It is the policy of Purdue University to permit an individual or their representative to request a restriction of the use and disclosure of their protected health information (PHI) to carry out treatment, payment or healthcare operations or for involvement in the individual’s care and notification purposes, and for the request to be promptly reviewed.
If an individual requests a restriction of the disclosure of their PHI, Purdue covered components must comply with the requested restriction, if (1) the disclosure is to a health plan for purposes of carrying out payment or health care operations, is not for purposes of carrying out treatment and is not otherwise required by law; and (2) the PHI pertains solely to a health care item or service for which the individual, or person on behalf of the individual, has paid the covered component in full. The restriction includes prohibition of disclosures to the individual’s health plan and also business associates of the health plan and may include only the health care items or services for which the restriction was requested and where the items were paid in full.
Regarding other requested restrictions, Purdue University is not required to agree to the restriction. However, if the HIPAA Privacy Officer agrees to such restriction, Purdue may not use or disclose the PHI in violation of the restriction. If the individual who requested the restriction is in need of emergency treatment and the restricted information is needed to provide the emergency treatment, Purdue may use the restricted information or may disclose the information to a health care provider to provide such treatment and must request that the health care provider not further use or disclose the information.
Any restriction agreed to by Purdue is not effective to prevent the following uses or disclosures permitted or required in the HIPAA Privacy Rule: uses or disclosures to the Secretary of Health and Human Services; facility directory information; required by law, for public health activities, about victims of abuse, neglect or domestic violence, for health oversight activities, for judicial or administrative proceedings, for enforcement purposes, about decedents, for cadaveric organ, eye or tissue donation purposes, for research purposes, to avert a serious threat to health or safety, or for specialized government functions.
Request for the Restriction of the Use or Disclosure of PHI - Policy and Procedure (pdf)