Part 2: Basic Patient Rights ( FAQ 54 of 65)
Right to Request Restrictions on Uses and Disclosures
54. Is the Right to Limit Disclosures to Relatives and Friends Meaningless Too?
There is a bit of hope if you want a provider to agree to limit disclosures to relatives and friends. If you tell your doctor or nurse not to talk to a relative, that provider is likely to comply regardless of the rule. The rule doesn't make those disclosures mandatory. It does, however, make it harder for a patient to obtain or enforce an agreement.
If, for example, you ask your provider not to disclose your diagnosis to your children, the rule requires the provider to document the request. Since formal documentation is not likely to be done for casual requests, any agreement will be unenforceable under the rule. Further, the required formality of the rule allows providers to insist that patients make requests in writing, and most will demand a letter. If you are a patient in a hospital about to receive a visit from a relative, how can you possibly make a written request and get a timely agreement from the hospital?
Even if you do make a written request, the rule doesn't require any response to your request or any response in a reasonable period. If you are prepared enough to present a formal request at the start of your hospitalization, the hospital could take 30 days or more before it agreed. Your hospitalization will likely have ended well before any response, if you even get a response.
Luckily, while the rule makes these requests to limit disclosure mostly meaningless, the human element that still exists in the health care system may supply what the rule does not. If you make a personal request to your provider, that provider will likely abide by your wishes regardless of the rule and its required formality. Your request may not be legally enforceable under the HIPAA rule, but enforcement may not be important.
We don't see much of a reason to bother with formal requests for use and disclosure restrictions. If you read many notices of privacy practices, you will find that covered entities say that they won't agree to most requests. That is a polite way of saying that they won't agree to any requests.
If you want to control disclosures to family members or friends, the formal process under the rule isn't likely to help you at all. Make your requests orally and informally to your providers, just the same way that patients have always done. Hope for the best. The HIPAA rule does nothing for you.