Standard for HIPAA Requests for Restrictions

Purpose

Ohio University will permit an individual to request a restriction on Ohio University’s uses or disclosures of the individual’s Protected Health Information (PHI). 

Scope

This standard shall apply to all Ohio University HIPAA Covered Entities. 

Standard

  1. Ohio University will permit an individual to request in writing a restriction on Ohio University’s uses or disclosures of the individual’s PHI.
  2. Ohio University is not required to agree to a requested restriction unless the request concerns a disclosure of PHI to a health plan for purposes of carrying out payment or health care operations, and the PHI pertains solely to a health care service for which Ohio University has been paid out of pocket in full.
  3. If Ohio University agrees to a restriction, it may not use or disclose PHI in violation of the restriction, except for when the restricted PHI is needed to provide emergency treatment to the individual.
  4. Ohio University may terminate its agreement to a restriction if:
    1. The individual agrees to or requests the termination in writing;
    2. The individual orally agrees to the termination and the oral agreement is documented; or
    3. Ohio University informs the individual that it is terminating its agreement to a restriction.
  5. Ohio University will document any agreed upon restriction.

Governance

This standard will be reviewed and approved by the University HIPAA Steering Committee, and other key stakeholders in the interest of ensuring the privacy and security of individual’s health information, as deemed appropriate based on the current regulatory requirement mandates. 

Status: Approved

Effective: September 24, 2019