HIPAA Restriction Requests and Confidential Communications (45 CFR 164.522)
Individuals may request restrictions on use or disclosure of PHI and may request communications by alternative means or at alternative locations.
Primary source
45 CFR 164.522 — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.522
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
45 CFR 164.522 gives individuals two related rights. First, the right to request restrictions on uses or disclosures for treatment, payment, or health care operations. The covered entity is not required to agree, with one exception: if the individual pays out of pocket in full for an item or service and asks that the disclosure to the health plan be restricted, the entity must agree (added by HITECH).
Second, the right to request that the covered entity communicate by alternative means or at alternative locations — for example, by mail to a P.O. box rather than to a household address. Health care providers must accommodate reasonable requests; health plans must accommodate when the individual indicates the standard channel could endanger them.
Practices must publish the request mechanism, train workforce to flag agreed restrictions in the EHR, and ensure billing and front-desk systems respect alternative-communication preferences. A documented but ignored restriction is a frequent OCR finding.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Accounting of Disclosures (45 CFR 164.528)Individuals may request an accounting of disclosures of their PHI made by a covered entity in the prior six years, with a defined list of exclusions.
- RegulationHIPAA Notice of Privacy Practices (45 CFR 164.520)Covered entities must provide a Notice of Privacy Practices describing how PHI may be used and disclosed and the individual's rights, with specific delivery and posting requirements.
- RegulationHIPAA Right of Access (45 CFR 164.524)Individuals have a right to inspect and obtain copies of their PHI in a designated record set, in the form and format requested when readily producible, within 30 days.
- ComplianceAccounting of Disclosures (45 CFR § 164.528): Tracker + ProcedureA 2026 HIPAA Accounting of Disclosures procedure citing 45 CFR § 164.528 — the six-year lookback, what to log, exclusions, and a copy-ready tracker template.
- SRAHIPAA Security Rule vs Privacy Rule: A Plain-English MapWhat the Security Rule at 45 CFR Part 164 Subpart C does, what the Privacy Rule at Subpart E does, where they overlap, and which rule the SRA actually answers to.
- ComplianceAnnual HIPAA Training Curriculum (What to Cover + How to Document)A 2026 annual HIPAA training curriculum for small healthcare practices — eight required modules under 45 CFR 164.530(b) and 45 CFR 164.308(a)(5), with documentation templates.
- GlossaryAccounting of DisclosuresThe HIPAA right of an individual to receive a list of disclosures of their PHI made by a covered entity over the prior six years.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.