Individual Request for Restriction of PHI
Clients have the right to request specific restrictions on the use or disclosure of PHI. Clients must file this request in writing by completing a Request for Restriction of Health Information, MO 886-4450. Staff must send the completed request through supervisory channels to the CD Privacy Officer.
Agreement or Denial of the Request
The CD Privacy Officer must receive the written request and determine whether it will be approved. The CD Privacy Officer will consult with the DSS Privacy Officer and provide staff and the client with the final decision. DSS will act on the request no later than 60 days after receipt of the request. DSS may request an extension of 30 days by notifying the client in writing.
- If approved, staff must notify the parties of the change, implement the restriction and ensure that such protected information is easily identifiable in the client’s record to avoid possible use or disclosure. One method would be to attach a cover sheet to the PHI, identifying to whom the information may or may not be released.
- If denied, do not implement client’s request for the restriction.
- File the original Request for Restriction of Health Information form in the front of the client case file.
While the individual has the right to request any kind of restriction of PHI uses and disclosures, the Division is not required to agree to those restrictions.
Termination of Restriction
Terminate the agreement to a restriction of information as follows:
- The client requests the termination in writing; and
- File the written request for termination of restriction in the front of the case together with the initial request for restriction
Emergency Exception
If DSS has agreed to the restriction, but the individual who requested the restriction is in need of emergency treatment, and the restricted PHI is needed to provide the emergency treatment, staff may disclose that PHI to a health care provider to provide such treatment. If such PHI is disclosed in an emergency situation, the facility must require that the health care provider to whom the information was disclosed to not further use or disclose that PHI.