restriction request, the provider may not use or disclose the individual’s PHI to medical trainees, even if the medical trainees are members of the covered health care provider’s workforce, with the result that the medical trainees cannot be in the room with the individual and their PHI, or otherwise have access to the individual’s PHI.⁹ As such, the restriction would prevent the medical trainees from observing or providing treatment to the individual, except as needed to provide emergency treatment or where another exception applies.

Under the emergency treatment exception, when a patient who requested the restriction is in need of emergency treatment, a covered entity is permitted to use or disclose only the restricted PHI that is needed to provide the emergency treatment.¹⁰

• Example 2: If a covered health care provider previously agreed to a patient’s request to restrict disclosures of their PHI to medical trainees in advance of a planned abdominal surgery (Example 1) and the same individual subsequently presents to the emergency room for chest pain, the health care provider would be permitted to disclose to medical trainees participating in the emergency treatment only the individual’s PHI that is needed to treat the patient for chest pain. The covered entity could not disclose any additional PHI to the medical trainee.

Endnotes