Patient Rights

Back Next

Right to Request Restrictions and Alternative Methods of Communication

The HIPAA Privacy Rule gives individuals the right to request restriction on the uses or disclosures of the PHI. For example, an individual may request that a particular medical procedure be kept confidential and not shared with other providers. Although agencies are not required to agree to such restrictions, if they enter into an agreement to restrict, they must abide by the agreement, except in emergency circumstances.

The HIPAA Privacy Rule also gives individuals the right to request that communications of PHI be made by alternative means or at alternative locations. For example, an individual may request that they are called at work instead of at home. All reasonable requests must be accommodated and shall not require an explanation from the individual as to why they are making such a request.

Right to Receive an Accounting of Disclosures

Individuals have the right to receive an itemized list of certain disclosures of their PHI that are made during the six years prior to the date that the individual requests the accounting, including disclosures to or by business associates. Generally, agencies must provide the individual with an accounting within 60 days after receiving such a request. It must include:

• the date of each disclosure;

• the name and, if known, the address of the organization or person who received the information;

• a description of the information disclosed; and

• a statement of the purpose of the disclosure.

Because agencies are required to provide individuals with an accounting of disclosures, they must document certain disclosures made.