Skip to main content

Policy/Memo 121

Number: Policy Memo 121
Date Issued: April 14, 2003
Policy File Ref: A1830
Subject: Restriction of Disclosures of PHI, Individual Rights

PURPOSE:

To issue instructions to EBD workforce members regarding the process for individuals to request a restriction of certain uses and disclosures of protected health information (PHI) that are for activities related to treatment, payment and health care operations (TPO), or to persons involved in the individual's care.

HIPAA grants individuals the right to request a health plan to restrict certain uses and disclosures of protected health information (PHI) that are for treatment, payment and health care operations (TPO) or to persons involved in the individual's care. However, the health plan is not required to agree to such restrictions. Additionally, agreed-upon restrictions do not have the effect of preventing certain other types of uses and disclosures, as discussed below.

EBD's uses and disclosures of PHI for TPO include updates to Empire Plan carriers and HMOs of enrollment and demographic information, and to OSC, the retirement systems, state agencies and participating agencies and employers to obtain premium payments. Restriction of these uses and disclosures would likely interfere with the administration of NYSHIP and the provision of benefits to individuals.

Policy:

EBD shall consider all requests from individuals for restrictions on uses and disclosure of PHI for treatment, payment or health care operations, or to persons involved in the individual's care. Requests will be reviewed on a case-by-case basis for the impact the restriction will have on the provision of benefits to the individual, and the reasonableness of the request in accommodating it within EBD's operating structure. If the restriction is agreed upon, the agreement shall not be violated, unless the individual is in need of emergency treatment and the restricted PHI is needed to provide the emergency treatment.

Procedure:

Staff should instruct individuals to submit in writing any requests for EBD to restrict uses and disclosures of PHI for treatment, payment and health care operations (TPO) or to persons involved in the individual's care. TPO uses and disclosures involve those which NYSHIP undertakes to receive premium payments and to administratively operate the health plan, and include the specific instances outlined in Policy Memorandum Number 112. Individuals may also request restriction to the uses and disclosures of PHI for involvement in the individual's care or notification, including those made when the individual is not present, for disaster relief or as part of emergency notification.

All requests for restriction of uses and disclosures should be forwarded to the EBD Privacy Official for review.
The Privacy Official shall review the request and respond in writing to the individual of the approval or denial of the request.

If the decision is to comply with the request, the EBD Privacy Official will notify the appropriate staff of the manner in which to implement the restriction of the PHI.

If a restriction is agreed to, it nevertheless will not have the effect of preventing certain other types of uses and disclosures, as listed below:

  • To determine a covered entity's compliance with HIPAA privacy regulations;
  • Uses and disclosures for which authorization is not required, including:
    • uses and disclosures required by law;
    • uses and disclosures for public health activities;
    • disclosures about victims of abuse; neglect or domestic violence;
    • uses and disclosures for health oversight activities;
    • disclosures for judicial and administrative proceedings;
    • disclosures for law enforcement purposes;
    • uses and disclosures about decedents;
    • uses and disclosures for cadaveric organ, eye or tissue donation purposes;
    • uses and disclosures for research purposes;
    • uses and disclosures to avert a serious threat to health or safety;
    • uses and disclosures for specialized government functions; and
    • disclosures for workers compensation.

Termination of Restrictions

Once EBD agrees to a restriction, the restriction will be terminated only under the following conditions:

  • The individual requests in writing that the agreed upon restriction be terminated,
  • The individual requests or agrees orally to termination of the agreed upon restriction and EBD documents this agreement in writing, or
  • EBD decides to terminate an agreed upon restriction and the EBD Privacy Official notifies the individual in writing of the termination. In this case EBD will only terminate the restriction with respect to PHI it creates or receives after the date the individual is informed. The EBD Privacy Official shall also inform the appropriate staff of the termination by copy of the notification sent to the individual.

Documentation

All documentation regarding requests for restriction shall be documented and maintained for a period of six (6) years from its last date of effectiveness. Documentation regarding revocations shall be saved six (6) years from the date of revocation.