Skip to Main Navigation
Skip to Main Content
The University of Texas at Dallas

HIPAA Privacy Manual

Section 11: Requests to Restrict Access to PHI

Definition:

Restriction:

An agreed upon limitation on use and disclosure of PHI about an individual to carry out Treatment, Payment or health care Operations (TPO) and disclosures for involvement in the individual’s care. For instance, UTD may use and disclose PHI for TPO but the patient may request UTD not to use or disclose PHI for other instances.

Policy:

Right of an Individual to Request Restrictions on Uses and Disclosures

UTD must permit an individual to request that UTD restrict uses and disclosures of PHI about the individual to carry out TPO.

UTD is not required to agree to a restriction. If UTD does agree to a restriction, UTD may not use or disclose PHI in violation of such restriction, except that, if the individual who requested the restriction is in need of emergency treatment and the restricted PHI is needed to provide emergency treatment. UTD may use the restricted PHI itself or UTD may disclose such restricted PHI to a health care provider to provide such treatment to the individual. If restricted PHI is disclosed to another health care provider for emergency treatment, as outlined above, UTD must request that the health care provider not further use or disclose the PHI. A restriction agreed to by UTD is not effective to prevent uses or disclosures from being made to the individual for inspection and copying their own PHI, the individual from obtaining an accounting of disclosures of PHI, the inclusion of a facility directory if the policy outlining facility directories is followed, or for uses and disclosure for which consent, authorization or opportunity to agree or object is not required.

Terminating a Restriction:

UTD may terminate its agreement to a restriction if:

  1. The individual agrees to or requests the termination in writing,
  2. The individual orally agrees to the termination and the oral agreement is documented, or
  3. UTD informs the individual that it is terminating the restriction. Any PHI created and received after the termination will not be restricted. However, any PHI created or received before the termination will be restricted.

Documentation:

UTD must maintain the policies and procedures required by the HIPAA Privacy regulations in written or electronic form, whenever a communication is required to be in writing, UTD will maintain such writing, or an electronic copy, as documentation; or an action, activity or designation is required to be documented. UTD will maintain a written or electronic record of such action, activity, or designation.

Confidential Communications:

A request for restricting confidential communications can occur anytime and requires a change in the patient’s designated address. UTD must permit individuals to request and must accommodate reasonable requests by individuals to receive communications of PHI from UTD by alternative locations. It is up to the patient to change the address back to the original designated address. UTD may require the individual to make a request for confidential communication in writing. UTD may condition the provision of a reasonable accommodation on:

  1. When appropriate, information as to how payment, if any, will be handled; and
  2. Specifications of an alternative address or other method of contact.

UTD may not require an explanation from the individual as to the basis for the request as a condition of providing communications on a confidential basis.

Enforcement:

All supervisors are responsible for enforcing this policy. Individuals who violate this policy will be subject to the appropriate and applicable disciplinary process, up to and including termination or dismissal.