HIPAA Privacy Rule 164.522a: Right to request restriction of uses and disclosures

A covered entity must permit individuals to request restrictions on uses and disclosures for treatment, payment or operations, and to disclosures to family involved in care, and must agree to a restriction on disclosure to a health plan for an item or service paid out of pocket in full, per 164.522(a).