Otolaryngology Coding Alert

Question: When a patient asks our office to limit or restrict disclosures of their protected health information (PHI) are we required to honor their request?

Georgia Subscriber

Answer: Yes. HIPAA allows “individuals to request that a covered entity [CE] restrict the use or disclosure of their PHI for treatment, payment, health care operations,” Department of Health and Human Services (HHS) Office for Civil Rights (OCR) guidance indicates. “The Privacy Rule also grants individuals the right to request restrictions for other uses and disclosures, such as disclosures made to family members or persons involved in the individual’s care.”

Caveat: Even though patients can ask providers to limit or nix the sharing of their PHI, CEs still have the option of disagreeing with the request. For example, if there’s a medical emergency and the disclosure of an individual’s PHI is necessary to adequately treat the patient, then the CE may share the data, OCR explains. The clinician who shares the patient’s PHI must also remind the emergency treatment provider that the data is restricted and only to be used for treatment purposes.

Bottom line: These two actions must be met for the CE to honor the request, according to OCR guidance:

The disclosure is for payment or healthcare operations and is not otherwise required by law.

The PHI pertains solely to a healthcare item or service for which the individual, or a person other than the health plan on behalf of the individual, has paid the covered entity in full.