NRPM: Standards for Privacy of Individually Identifiable Health Information. iii. Disclosures of confidential information likely to reveal the source.


We propose that covered plans or providers be permitted to deny a request for inspection and copying if the entity determines that the requested information was obtained under a promise of confidentiality from someone other than a health care provider and such access would be likely to reveal the source of the information. This provision is intended to preserve an entity’s ability to maintain an implicit or explicit promise of confidentiality.

Covered plans and providers would not be permitted to deny access when the information has been obtained from another health care provider. An individual is entitled to have access to all information about him or her generated by the health care system (apart from the other exceptions we propose here), and confidentiality promises by health care providers to other providers should not interfere with that access.