Skip to main content


U.S. flag
      An official website of the United States government
              Here’s how you know
        Here’s how you knowDot gov**Official websites use .gov**
                 A **.gov** website belongs to an official government organization in the United States.
                  HTTPS**Secure .gov websites use HTTPS**
                 A **lock** (A locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. 
  Menu Close
          Enter the terms you wish to search for.
    Search
        








  
  
    

  
      

                                      About HHS
    
                        
                              
      
      
      Programs & Services
    
                        
                              
      
      
      Grants & Contracts
    
                        
                              
      
      
      Laws & Regulations                  
Health Information Privacy
  HIPAA for Individuals
    
                        
                                            
      
      
      Filing a Complaint
    
                        
                                            
      
      
      HIPAA for Professionals
    
                        
                                            
      
      
      Newsroom

              

    



Breadcrumb
    HHS
                              HIPAA Home
                              For Professionals
                              FAQ
                              Can an individual restrict who has access to their protected health information during a medical procedure?


    

    

    Navigate to:
  Authorizations (30)
          Business Associates (41)
          Compliance Dates (2)
          Covered Entities (14)
          Decedents (9)
          Disclosures for Law Enforcement Purposes (5)
          Disclosures for Rule Enforcement (1)
          Disclosures in Emergency Situations (2)
          Disclosures Required by Law (6)
          Disclosures to Family and Friends (28)
          Disposal of Protected Health Information (6)
          Facility Directories (7)
          Family Medical History Information (3)
          FERPA and HIPAA (10)
          Group Health Plans (3)
          Incidental Uses and Disclosures (10)
          Judicial and Administrative Proceedings (8)
          Minimum Necessary (14)
          Notice of Privacy Practice (20)
          Preemption of State Law (10)
          Privacy Rule: General Topics (12)
          Protected Health Information (2)
          Public Health Uses and Disclosures (13)
          Research Uses and Disclosures (20)
          Right to an Accounting of Disclosures (8)
          Right to File a Complaint (1)
          Right to Request a Restriction (4)
          Safeguards (13)
          Security Rule (24)
          Smaller Providers and Businesses (145)
          Student Immunizations (8)
          Transition Provisions (3)
          Treatment, Payment, and Health Care Operations Disclosures (30)
          Workers Compensation Disclosures (5)
          Limited Data Set (6)
          Marketing (17)
          Marketing - Refill Reminders (16)
          Personal Representatives and Minors (12)
          Right to Access and Research (58)
          Mental Health (35)
          Health Information Technology (41)
          Telehealth (11)Text resize icon

                    




Can an individual restrict who has access to their protected health information during a medical procedure?








  
  
    

  
      





Answer

**Yes**, if their health care provider agrees to the restriction. The Health Insurance Portability and Accountability Act of 1996 (HIPAA)1 Privacy Rule2 requires covered entities3 to allow individuals4 ****to request**** that the covered entities restrict the use and disclosure of their protected health information (PHI) for treatment, payment, or health care operations.5 A covered entity generally is not required to agree to the requested restrictions.6 However, if a covered entity agrees to an individual’s requested restriction, it must comply with the agreed-upon restriction, except for purposes of treating the individual in a medical emergency or under certain other circumstances specified in the Privacy Rule.7 The covered entity must also document the agreed-upon restriction.8

Example 1: An individual who is scheduled for abdominal surgery and concerned about medical trainees observing a pelvic exam without their consent, while they are unconscious, may request that a covered health care provider not use or disclose their PHI to medical trainees. If the covered health care provider agrees to the restriction request, the provider may not use or disclose the individual’s PHI to medical trainees, even if the medical trainees are members of the covered health care provider’s workforce, **with the result that the medical trainees cannot be in the room with the individual and their PHI, or otherwise have access to the individual’s PHI**.9 As such, the restriction would prevent the medical trainees from observing or providing treatment to the individual, except as needed to provide emergency treatment or where another exception applies.Under the emergency treatment exception, when a patient who requested the restriction is in need of emergency treatment, a covered entity is permitted to use or disclose only the restricted PHI ****that is needed to provide the emergency treatment****.10

Example 2: If a covered health care provider previously agreed to a patient’s request to restrict disclosures of their PHI to medical trainees in advance of a planned abdominal surgery (Example 1) and the same individual subsequently presents to the emergency room for chest pain, the health care provider would be permitted to disclose to medical trainees participating in the emergency treatment only the individual’s PHI **that is needed to treat the patient for chest pain**. The covered entity could not disclose any additional PHI to the medical trainee.Endnotes

1 Subtitle F of title II of HIPAA, Pub. L. 104–191, 110 Stat. 1936 (Aug. 21, 1996).

2 45 CFR parts 160 and 164 subparts A and E.

3 45 CFR 160.103 (definition of “Covered entity”).

4 45 CFR 160.103 (definition of “Individual”).

5 *See* 45 CFR 164.522(a)(1)(i)(A).

6 *See* 45 CFR 164.522(a)(1)(ii). A covered entity must agree to the request of an individual to restrict the disclosure of PHI about the individual to a health plan in certain circumstances. *See*45 CFR 164.522(a)(1)(vi).

7 *See* 45 CFR 164.522(a)(1)(iii) and (v).

8 *See*45 CFR 164.522(a)(1)(iii) and 45 CFR 164.530(j).

9 When a patient is receiving treatment, they are typically surrounded by PHI, such as their name on a hospital room door or identification bracelet, notes about their care, real-time displays of heart or lung function, and verbal communications about their health status and health care.

10 *See* 45 CFR 164.522(a)(1)(iii) and (iv).

                    
  


Content created by Office for Civil Rights (OCR) Content last reviewed March 28, 2024Back to top
    Contact HHS
    
                        
                                            
      
      
      Careers
    
                        
                                            
      
      
      HHS FAQs
    
                        
                                            
      
      
      Nondiscrimination NoticeHHS Archive
    
                        
                                            
      
      
      Accessibility Statement
    
                        
                                            
      
      
      Privacy Policy
    
                        
                                            
      
      
      Viewers & PlayersBudget/Performance
    
                        
                                            
      
      
      Inspector General
    
                        
                                            
      
      
      Web Site Disclaimers
    
                        
                                            
      
      
      EEO/No Fear ActFOIA
    
                        
                                            
      
      
      The White House
    
                        
                                            
      
      
      USA.gov
    
                        
                                            
      
      
      Vulnerability Disclosure Policy
        Sign Up for Email Updates

Receive the latest updates from the Secretary, Blogs, and News Releases.

Sign Up
  HHS Headquarters
          200 Independence Avenue, S.W.
                  Washington, D.C. 20201
                  Toll Free Call Center: 1-877-696-6775​