Standards for Patients Right to Restrict PHI

The HCC must comply with a patient's request to restrict disclosures to a health plan when the following conditions are met:

1. The PHI pertains solely to a healthcare item or service for which the patient has paid out of pocket in full at the time of service.
2. The disclosure is to a health plan for the purpose of carrying out payment or health care operations (and not for treatment).  You must restrict this PHI to any contracted vendors that perform services on the behalf of the HCC and would submit claims for these services, e.g. reference lab should not bill the patient’s health plan for this/these services This requirement does not apply if disclosure is otherwise required by law. 

A patient or their personal representative must complete the "Request to Restrict Uses and Disclosures of Protected Health Information" form. This form is managed by the HCC Privacy Custodian.

1. The Privacy Custodian will review and process the request.
2. The Director will review and approve any restrictions related to treatment, disclosures to family/friends, payment, or healthcare operations.
3. The Director will specifically review and approve restrictions for out-of-pocket services paid in full.
4. A restriction can apply to an entire encounter, visit, or admission, or a portion thereof.
5. Any approved restriction must still permit the use of the data for treatment purposes when clinically necessary. 

1. The HCC is not required to agree to a restriction request, except for non-students, where HIPAA's mandatory restriction rules apply.
2. If the HCC approves a restriction, it will not use or disclose the patient's PHI in violation of that restriction.
3. Violations of an approved restriction may result in a breach and disciplinary action. 

1. Written notification of the outcome will be provided to the patient within five business days.
2. If the restriction affects student insurance payments, the patient will be notified, and full payment will be collected from them directly.
3. Documentation of the outcome will be filed in the patient’s medical record.
4. The patient’s medical record or health information will be flagged to alert users of the restriction. 

An approved restriction may be violated only when:

1. The patient is in need of emergency treatment, and the restricted PHI is necessary to provide that treatment.
2. The HCC may use or disclose the restricted PHI to an outside healthcare provider to provide emergency treatment.
3. When disclosing for emergency treatment, the HCC must request that the receiving provider not further use or disclose the PHI.

An approved restriction is not effective to prevent uses or disclosures in the following circumstances:

1. When required by the Secretary of the Department of Health and Human Services to investigate or determine compliance.
2. For the facility directory.
3. When authorization or opportunity to agree or object is not required. 

The HCC may terminate its agreement to a restriction, if:

1. The patient agrees to or requests the termination in writing.
2. The patient orally agrees to the termination, and this agreement is documented in the medical record.
3. The HCC informs the patient that it is terminating its agreement to the restriction.
4. A termination is only effective for PHI created or received after the patient has been informed of the termination.