1. Purpose

1.1. East Carolina University's Health Care Components ("ECU's Health Care Components") have a legal duty to permit an individual to request restriction of uses and disclosures of his/her protected health information ("PHI"). The purpose of this regulation is to describe the manner in which an individual's requests for restrictions of uses and disclosures of PHI will be processed.

2. Regulation

2.1. It is the policy of ECU's Health Care Components to permit individuals to request restrictions of uses and disclosures of their PHI for treatment, payment activities, health care operations, and of disclosures to family members, other relatives, close personal friends of the individual, or any other person identified by the individual involved in their care. Except as provided in paragraph 3.5 below, ECU Health Care Components are not required to agree or comply with all requests for restrictions; however, if a Component agrees to a restriction, it must abide by the restrictions except in emergencies and in situations where use or disclosure is permitted by HIPAA without an authorization.

3. Procedure

3.1. Written Request.

An individual may request to restrict the use or disclosure of PHI by completing a Request for Restrictions on the Use and Disclosure of Protected Health Information form and returning it to the ECU HIPAA Privacy Office.

3.2. Review of Request.

The ECU HIPAA Privacy Officer will review the individual's request for restrictions. Determination on whether to accept and comply with the request should, at a minimum, be based on the impact or limitations on further treatment, assurance of payment for services and the mechanisms available that would ensure such restrictions could be accommodated within the organization. The individual making the request will be informed of the outcome of this review in writing using the Response to Patient Request for Restrictions on the Use and Disclosure of PHI form. If approved, the ECU HIPAA Privacy Officer will coordinate this restriction within the appropriate ECU Health Care Component.

3.3. Use of Restricted Information in Emergency Situations.

An ECU Health Care Component that agrees to a restriction may not use or disclose PHI in violation of such restriction, except that, if the individual who requested the restriction is in need of emergency treatment and the restricted PHI is needed to provide the emergency treatment, the Component may use the restricted PHI or disclose such information to a health care provider to provide such treatment to the individual.

3.3.1. In such emergency cases, the Component must request that such health care provider not further use or disclose the restricted information.

3.4. Limitations to Restrictions.

Restrictions agreed to by an ECU Health Care Component are not effective to prevent uses or disclosures of the following items:

3.4.1. Required by the Secretary of Health and Human Services to investigate or determine the ECU Health Care Components' compliance with HIPAA

3.4.2. Required by law;

3.4.3. For public health activities;

3.4.4. About victims of abuse, neglect or domestic violence;

3.4.5. For health oversight activities;

3.4.6. For judicial and administrative proceedings;

3.4.7. For law enforcement purposes;

3.4.8. About decedents requested by coroners and medical examiners as well as funeral directors;

3.4.9. For cadaveric organ, eye or tissue donation purposes;

3.4.10. For research purposes, subject to the conditions set forth in HIPAA Privacy Regulations;

3.4.11. To avert a serious threat to health or safety;

3.4.12. For specialized government functions, such as military activities and national security/intelligence activities; or

3.4.13. For worker's compensation.

3.5. Required Approvals.

An ECU Health Care Component must approve an individual's request for restriction on disclosure of PHI about the individual to a health plan or a business associate of a health plan if:

3.5.1. The disclosure is for purposes of carrying out payment or health care operations and is not otherwise required by law; and

3.5.2. The PHI pertains solely to a health care item or service for which the individual, or person other than the health plan on behalf of the individual, has paid the ECU Health Care Component in full.

3.5.2.1. ECU Health Care Components should counsel the patient about self-payment policies and procedures and how those policies may affect his/her request for restriction and that ECU Health Care Components may seek alternative sources of payment in accordance with those payment policies/procedures, including submission of the claim to the health plan, if payment is not received in accordance with those policies and procedures.

3.5.2.1.1. Note for Medicare Patients: Section 1848 of the Social Security Act requires a physician or supplier to submit claims to Medicare unless the patient (the Medicare beneficiary) refuses of his/her own free will to authorize the submission of the bill to Medicare. ECU Health Care Components should counsel patients that such Component will submit the claim for service to Medicare unless the beneficiary refuses to authorize the submission of the claim and makes such refusal in writing.

3.6. Termination of Restriction.

An ECU Health Care Component, through the ECU HIPAA Privacy Office, may terminate a restriction if:

3.6.1. Initiated by the Individual:

3.6.1.1. The individual agrees to or requests the termination in writing by completing the Patient Request for Termination of Restrictions form;

3.6.1.2. The individual orally agrees to the termination and the oral agreement is documented by having the individual complete the Patient Request for Termination of Restrictions form; or

3.6.2. Initiated by an ECU Health Care Component:

3.6.2.1. The Component informs the individual that it is terminating its agreement to a restriction, except that such termination is:

3.6.2.1.1. Not effective for PHI restricted under paragraph 3.5; and

3.6.2.1.2. Only effective with respect to PHI created or received after it has informed the individual.

3.6.2.2. If an ECU Health Care Component initiates a termination of the restriction, the ECU HIPAA Privacy Officer will contact the individual in writing using the Notice of Termination of Previously Approved Request for Restrictions on the Use and Disclosure of PHI form.

3.7. Documentation.

ECU Health Care Components shall ensure that restrictions that are agreed to and the termination of agreed upon restrictions must be documented in the individual's designated record set. Documentation including all forms will be retained as part of the individual's designated record set for a period of six years from the date of its creation or from the date it was last in effect, whichever is later.