NRPM: Standards for Privacy of Individually Identifiable Health Information. c. Right to restrict.


We propose to permit in § 164.506(c) that individuals be able to request that a covered entity restrict further uses and disclosures of protected health information for treatment, payment, or health care operations, and if the covered entity agrees to the requested restrictions, the covered entity may not make uses or disclosures for treatment, payment or health care operations that are inconsistent with such restrictions, unless such uses or disclosures are mandated by law. This provision would not apply to health care provided to an individual on an emergency basis.

It should be noted that there is nothing in this proposed rule that requires a health care provider to agree to a request to restrict uses or disclosures for treatment, payment, or health care operations. Providers who do not wish to, or due to contractual obligations cannot, restrict further use or disclosure are not obligated to treat an individual making a request under this provision.

If small entities view this proposed provision as overly burdensome, they would not have to provide treatment to individuals requesting restrictions. We considered requiring that providers conform to requests to restrict use or disclosures. We rejected this approach due to the potential ethical conflicts these restrictions could pose to health care professionals and the possible burden to providers. Providers comprise a large proportion of the small businesses covered under this proposed regulation.