HIPAA GENERAL OPERATING POLICY #26
RIGHTS TO REQUEST PRIVACY PROTECTION FOR PHI
I. Right of Individual to Request Restriction of Uses and Disclosures
a. A HCC must permit an individual to request that the HCC restrict uses or disclosures of PHI for treatment, payment or health care operations, and disclosures for involvement in the individual’s care and notification purposes.
b. A HCC is not required to agree to a restriction.
c. A HCC that agrees to a restriction may not use or disclose PHI in violation of the restriction except that, where the restricted PHI is needed for emergency treatment, the HCC may use or disclose such PHI to a health care provider to provide such treatment to the individual. If the restricted PHI is disclosed for emergency treatment, the HCC must request that the health care provider not further use or disclose the information.
d. A restriction agreed to is not effective to prevent uses or disclosures permitted or required to the Secretary of DHHS for compliance, for facility directories or for which authorization or an opportunity to agree or object is not required.
II. Terminating a Restriction
A HCC may terminate its agreement to a restriction if:
a. The individual agrees to or requests the termination in writing;
b. The individual orally agrees to the termination and the oral agreement is documented; or
c. The HCC informs the individual it is terminating its agreement to the restriction, except that such termination is only effective with regard to PHI created or received after it has so informed the individual.
III. Documentation of a Restriction
A HCC that agrees to a restriction must document that restriction.