Where an individual requests a restriction on disclosure of protected health information under 45 CFR 164.522(a)(1)(i)(A), the covered entity must comply if the disclosure would be to a health plan for payment or health care operations (not treatment) and the information pertains solely to an item or service the provider has been paid for out of pocket in full, unless the disclosure is otherwise required by law.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.