[Code of Federal Regulations]
[Title 45, Volume 1]
[Revised as of October 1, 2001]
From the U.S. Government Printing Office via GPO Access
[CITE: 45CFR164.522]

[Page 718-719]
 
                        TITLE 45--PUBLIC WELFARE
 
                    SUBTITLE A--DEPARTMENT OF HEALTH
                           AND HUMAN SERVICES
 
PART 164--SECURITY AND PRIVACY--Table of Contents
 
   Subpart E--Privacy of Individually Identifiable Health Information
 
Sec. 164.522  Rights to request privacy protection for protected health information.

    (a)(1) Standard: Right of an individual to request restriction of 
uses and disclosures. (i) A covered entity must permit an individual to 
request that the covered entity restrict:
    (A) Uses or disclosures of protected health information about the 
individual to carry out treatment, payment, or health care operations; 
and
    (B) Disclosures permitted under Sec. 164.510(b).
    (ii) A covered entity is not required to agree to a restriction.
    (iii) A covered entity that agrees to a restriction under paragraph 
(a)(1)(i) of this section may not use or disclose protected health 
information in violation of such restriction, except that, if the 
individual who requested the restriction is in need of emergency 
treatment and the restricted protected health information is needed to 
provide the emergency treatment, the covered entity may use the 
restricted protected health information, or may disclose such 
information to a health care provider, to provide such treatment to the 
individual.
    (iv) If restricted protected health information is disclosed to a 
health care provider for emergency treatment under paragraph (a)(1)(iii) 
of this section, the covered entity must request that such health care 
provider not further use or disclose the information.
    (v) A restriction agreed to by a covered entity under paragraph (a) 
of this

[[Page 719]]

section, is not effective under this subpart to prevent uses or 
disclosures permitted or required under Secs. 164.502(a)(2)(i), 
164.510(a) or 164.512.
    (2) Implementation specifications: Terminating a restriction. A 
covered entity may terminate its agreement to a restriction, if :
    (i) The individual agrees to or requests the termination in writing;
    (ii) The individual orally agrees to the termination and the oral 
agreement is documented; or
    (iii) The covered entity informs the individual that it is 
terminating its agreement to a restriction, except that such termination 
is only effective with respect to protected health information created 
or received after it has so informed the individual.
    (3) Implementation specification: Documentation. A covered entity 
that agrees to a restriction must document the restriction in accordance 
with Sec. 164.530(j).
    (b)(1) Standard: Confidential communications requirements. (i) A 
covered health care provider must permit individuals to request and must 
accommodate reasonable requests by individuals to receive communications 
of protected health information from the covered health care provider by 
alternative means or at alternative locations.
    (ii) A health plan must permit individuals to request and must 
accommodate reasonable requests by individuals to receive communications 
of protected health information from the health plan by alternative 
means or at alternative locations, if the individual clearly states that 
the disclosure of all or part of that information could endanger the 
individual.
    (2) Implementation specifications: Conditions on providing 
confidential communications.
    (i) A covered entity may require the individual to make a request 
for a confidential communication described in paragraph (b)(1) of this 
section in writing.
    (ii) A covered entity may condition the provision of a reasonable 
accommodation on:
    (A) When appropriate, information as to how payment, if any, will be 
handled; and
    (B) Specification of an alternative address or other method of 
contact.
    (iii) A covered health care provider may not require an explanation 
from the individual as to the basis for the request as a condition of 
providing communications on a confidential basis.
    (iv) A health plan may require that a request contain a statement 
that disclosure of all or part of the information to which the request 
pertains could endanger the individual.