Section 20: Request for Restricting Access to PHI
Patients shall have the right to request that the Callier Center restrict its Use and Disclosure of PHI for Payment, Health Care Operations, and Breach Notification Disclosures.
Patient’s Right to Request Restrictions on Uses and Disclosures of PHI
a. The Center shall permit a Patient to request that the Center restrict (i) its Use and Disclosure of the individual’s PHI for purposes of Payment and Health Care Operations and (ii) its Breach Notification Disclosures concerning the individual.
b. In accordance with this Manual, a Patient’s Personal Representative has the right to request a restriction to the same extent the Patient has a right under this Section.
Request for Restriction on Use and Disclosure of PHI
a. The Privacy Officer shall be responsible for receiving and processing a Patient’s request for restriction of the Use and Disclosure of PHI. The Privacy Officer has ultimate authority regarding the disposition of such requests.
b. The Privacy Officer may agree to comply with such request but is not required to do so, except for requests where the Patient pays for a service or health care item out-of-pocket in full, and requests that that information regarding the services not be shared for the purpose of payment or Center’s operations with the Patient’s health insurer unless a law requires disclosure. The Center can cancel the agreement if the Patient fails to pay the entire amount out of pocket.
c. The Center shall not agree to a request to restrict Use or Disclosure of PHI unless all of the following requirements are met:
- i. The request is in writing; Request for Restriction Form (English/Spanish)
- ii. The request identifies which PHI should not be Used or Disclosed and/or to whom such PHI should not be Disclosed (the Patient may restrict all PHI or all recipients, but not both);
- iii. The request states the special circumstances that justify the requested restriction;
- iv. If compliance with the request would affect Payment operations, the Individual’s request provides a feasible alternative method for the Payment operation to be performed; and
- v. The Privacy Officer determines, in her or his discretion, that the administrative difficulty that would result from granting the Patient’s request would be reasonable, would not result in a more than modest additional cost, and is justified by the identified special circumstances.
Provided, however, that the Center reserves the right to not to agree to a request for a restriction even if all of these requirements are met except for requests involving restrictions on the use of information for Payment where the Patient pays for the service or item out-of-pocket in full.
d. If the Center agrees to an Individual’s request, the Privacy Officer shall:
- i. notify the Patient in writing of the agreed upon restriction;
- ii. file a copy of the agreed upon restriction with the Individual’s Designated Record Set;
- iii. not make any future Use or Disclosure of PHI in violation of the agreed restriction unless: the Use or Disclosure is permissible for reasons other than Payment, Health Care Operations or Breach Notification Disclosures; or the restriction has been terminated in accordance with this Section.
e. If the Center denies an individual’s request, the Privacy Officer shall notify the Patient in writing of the denial and the reasons therefor.
Termination of Agreed Restriction
An agreed restriction on Uses and Disclosures of PHI shall be terminated if:
a. The Patient agrees in writing that the restriction can be terminated; or
b. The Center gives the Patient written notice that the restriction is terminated without the Patient’s agreement, except that such termination shall be effective only as to PHI received or created by University after the written notice is given.
Documentation of Agreed and Denied Restrictions
a. If a request is granted, the Center shall document (i) the Patient’s request; (ii) notice of the granted request; (iii) any subsequent agreed-upon modifications or revocations of the agreed restriction; and (iv) if the Center modification or revocation is not agreed to by the Patient, any written notification to the Patient of such unilateral modifications or revocations.
b. If a Patient’s request is denied, the Center shall document both the request and written denial of such request. Any such documentation shall be retained in accordance with this Manual.
HIPAA Regulatory Citation: 45 CFR § 164.522(a)
Effective: 04/14/2003
Revised: 05/26/2015, 04/13/2013
Reviewed: 10/21/2022, 03/24/2021, 12/08/2015
Heather Zimmerman, HIPAA Privacy Officer
UT Dallas Callier Center
