If a client requests a restriction for disclosure of a certain part of their PHI to a health plan, the health care provider is:

Question

Options

• ARequired to agree to the requested restriction if the disclosure is for treatment or payment, is not
• BRequired to agree only if the client specifies why he/she wants the restriction
• CRequired to agree only if the client specifies who he/she wants the restriction to apply to
• DRequired to agree to the requested restriction

• A
  94% (30)
• B
  3% (1)
• C
  3% (1)

Explanation

Option A reflects the HIPAA Omnibus Rule mandate under 45 CFR §164.522, which requires a health care provider to honor a patient's restriction request when the PHI pertains to a service the patient paid for out-of-pocket in full, and the disclosure would go to a health plan for payment or health care operations - not for treatment purposes. This is the one scenario where agreement is legally mandatory, not discretionary.

Why the distractors are wrong:

• B is incorrect because a client's stated reason for wanting a restriction is irrelevant to the provider's obligation - HIPAA does not require justification from the patient.
• C is incorrect because identifying who the restriction applies to is also not a legal prerequisite; the obligation is triggered by payment status and disclosure purpose, not by the client naming a recipient.
• D is a trap - providers are generally not required to agree to all restriction requests; mandatory agreement only applies in the specific circumstance in A.

Memory tip: Think "Pay = Power to Restrict." When the patient pays fully out of pocket, they gain the power to restrict disclosure to the health plan - that's the one case where the provider has no choice but to comply.

No community discussion yet for this question.