45 CFR 164.522 Explained: Your Guide to HIPAA Privacy Protection Requests

Table of Contents#

What Is 45 CFR 164.522, and Who Does It Apply To?
Types of Privacy Requests Allowed Under the Rule
Step-by-Step Process to Submit a Request
Can a Covered Entity Deny Your Privacy Request?
What to Do If Your Request Is Denied or Violated
Key Compliance Responsibilities for Covered Entities
Frequently Asked Questions About 45 CFR 164.522
Final Takeaways
References

What Is 45 CFR 164.522, and Who Does It Apply To?#

45 CFR § 164.522 is a formal provision of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, issued and enforced by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). It codifies two core patient rights related to health data privacy:

The right to request restrictions on how a covered entity uses or discloses your Protected Health Information (PHI) for treatment, payment, or healthcare operations (§ 164.522(a)).
The right to request confidential communications to receive health-related updates by alternative means or at alternative locations (§ 164.522(b)).

The rule applies to all HIPAA-covered entities, including:

Licensed healthcare providers (doctors, clinics, hospitals, pharmacies, dentists, and therapists).
Health plans (health insurance companies, HMOs, employer-sponsored plans, Medicare, and Medicaid).
Healthcare clearinghouses (billing services and community health information systems).

While the rule directly applies to covered entities, it also extends to business associates (third-party vendors that handle PHI on behalf of covered entities, such as cloud storage providers, billing services, or patient portal platforms). Business associates are required by law and contract (via Business Associate Agreements, or BAAs) to safeguard this information and uphold compliance.

Types of Privacy Requests Allowed Under the Rule#

The rule permits two distinct categories of privacy requests, outlined below:

1. Restrictions on Uses and Disclosures (§ 164.522(a))#

You can request that a covered entity limit how it uses or shares your PHI for treatment, payment, or healthcare operations, or restrict disclosures to family members, close friends, or others involved in your care. Common requests include:

Restricting disclosure of mental health or therapy records to your primary care provider.
Barring disclosure of a sensitive diagnosis (e.g., STIs, reproductive health care, or substance use treatment) to a family member listed as your emergency contact.
Preventing a health plan from sharing details of your care with your employer.

Mandatory Restriction (The Out-of-Pocket Payment Exception)#

While covered entities have discretion over most restriction requests, there is one mandatory exception under the HITECH Act. A provider must agree to restrict disclosure of PHI to a health plan if:

The disclosure is for the purpose of carrying out payment or healthcare operations (and is not otherwise required by law); and
The PHI pertains solely to a healthcare item or service for which the provider has been paid in full out-of-pocket (by the patient or someone else on their behalf, other than the health plan).

[!IMPORTANT] The Bundling Rule: If a provider cannot practically or legally "unbundle" a specific service from a larger package or visit (due to bundled billing codes), the entire bundle is treated as a single unit. To restrict the disclosure of any part of that bundle, you must pay out-of-pocket and request a restriction for the entire bundle of services.

2. Confidential Communications (§ 164.522(b))#

You have the right to request that a covered entity communicate with you using alternative means or at alternative locations. This is essential for safety, such as for individuals experiencing domestic violence who do not want health communications sent to a shared home. Common requests include:

Calling a personal cell phone instead of a shared home phone.
Mailing billing statements, explanation of benefits (EOBs), or medical records to a P.O. Box or a friend’s address.
Communicating via a secure patient portal or encrypted email rather than physical mail or unencrypted texts.

Provider vs. Health Plan Obligations#

The standard for granting a confidential communication request depends on the type of covered entity:

Healthcare Providers: Must accommodate any reasonable request. They cannot require you to provide a reason or statement that disclosure could endanger you.
Health Plans: Must accommodate reasonable requests only if you clearly state that the disclosure of all or part of the information could endanger you. Plans are permitted to require this statement of endangerment (often in writing).

Step-by-Step Process to Submit a Request#

Follow these steps to submit a request:

Confirm the entity is HIPAA-covered: Traditional healthcare providers, pharmacies, and health plans are covered. However, wellness apps, fitness trackers, health coaches, and direct-to-consumer genetic testing companies are generally not subject to HIPAA (unless they are acting as business associates).
Draft a specific, detailed request: Vague requests (e.g., "keep my info private") are easily denied. Be precise:
- Include your full name, date of birth, and patient/member ID.
- Describe the exact PHI you want restricted (e.g., "all records and lab results from my March 15, 2026 reproductive health visit").
- Specify the exact restriction (e.g., "do not disclose these records to my spouse") or alternative contact details (e.g., "send all billing statements to P.O. Box 123 instead of my home address").
Submit the request in writing: Covered entities are legally permitted to require requests in writing. Check their website or Notice of Privacy Practices (NPP) for a dedicated "HIPAA Restriction Request Form" or "Confidential Communications Request Form." If none exists, submit a formal written letter. Always keep a copy for your records.
Wait for a decision: Unlike the HIPAA Right of Access (45 CFR § 164.524), which imposes a strict 30-day response deadline, 45 CFR § 164.522 does not establish a mandatory federal timeline for responding to restriction or confidential communication requests. However, covered entities are expected to act within a reasonable timeframe. Many entities align their response times with the 30-day window for consistency. If you haven't heard back, follow up with the entity’s Privacy Officer.

Can a Covered Entity Deny Your Privacy Request?#

For general restriction requests (those that do not meet the mandatory out-of-pocket payment criteria), covered entities have complete discretion and are not legally required to agree to your request. They can deny a voluntary restriction request for any reason.

