What restrictions can I request?

You can request restrictions on use for treatment, payment, or healthcare operations. You can also ask that information not be disclosed to specific family members or employers, or limit disclosures to certain purposes.

Can a provider refuse my restriction request?

Yes, providers can decline restriction requests. However, if you pay out-of-pocket and request restrictions on payment disclosures, providers must honor that request.

How long does a restriction last?

Restrictions last until you revoke them in writing. You can request removal of restrictions at any time. Once revoked, they are no longer binding.

Your Right to Request Restrictions on PHI Use

Q: Can I restrict how my medical information is used?

Yes, you can request restrictions on how your healthcare provider uses and discloses your protected health information. However, the provider is not required to agree to your request.

Quick Answer

You have the right to request restrictions on how your healthcare provider uses and discloses your protected health information. Submit written requests to your provider, but note that they can refuse most requests. However, if you pay out-of-pocket, providers must honor restrictions on sharing information with insurance companies.

Understanding Your Right to Request Restrictions

While healthcare providers have broad rights to use and share your medical information for treatment, payment, and operations, you can request limitations on these uses. This gives you more control over your private health data.

Common Restriction Requests

Don't share my information with my employer
Don't send information to specific family members
Don't use my information for marketing purposes
Don't share my mental health records with my primary care doctor
Don't disclose my information to insurance if I pay out-of-pocket
Limit use to specific types of care (e.g., only mental health treatment)
Don't contact me for appointment reminders or surveys

Important Limitations on Restrictions

Providers are not required to agree to your requests (except for out-of-pocket restriction)
Restrictions must still allow information use for treatment and legal obligations
Once agreed, both you and the provider can ask to terminate restrictions
Emergency situations may override restrictions
You cannot restrict disclosures already made

How to Request Restrictions on Your Information

Decide What Restrictions You Want

Think carefully about what restrictions would protect your privacy. Be specific about what you want restricted (e.g., "don't share mental health information with my employer") and why (if applicable).

Contact Your Healthcare Provider

Reach out to your provider's privacy officer or medical records department. Ask how they handle restriction requests and whether they have a form you must use.

Submit Your Request in Writing

Put your request in writing via email, mail, or in-person. Include specific details about what you want restricted, who you want it restricted from, and which information should be restricted.

Keep Documentation

Keep copies of your request and any written responses from the provider. If they agree, ask for written confirmation of the restrictions in place.

Monitor Compliance

If your restriction is agreed to, verify it's being followed. If you discover violations, contact the provider's privacy officer immediately and file a complaint if necessary.

Modify or Revoke as Needed

You can request to modify or remove restrictions at any time by submitting another written request to the provider.

Sample Restriction Request Letter

[YOUR NAME] [YOUR ADDRESS] [YOUR PHONE NUMBER] [YOUR EMAIL] [DATE] Privacy Officer / Medical Records Department [PROVIDER NAME] [PROVIDER ADDRESS] Re: Request for Restrictions on Use and Disclosure of Protected Health Information Dear Privacy Officer, I am requesting restrictions on the use and disclosure of my protected health information as permitted under HIPAA. Patient Information: Full Name: [YOUR FULL NAME] Date of Birth: [YOUR DOB] Medical Record Number: [YOUR MRN, if known] Requested Restrictions: I request that my [SPECIFIC INFORMATION - e.g., "mental health records," "substance abuse treatment information," or "all medical information"] NOT be: - Disclosed to [SPECIFIC PERSON/ORGANIZATION] - Used for [SPECIFIC PURPOSE - e.g., "marketing," "contact for appointment reminders"] - Shared with my insurance company (I will pay out-of-pocket for this care) Reason for Restriction: [Brief explanation of why this restriction is important to you - optional but recommended] I understand you may accept or deny this request. Please provide written confirmation of your decision within 30 days. If you have questions, please contact me at [PHONE] or [EMAIL]. Thank you, [YOUR SIGNATURE] [YOUR PRINTED NAME]