2.4 Restrictions, Confidential Communications & Notice of Privacy Practices (NPP)

Restrictions, Confidential Communications & Notice of Privacy Practices (NPP)

The fourth cornerstone of HIPAA operational privacy governance encompasses the proactive mechanisms through which covered entities communicate their privacy practices, accommodate individual confidentiality preferences, and enforce statutory restrictions on data dissemination. Governed under 45 CFR § 164.520 and § 164.522, these operational procedures represent daily front-line compliance responsibilities for registration staff, health information management, and privacy leadership.

+---------------------------------------------------------------------------------------------------+
|                         PRIVACY RESTRICTIONS, COMMUNICATIONS & NPP MAP                           |
|                                                                                                   |
|   REQUEST FOR RESTRICTIONS        CONFIDENTIAL COMMUNICATIONS     NOTICE OF PRIVACY PRACTICES     |
|   (45 CFR § 164.522(a))           (45 CFR § 164.522(b))           (45 CFR § 164.520)              |
|   +---------------------------+   +---------------------------+   +---------------------------+   |
|   | GENERAL RULE:             |   | HEALTHCARE PROVIDERS:     |   | MANDATORY HEADER:         |   |
|   | Discretionary (CE is NOT  |   | MUST accommodate all      |   | Exact statutory wording   |   |
|   | required to agree)        |   | reasonable requests       |   |                           |   |
|   |                           |   | WITHOUT requiring reason  |   | DISTRIBUTION:             |   |
|   | HITECH MANDATORY EXCEPTION|   | or endangerment claim.    |   | - Date of first service   |   |
|   | MUST agree if:            |   |                           |   | - Prominent site posting  |   |
|   | 1. Disclosure to Plan for |   | HEALTH PLANS:             |   | - Website publication     |   |
|   |    Payment / Ops, AND     |   | Must accommodate IF       |   |                           |   |
|   | 2. Paid IN FULL OUT-OF-   |   | individual states dis-    |   | ACKNOWLEDGMENT:           |   |
|   |    POCKET (Self-Pay)      |   | closure could endanger.   |   | Good-faith effort required|   |
|   +---------------------------+   +---------------------------+   +---------------------------+   |
+---------------------------------------------------------------------------------------------------+

---

1. Right to Request Privacy Restrictions (45 CFR § 164.522(a))

Under 45 CFR § 164.522(a), an individual has the right to request that a covered entity restrict the uses or disclosures of PHI about the individual to carry out Treatment, Payment, or Health Care Operations (TPO), or restrict disclosures to family members, caregivers, or facility directories under § 164.510.

The General Discretionary Rule

As a general statutory standard, a covered entity is NOT required to agree to a requested restriction. Covered entities routinely decline broad discretionary restriction requests because fragmented records create significant clinical safety risks in emergency care and disrupt automated claims pipelines.

Legal Effect of an Agreed Restriction

If a covered entity agrees to a discretionary restriction, the agreement is legally binding upon the entity. The covered entity may not use or disclose the restricted PHI in violation of the agreement, with one vital exception: Emergency Medical Treatment.

• If a restricted patient requires emergency treatment and the restricted PHI is clinically needed to provide emergency care, the covered entity may disclose the PHI to a healthcare provider.
• The covered entity must request that the emergency healthcare provider not further use or disclose the restricted information.

Terminating an Agreed Restriction

A covered entity may terminate an agreed restriction if:

1. The individual agrees to or requests the termination in writing;
2. The individual orally agrees to the termination and the oral agreement is documented; or
3. The covered entity informs the individual that it is terminating its agreement (such termination is effective only with respect to PHI created or received after the entity has informed the individual; historical restricted PHI remains permanently protected).

---

2. The HITECH Mandatory Restriction: Out-of-Pocket Self-Pay Rule (45 CFR § 164.522(a)(1)(vi))

Enacted under Section 13405(a) of the HITECH Act and codified in the 2013 HIPAA Omnibus Final Rule, Congress created a major statutory exception to the discretionary restriction standard.

