POLICY: Patients will be provided the right to request restriction of certain uses and disclosures of their PHI. Exceptions include psychotherapy notes, information compiled for use in civil, criminal or administrative actions, and information that is subject to prohibition by the Clinical Laboratory Improvements Amendments (CLIA A determination to restrict uses or disclosures is to be made very carefully to ensure the request can be met. The facility may deny a request under certain circumstances.

Emergency Treatment Exception: If the facility agrees to a restriction, HIPAA privacy regulations provide an exception in emergency treatment situations for a hospital or provider to use and disclose necessary information to treat the patient.

PURPOSE: To ensure patients the right to request privacy restrictions on the use or disclosure of their protected health information (PHI) as required by the Health Insurance Portability and Accountability Act (HIPAA), Standards for privacy of Individually Identifiable Health Information (Privacy Standards), 45 CFR Parts 160 and 164, and any and all other Federal regulations and interpretive guidelines promulgated thereunder.

PROCEDURES:

Requests for Restrictions:

1. Patients have the right to request restrictions on the use and disclosure of PHI as contained in the medicalrecord.
2. Requests for restrictions must be presented in writing (attachment - Request for Restriction On Use orDisclosure of PHI) and must be specific to the episode(s) of treatment for which the restriction isrequested.
3. Written requests are to be routed to the respective facility medical record custodian or designee i.e.,facility health information management director (or designee) or outreach clinic manager (or designee) forreview and consideration.
4. The request for restriction is to be maintained as a permanent part of the patient’s medical record.

Responses to the Requests for Restrictions

1. CFVHS may approve or deny a request for restriction. The request for restriction is reviewed andinvestigated as needed, prior to approval or denial.
2. If CFVHS approves the request for a restriction:
   1. PHI may not be used or disclosed in violation of such restriction.
   2. PHI may be used or disclosed if the individual who requested the restriction is in need ofemergency treatment and the restricted PHI is needed to provide emergency treatment. CFVHSmay use or disclose restricted PHI to a health care provider to provide such treatment to theindividual.
   3. If restricted PHI is disclosed to another health care provider for emergency treatment, CFVHSwill request that the health care provider not further use or disclose the PHI.
   4. The medical record custodian or designee provides written response to the patient regarding the approval of the request (attachment - Response to Request for Restriction)
   5. The medical record custodian or designee is responsible for indicating in the master patient index, that there has been a restriction placed on the record. The medical record custodian or designee ensures that the notification of restriction also becomes a permanent part of the medical record (electronic or paper)
   6. The approval of restriction does not prevent the uses and disclosures for which patient authorization, consent or opportunity to agree or object is not required.
   7. The approval of restriction does not prevent the inclusion of PHI in the facility directory if the restriction is not specific to the facility directory and the policy outlining facility directory information is followed.
3. If CFVHS denies the request for a restriction:
   1. 1.The medical record custodian or designee provides written response to the patient regarding the denial of the request (attachment - Response to Request for Restriction)
   2. The medical record custodian or designee includes the request for restriction and the denial of restriction in the patient's medical record (electronic or paper)
   3. The denial does not prevent uses or disclosures being made to the individual for inspection and copying their own PHI.
   4. The denial does not prevent the individual from obtaining an accounting of disclosures of PHI.

Terminating Restrictions

A facility may terminate the agreement to a restriction if:

• The individual agrees to or requests the termination in writing;
• The facility informs the individual that it is terminating the restriction.

The responsible Cape Fear Valley Health System staff member retains the completed Termination of Restriction form with the specified medical record. (attachment - Termination of Restriction on Use or Disclosure of Protected Health Information)

This request for restriction of use or disclosure of protected health information will be reviewed by the respective facility record custodian. A written response of approval or denial will be provided to the address as indicated above.