Can You Keep A Secret?
HIPAA Privacy and You

Restricting Access

As part of our continuing series, this month’s article focuses on a patient’s right to restrict access to their health information. HIPAA gives patients the right to ask that we limit who has access to their protected health information (PHI) for the purposes of treatment, obtaining payment for treatment or for our internal operations (TPO). Below are some possible requests and the appropriate responses.

“I see in the NOPP that I can restrict access to my health information. How do I make sure that only Dr. Smith has access to my records?”
Patients can request a restriction using our “Request Restrictions” form. Our ability to agree to the request is determined by the Privacy Office. Although patients have the right to request restrictions, Yale is not required to accept the restriction if doing so jeopardizes the treatment of the patient or unreasonably impacts our normal business operations. Limiting access to PHI may mean that the patient’s treatment suffers because Dr. Smith is unable to discuss the case with other nurses and physicians and we could not bill for the treatment. We can, however, reassure the patient that our normal practices limit who has access to his/her records.

 “I’m involved in a law suit and I do not want you to release my records.”
HIPAA’s privacy protection does not supercede many of the existing laws which require or permit the release of PHI so we could not agree to this request. HIPAA requires us to release PHI for judicial proceedings as long as certain requirements are met. For example, if we receive a court-order to release the PHI, then we are required to provide the information.

“My neighbor Mary works in the billing department. I don’t want her to see any of my records.”
This is a case where, although we cannot comply with the request, we can reassure the patient that we make reasonable efforts to limit access to their PHI to those persons who need to see the information in order to carry out their duties. This means limiting access to the minimum necessary information needed in order to perform the task at hand. We can also assure the patient that Yale staff has been trained in the importance of maintaining patient privacy.

Other questions about a patient’s right to request restrictions?
If you or a patient have any other questions about requesting restrictions, confidential communications or any other aspects of HIPAA, you can contact the Privacy Office at hipaa@yale.edu or 436-3650. You can read our policies and procedures as well as print copies of our forms at http://www.hipaa.yale.edu/

What would you do?
Next month we will discuss authorizations for release of PHI. What would you do about the following? You receive a letter in the mail from a parent asking you to send a copy of their child’s records directly to a child care center. Should you go ahead and mail them out?

Join us next month for the answer to this and other thrilling HIPAA questions!