+---------------------------------------------------------------------------------------------------+
|                         HITECH MANDATORY SELF-PAY RESTRICTION PROTOCOL                            |
|                                                                                                   |
|   [PATIENT SELF-PAY REQUEST]                                                                      |
|   Patient requests restriction of encounter PHI from their commercial Health Plan                 |
|                                     |                                                             |
|                                     v                                                             |
|   [TWO-PRONG STATUTORY TEST: 45 CFR § 164.522(a)(1)(vi)]                                          |
|   1. Is the disclosure to a Health Plan for purposes of Payment or Health Care Operations?        |
|      AND                                                                                          |
|   2. Has the healthcare item or service been PAID IN FULL OUT-OF-POCKET by or for the patient?    |
|                                     |                                                             |
|                    +----------------+----------------+                                            |
|                    | YES                             | NO                                         |
|                    v                                 v                                            |
|         [MANDATORY COMPLIANCE]            [DISCRETIONARY STANDARD]                                |
|         Covered Entity MUST agree;        Covered Entity may accept                               |
|         Strictly prohibited from          or decline the requested                                |
|         billing health plan.              restriction.                                            |
+---------------------------------------------------------------------------------------------------+

Operational Compliance Requirements for Self-Pay Restrictions

1. Electronic Health Record (EHR) Flagging & Billing Suppression: IT and revenue cycle workflows must immediately flag the restricted encounter to suppress automatic generation and transmission of standard HIPAA electronic claim transactions (ASC X12 837).
2. Bundled & Multi-Service Encounters: If a patient receives multiple clinical services in a single encounter (e.g., an annual wellness exam and an elective cosmetic dermatology procedure) and pays out-of-pocket only for the cosmetic procedure, the restriction applies solely to the cosmetic service. If the services are clinically inextricably linked in a bundled claim, the patient must pay out-of-pocket for the entire bundle to enforce the restriction.
3. Managing Downstream Healthcare Providers (Labs, Pharmacies, Imaging):
   • The ordering provider is not legally required to enforce restrictions across independent external entities; however, best practice mandates flagging laboratory requisitions and prescription orders as "Self-Pay / Do Not Bill Insurance."
   • Compliance officers must train clinical staff to counsel patients that they must independently request the restriction and pay out-of-pocket at external retail pharmacies or imaging centers.
4. Dishonored Payments: If a patient's self-pay check bounces or credit card charge is disputed, the covered entity must make reasonable good-faith efforts to collect payment from the patient before un-restricting the encounter and submitting a claim to the health plan.

---

3. Right to Request Confidential / Alternative Communications (45 CFR § 164.522(b))

Under 45 CFR § 164.522(b), individuals have the statutory right to request that they receive communications of PHI from covered entities by alternative means or at alternative locations (e.g., requesting test results via cell phone rather than home phone, or sending billing statements to a post office box or work address).

+---------------------------------------------------------------------------------------------------+
|                         CONFIDENTIAL COMMUNICATIONS: PROVIDER VS. PLAN                            |
|                                    (45 CFR § 164.522(b))                                          |
|                                                                                                   |
|   COVERED HEALTHCARE PROVIDERS (§ 164.522(b)(1))     COVERED HEALTH PLANS (§ 164.522(b)(2))       |
|   +--------------------------------------------+     +------------------------------------------+ |
|   | - MUST accommodate ALL reasonable requests |     | - Must accommodate reasonable requests   | |
|   | - CANNOT require the patient to provide an |     |   ONLY IF the individual clearly states  | |
|   |   explanation or claim of endangerment     |     |   that disclosure of PHI could ENDANGER  | |
|   | - May condition accommodation on:          |     |   the individual.                        | |
|   |   1. Specification of how payment will be  |     |   1. Specification of endangerment;      | |
|   |      handled; and                          |     |   2. Specification of payment handling;  | |
|   |   2. Specification of alternative address  |     |   3. Alternative address/contact method. | |
|   |      or contact method.                    |     |                                          | |
|   +--------------------------------------------+     +------------------------------------------+ |
+---------------------------------------------------------------------------------------------------+

Compliance Officer Trap: A clinic receptionist refusing a domestic violence victim's request to send appointment reminders to a sister's address because the patient refuses to disclose why she cannot receive mail at home violates 45 CFR § 164.522(b)(1). Healthcare providers are legally prohibited from demanding an explanation or requiring a claim of endangerment.

