PRIVACY POLICY AND PROCEDURES	Policy #: 2100.9
LSU Health Sciences Center New Orleans Date Effective: April 14, 2003	Table of Contents

Restriction Policy

Patient’s Request for Restriction of Uses and Disclosures of Their Protected Health Information

SCOPE:

All Louisiana State University (LSU) System health care facilities and providers including, but not limited to hospitals, physician practices, clinics, schools, etc. on the LSU Health Sciences Center New Orleans Academic Campus.

Nota Bene: All LSU System health care facilities and providers including, but not limited to hospitals, physician clinics, schools, etc. on the LSU Health Sciences Center New Orleans Academic Campus, are referred to in this policy as LSUHSC-NO.

PURPOSE:

To provide guidance to the health care facilities and providers affiliated with the LSU System on a patient’s right to request restriction(s) of the uses and disclosures of their Protected Health Information to carry out treatment, payment, health care operations, or for involvement in the individual’s care and notification purposes as required by the Health Insurance Portability and Accountability Act, Standards for Privacy of Individually Identifiable Health Information (HIPAA Privacy Regulations), and any other applicable state or federal laws or regulations.

POLICY:

All LSU System health care facilities and providers must provide patients with a right to request a restriction of the uses and disclosures of their Protected Health Information that is contained in a Designated Record Set. The HIPAA Privacy Regulations require health care providers to provide patients with a right of access to inspect and obtain a copy of their Protected Health Information.

DEFINITIONS:

Protected Health Information (PHI) – for purposes of this policy means individually identifiable health information that relates to the past, present or future health care services provided to an individual. Examples of Protected Health Information include medical and billing records of a patient.

Privacy Officer – Person designated by LSUHSC-NO as the Privacy Officer.

For the definition of "Designated Record Set"

The term “record” means any item, collection, or grouping of information that includes PHI and is maintained, collected, used or disseminated by or for LSUHSC-NO.
The term “record” also includes patient information originated by another health care provider and used by LSUHSC-NO to make decisions about a patient.
The term “record” includes tracings, photographs, and videotapes, digital and other images that may be recorded to document care of the patient.

Designated Record Set - is a group of records maintained by or for LSUHSC-NO that are:

The medical records and billing records about individuals maintained by or for the LSUHSC-NO; or
Any records used, in whole or part, by or for the LSUHSC-NO to make decisions about individuals.
Any record that meets this definition of Designated Record Set and which are held by a HIPAA Business Associate of LSUHSC-NO are part of LSUHSC-NO’s Designated Record Set.

PROCEDURE:

1.0	A patient has the right to request in writing that LSUHSC-NO restrict:
1.1	Uses or disclosures of PHI about the patient used to carry out treatment, payment or health care operations; and
1.2	Disclosures of PHI to persons involved with the patient’s care or payment or for notification purposes.
2.0	The patient’s request for restriction should be forwarded to the Privacy Officer who will determine whether the request can be accommodated.
3.0	LSUHSC-NO does not have to agree to a restriction requested by the patient. If the Privacy Officer agrees to a requested restriction, the patient shall be notified in writing that the request has been granted.
4.0	If the requested restriction is denied, the patient should be notified in writing of the denial.
5.0	If Privacy Officer agrees to the restriction, LSUHSC-NO must abide by such restriction, except:
5.1	If the patient is in need of emergency treatment and the restricted PHI is needed to provide the emergency treatment.
5.2	If restricted PHI is disclosed under this exception, LSUHSC-NO must request that the emergency care provider not further use or disclose the restricted PHI.
5.3	If restricted PHI is disclosed to a health care provider, LSUHSC-NO must request that the health care provider not further use or disclose the restricted PHI.
6.0	A restriction agreed to by LSUHSC-NO is not effective to prevent uses or disclosures permitted or required to the Department of Health and Human Services, for facility directories and where the patient’s opportunity to object is not required.
7.0	LSUHSC-NO may terminate its agreement to a restriction, if:
7.1	The patient agrees to or requests the termination in writing;
7.2	The patient orally agrees to the termination and the oral agreement is documented; or
7.3	LSUHSC-NO informs the patient that it is terminating the agreement. This termination is only effective with respect to Protected Health Information created or received after LSUHSC-NO has informed the patient.
8.0	All correspondence and associated documentation related to patient requests for restrictions, including denials, must be maintained and retained for 6 years.

REFERENCE:

45 C.F.R. § 164.522