Requesting Restrictions on Uses and Disclosure of Protected Health Information (PHI) for Treatment, Payment, and Health Care Operations

Title

The University of North Carolina at Chapel Hill Policy on Requesting Restrictions on Uses and Disclosure of Protected Health Information (PHI) for Treatment, Payment, and Health Care Operations

Policy

Pursuant to the Health Insurance Portability and Accountability Act of 1996, as modified by the Health Information for Economic and Clinical Health Act of 2009 ("HIPAA"), individuals have the right to request restrictions to the use and disclosure of his/her protected health information ("PHI") for treatment, payment and health care operations. The University of North Carolina at Chapel Hill ("UNC-Chapel Hill") Covered Components are not required to accept the requested restrictions; however, Covered Components must agree to a restriction to an individual's health plan for a health care service or item for which the individual or someone on his/her behalf has paid in full out of pocket. If the requested restriction is granted, the Covered Component must not make uses or disclosures that are inconsistent with such restrictions, unless such uses or disclosures are mandated by law. This provision will never apply to health care provided to an individual on an emergency basis.

Procedure

1. An individual must make a written request to the Covered Component to restrict the use and disclosure of PHI for treatment, payment or health care operations.
2. The Covered Component will determine the most efficient method of processing the requests for restriction.
3. If the Covered Component accepts the requested restriction, the provider will not violate such restriction, unless as specified within this policy and procedure.
4. The Covered Component is never permitted to accept an individual's request in the following situation(s):
   1. When the individual who requested the restriction is in need of emergency treatment and the restricted PHI is needed to provide the emergency treatment. If restricted PHI is disclosed to a health care provider for emergency treatment, UNC-Chapel Hill will request that such health care provider not further use or disclose the information.
   If a Covered Component agrees to an individual's requested restriction, the restriction does not apply to the following uses and disclosures:
   1. To an individual accessing their own PHI through proper procedures;
   2. To an individual requesting an accounting of their own PHI; or
   3. Instances for which consent, an authorization, or opportunity to agree or object is not required, such as judicial and administrative purposes; health oversight; research; law enforcement; public health; to avert a serious threat to health and safety; cadaveric organ, eye, or tissue donation; coroner or medical examiner; worker's compensation; victims of abuse, neglect or domestic violence; specialized government functions; required by law.
5. A Covered Component may terminate its agreement to a restriction in the following situations:
   1. The individual agrees to or requests the termination in writing;
   2. The individual orally agrees to the termination and the oral agreement is documented; or
   3. The Covered Component informs the individual that it is terminating its agreement to a restriction. Such termination is only effective with respect to PHI created or received after it has so informed the individual.
6. A Covered Component must document and retain the restriction for a period of at least 6 years from the date of its creation or the date when it last was in effect, whichever is later.
7. Knowledge of a violation or potential violation of this policy must be reported directly to the University's Chief Privacy Officer, or their designee.