---

4. Notice of Privacy Practices (NPP) (45 CFR § 164.520)

The Notice of Privacy Practices (NPP) is the foundational transparency document through which covered entities notify individuals of their legal rights and the entity's privacy policies.

Exact Mandatory Statutory Header (45 CFR § 164.520(b)(1)(i))

The NPP must contain the following exact statutory heading, formatted prominently:

"THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY."

Mandatory Content Elements (45 CFR § 164.520(b)(1))

1. Descriptions of Uses & Disclosures: Detailed descriptions and at least one concrete clinical/operational example of uses and disclosures for Treatment, Payment, and Health Care Operations.
2. Descriptions of Other Permitted Uses: Clear descriptions of each permitted disclosure under 45 CFR § 164.512 (public health, oversight, organ donation, law enforcement, court orders).
3. Separate Authorization Statements: Explicit statements that other uses and disclosures—specifically including psychotherapy notes, marketing, and the sale of PHI—require written authorization and that individuals may revoke authorizations.
4. Fundraising Notice: If the entity engages in fundraising, a statement that the entity may contact the individual for fundraising and that the individual has the absolute right to opt out of fundraising communications.
5. Statement of Individual Rights: Full descriptions of rights under § 164.520, § 164.522, § 164.524, § 164.526, and § 164.528, plus the statutory right to be notified following a breach of unsecured PHI (45 CFR § 164.404).
6. Covered Entity Duties: A statement that the entity is required by law to maintain the privacy of PHI, provide notice of its legal duties, abide by the terms of the notice currently in effect, and describe how revised notices will be distributed.
7. Complaints and Non-Retaliation: A statement that individuals may file a complaint with the covered entity and with the Secretary of HHS, detailing contact information (name or title and phone number of the Privacy Officer) and an explicit guarantee that the entity will not retaliate against any individual for filing a complaint.
8. Effective Date: The date on which the notice first became effective or was last revised.

Distribution Mandates & Good-Faith Acknowledgment Rules (45 CFR § 164.520(c))

• First Service Delivery: Direct treatment providers must provide the complete NPP no later than the date of the first service delivery (including electronic delivery if the patient consented).
• Physical & Electronic Posting: Must prominently display the NPP at physical service sites (registration desks/waiting areas) and post the complete notice prominently on any public-facing customer service website with a direct homepage link.
• Good-Faith Effort for Written Acknowledgment: Direct treatment providers must make a good-faith effort to obtain a written acknowledgment of receipt of the NPP. If acknowledgment is not obtained, the provider must formally document its good-faith efforts and the specific reason why acknowledgment was not obtained (e.g., patient refused to sign, acute medical emergency).
• Non-Conditioning Rule: A patient's refusal to sign the NPP acknowledgment never permits a provider to refuse treatment.
• Emergency Treatment Exception: In emergency treatment situations, the requirement to provide the NPP and seek acknowledgment is deferred until emergency conditions have resolved.

[!IMPORTANT] The Live 2026 NPP Deadline. The 2024 reproductive health rulemaking also rewrote § 164.520 to account for 42 CFR Part 2 substance use disorder records. When the Northern District of Texas vacated that rulemaking in Purl v. HHS on June 18, 2025, it struck only § 164.520(b)(1)(ii)(F), (G), and (H); the remaining NPP modifications survive, and compliance is required by February 16, 2026. Any covered entity that receives or maintains Part 2 records must have its NPP updated accordingly. See section 4.3 for the full vacatur analysis and section 4.4 for the Part 2 consent framework the notice must describe.