Common reasons for denial include:

Administrative burden: The restriction is too difficult or impossible to implement with their current Electronic Health Record (EHR) systems.
Interference with operations: The restriction would disrupt necessary treatment, payment, or standard healthcare operations.
Required by law: The PHI must be disclosed under state or federal laws (e.g., public health reporting, child abuse reporting, or court orders).
Emergency care risks: The restriction could prevent providers from sharing life-saving info in an emergency.

[!NOTE] No Written Denial Required: Under HIPAA, covered entities are not federally mandated to provide a formal written denial or justify their decision for a restriction request (unlike requests to access or amend records). However, providing a written explanation is considered a compliance best practice, and many organizations do so under their internal policies.

What to Do If Your Request Is Denied or Violated#

If a voluntary restriction request is denied, or if a mandatory out-of-pocket restriction or reasonable confidential communication request is wrongfully refused, take the following actions:

Ask for clarification: Even though a written denial isn't strictly required for voluntary restrictions, ask the Privacy Officer for details on why it was refused.
Narrow the request: If a voluntary request was rejected as too broad, submit a more limited request (e.g., restricting only a specific diagnosis or encounter rather than your entire medical record).
File an OCR Complaint: If a covered entity wrongfully denies a mandatory out-of-pocket restriction, refuses a reasonable confidential communication request, or violates an agreed-upon restriction, you have the right to file a complaint with the HHS Office for Civil Rights (OCR). Complaints must be filed within 180 days of the violation.
Consult an attorney: HIPAA does not provide a private right of action (you cannot sue a provider directly for a HIPAA violation). However, you may have legal recourse under state privacy, contract, or negligence laws if the violation caused you harm.

Key Compliance Responsibilities for Covered Entities#

To comply with 45 CFR § 164.522, covered entities must:

Provide a clear submission process: Establish accessible procedures and forms for patients/members to submit written requests.
Update Notice of Privacy Practices (NPP): Clearly explain the right to request restrictions and confidential communications in the NPP.
Honor mandatory restrictions: Ensure systems and billing workflows prevent disclosures to health plans for out-of-pocket services paid in full.
Enforce agreed-upon restrictions: Flag restricted records in Electronic Health Records (EHRs) so that staff do not accidentally disclose them.
Establish internal timelines: Define and document reasonable timelines for reviewing and responding to requests, even if not mandated by federal deadlines.
Retain documentation: Under 45 CFR § 164.530(j), retain all documentation related to requests, approvals, and terminations of restrictions for at least six years.
Manage emergency exceptions: Train staff on how to share restricted information during emergencies, including the duty to request that the receiving provider not further disclose the PHI.

Frequently Asked Questions About 45 CFR 164.522#

Q: Do I have to pay to submit a 45 CFR 164.522 request?#

A: No. Covered entities are prohibited from charging fees for submitting, processing, or implementing privacy protection requests.

Q: Can I revoke an approved restriction later?#

A: Yes. You can submit a written revocation at any time. You can also orally request revocation, which the covered entity must document.

Q: How long does an approved restriction last?#

A: Approved restrictions remain in effect indefinitely unless you revoke them. However, for voluntary restrictions, the covered entity can unilaterally terminate their agreement by informing you.

Unilateral termination is prospective only: The termination only applies to PHI created or received after you have been informed. Historical PHI remains protected under the agreed restriction.
Out-of-pocket restrictions cannot be terminated: A covered entity cannot unilaterally terminate a mandatory out-of-pocket payment restriction.

Q: Does 45 CFR 164.522 apply to mental health and substance use records?#

A: Yes. It applies to all PHI. Furthermore, for substance use disorder (SUD) records, the HHS issued a Final Rule in 2024 (with compliance required by February 16, 2026) aligning 42 CFR Part 2 with HIPAA. This final rule explicitly harmonizes patient rights, including the right to request restrictions under 45 CFR § 164.522, while maintaining strict protections against using these records in legal proceedings without patient consent or court orders.

Final Takeaways#

45 CFR 164.522 is one of the most powerful patient rights included in the HIPAA Privacy Rule, putting you in direct control of how your most sensitive health information is shared and communicated. By submitting specific, detailed requests, keeping records of all correspondence, and escalating wrongful denials to the OCR, you can ensure your health data remains private and secure. For covered entities, complying with this rule is not just a legal requirement—it is a core part of building trust with patients.

References#

U.S. Department of Health and Human Services Office for Civil Rights. (n.d.). Right to Request Restrictions of PHI. Retrieved from https://www.hhs.gov/hipaa/for-individuals/right-request-restrictions/index.html
U.S. Government Publishing Office. (2024). 45 CFR § 164.522 - Rights to request privacy protection for protected health information. Retrieved from https://www.ecfr.gov/current/title-45/part-164/section-164.522
U.S. Department of Health and Human Services Office for Civil Rights. (n.d.). Filing a HIPAA Complaint. Retrieved from https://www.hhs.gov/hipaa/filing-a-complaint/index.html
U.S. Department of Health and Human Services. (2024). Confidentiality of Substance Use Disorder (SUD) Patient Records Final Rule (42 CFR Part 2 and HIPAA Alignment). Retrieved from https://www.federalregister.gov/documents/2024/02/16/2024-02568/confidentiality-of-substance-use-disorder-patient-records