In general, the HIPAA privacy rule gives individuals the right to request a restriction on uses and disclosures of their protected health information (PHI). The individual is also provided the right to request confidential communications or that a communication of PHI be made by alternative means, such as sending correspondence to the individual's office instead of the individual's home.
The Privacy Rule generally requires healthcare providers to take reasonable steps to limit the use or disclosure of, and requests for PHI to the minimum necessary to accomplish the intended purpose. These provisions do not apply to uses or disclosures made pursuant to an authorization requested by the individual.
Note: Uses and disclosures for TPO may be permitted without prior consent in an emergency