NRPM: Standards for Privacy of Individually Identifiable Health Information. 2. Individual requests for restricting uses and disclosures.


We propose to require covered health care providers to document how they would implement an individual’s request to restrict uses and disclosures. Under proposed § 164.506(c)(1)(iii), a covered entity need not agree to such restrictions. This section of the documentation would describe who (if anyone) in the covered entity is permitted to agree to such restrictions, and if such restrictions were accepted, how they would be implemented. For example, a provider may require that once an individual has requested a limitation on a use or disclosure, the affected information is stamped, marked or kept in a separate file. The provider could also have a policy of never agreeing to requests for such restrictions.