A patient is admitted to the hospital for substance use disorder treatment and asks the hospital not to disclose the records to his insurance company. The hospital obliges, as required by HIPAA, if the patient pays for the services up front. Another patient, misunderstanding the right to restrict disclosures under HIPAA, asks the hospital to withhold information about her hospitalization from her husband because they’re embroiled in a custody fight, saying she’ll pay for the treatment. Although the hospital will honor her request not to share her protected health information (PHI), it has nothing to do with insurance company restrictions, and she doesn’t have to worry about paying the bill.

Like many aspects of HIPAA, restrictions are misunderstood, says Barbara Duncan, HIPAA privacy officer at Stormont Vail Health in Topeka, Kansas. While authorizations permit the release of PHI, restrictions have the opposite effect. “Patients know they have the right to the restriction, but not necessarily what it entails,” she notes.