HIPAA Privacy - Terminating a Restriction 164.522(a)(2)

Overview:
§164.522(a)(2)
Implementation specifications: Terminating a restriction.
A covered entity may terminate a restriction, if :
(i) the individual agrees to or requests the termination in writing;
(ii) the individual orally agrees to the termination and the oral agreement is documented; or
(iii) the covered entity informs the individual that it is terminating its agreement to a restriction, except that such termination is:
(A) Not effective for protected health information restricted under paragraph (a)(1)(vi) of this section; and
(B) Only effective with respect to protected health information created or received after it has so informed the individual.

Action Items:
1) Obtain and review policies and procedures related to terminating restrictions of use and/or disclosure of PHI.
2) If the covered entity has terminated a restriction, obtain and review a sample of documented terminated restriction to determine that the terminations are implemented consistent with the policies and procedures.

Related Documents:
1) Policies and procedures related to terminating restrictions of use and/or disclosure of PHI.
2) Sample of documented terminated restriction to determine that the terminations are implemented consistent with the policies and procedures.

Additional Guidance:
Individuals have the right to request that a covered entity restrict use or disclosure of protected health information for treatment, payment or health care operations, disclosure to persons involved in the individual’s health care or payment for health care, or disclosure to notify family members or others about the individual’s general condition, location, or death. A covered entity is under no obligation to agree to requests for restrictions. A covered entity that does agree must comply with the agreed restrictions, except for purposes of treating the individual in a medical emergency.