HIPAA Myth: HIPAA Grants Individuals the Right to Pay for Healthcare Services In Cash

The Privacy Rule grants an individual certain rights, including the right to request a restriction on certain disclosures of their protected health information ("PHI"). Although a covered entity can agree to such requests, they are also free to reject most requests. The only request to restrict the disclosure of PHI that a covered entity is required to agree to is a disclosure to a health plan where 1) the disclosure is for payment or health care operations purposes, and 2) the PHI pertains to the provision of care to the individual, and the individual has paid for the provision of care in full.

Some interpret this as granting patients with the right to self-pay. This argument stems largely from HHS' guidance on individual rights which addresses the above described restriction request. Specifically, advocates of this argument focus on the following language from the guidance (emphasis added):

Finally, you can also ask your health care provider or pharmacy not to tell your health insurance company about care you receive or drugs you take, if you pay for the care or drugs in full and the provider or pharmacy does not need to get paid by your insurance company.

It's subtle, but the language in the guidance varies slightly from the language in the regulation. Whereas the regulation uses "has paid," clearly indicating that payment must have occurred as a pre-requisite for the requirement to apply, the guidance uses softer language suggesting the requirement applies so long as the individual intends to pay in full.

This interpretation is belied by the plain language of the regulations. Moreover, it is a stretch to suggest that the Privacy Rule contemplates or otherwise was intended to address issues such as guaranteeing an individual's right to self-pay.