Right to Request a Restriction

Individuals do not have a right under the Privacy Rule at 45 CFR 164.522(a) to request that a covered entity restrict a disclosure of protected health information about them for workers’ compensation purposes when that disclosure is required by law or authorized by, and necessary to comply with, a workers’ compensation or similar law.

Under the HIPAA Privacy Rule, may a health care provider disclose protected health information about an individual to another provider, when such information is requested for the treatment of a family member of the individual?

Yes, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule requires covered entities (health plans, health care clearinghouses, or health care providers that conduct standard electronic transactions) to allow individuals to request that a covered entity restrict the use or disclosure of their PHI for treatment, payment, health care operations.

Yes, if their health care provider agrees to the restriction. The Health Insurance Portability and Accountability Act of 1996 (HIPAA)¹ Privacy Rule² requires covered entities³ to allow individuals⁴ to request that the covered entities restrict the use and disclosure of their protected health information (PHI) for treatment, payment, or health care operations.⁵ A covered entity generally is not required to agree to the requested restrictions.⁶ However, if a covered entity agrees to an individual’s requested restriction, it must comply with the agreed-upon restriction, except for purposes of treating the individual in a medical emergency or under certain other circumstances specified in the Privacy Rule.⁷ The covered entity must also document the agreed-upon restriction.⁸

Endnotes