If you pay for a medical visit entirely out of your own pocket, you have the right to tell your provider not to share information about that visit with your health insurance plan — and they must say yes. Not “may consider it.” Must. It is one of the only privacy requests in HIPAA that a provider is not allowed to refuse, it has existed since 2013, and almost nobody knows it is there. Here is how it works, what it covers, and what it does not.
The right, in one paragraph
The rule lives at 45 CFR 164.522(a)(1)(vi). It says a covered entity — your doctor, dentist, therapist, hospital, or pharmacy — must agree to your request to restrict disclosure of your health information to a health plan if:
(B) the information pertains solely to a health care item or service for which you — or someone other than the health plan, on your behalf — has paid the provider in full.
That is the whole mechanism. You paid for it yourself, so the insurer has no billing reason to know about it, so you can require that they not be told.
What makes this unusual is the word must. Everywhere else in this part of HIPAA, you can ask and a provider can decline. Here they cannot.
The two conditions
Both have to be true. It is worth being precise about each, because this is where requests fall apart.
1. You paid in full. The regulation says paid “in full.” A partial payment does not trigger the obligation. If you pay part and expect insurance to cover the rest, the plan has to be told, because you have asked it to pay. Note the rule allows someone other than the health plan to pay on your behalf — a family member can pay and the right still applies. What does not work is the plan paying any of it.
2. It is about payment or health care operations, and not otherwise required by law. This is the limiting clause people miss. The restriction covers disclosures made so the plan can process a claim or run its business functions. It does not override a disclosure that some other law requires. If a law compels the disclosure, the restriction does not block it.
And notice the word solely in condition (B). The information has to relate only to the item or service you paid for. If a single record mixes a self-paid service together with services billed to your plan, the “solely” test gets complicated fast. In practice, this right works most cleanly when the visit or service is discrete and separately payable. Ask about it at the front desk before the service, not after the claim has gone out.
Why someone would use this
This is not a loophole for hiding things from a doctor. Your provider still has the full record, and your care is unaffected. What changes is whether your insurer learns about it.
People use it for ordinary and reasonable reasons:
- A test or screening they would rather keep out of an insurance file.
- A visit on a plan where someone else — a spouse, a parent — receives the explanation of benefits, which can disclose what you were seen for.
- Care they simply consider nobody else's business, and are willing to pay for to keep it that way.
The explanation of benefits point is worth drawing out, because it is the one that surprises people. If you are covered as a dependent on someone else's plan, the plan often sends paperwork to the policyholder describing services. Paying in full and requesting a restriction is the mechanism HIPAA gives you to stop that flow at its source.
How to ask
Keep it simple and do it early.
- Raise it before the service if you can. Once a claim has been sent to your plan, the information has been disclosed and there is no unsending it. The right prevents disclosure; it does not reverse it.
- Say the two things that matter: that you are paying in full yourself, and that you are requesting a restriction on disclosure to your health plan under your HIPAA right.
- Pay in full at the time of service. This is the condition that makes the obligation binding, so do not leave it open.
- Ask for it in writing and keep a copy. The rule requires the covered entity to document a restriction, and having your own record of what was agreed is simply practical.
- Ask what happens to related records. Referrals, labs, imaging, and pharmacy are often separate covered entities. Your restriction binds the provider you asked. If a lab bills your plan separately, that is a separate disclosure by a separate entity — and you would need to handle it with them, and pay them in full too.
That last point is the practical trap. A single office visit can generate three bills from three organizations. Restricting one does not restrict the others.
They cannot quietly cancel it
This is the part of the rule that gives the right real durability, and it is genuinely favorable to patients.
Under 45 CFR 164.522(a)(2), a provider may terminate a restriction in three situations: you agree to or request the termination in writing; you agree orally and the agreement is documented; or the provider tells you it is terminating its agreement.
That third route — the provider unilaterally ending it — comes with two limits at 164.522(a)(2)(iii):
- Termination is not effective for information restricted under the out-of-pocket provision at 164.522(a)(1)(vi).
- Where termination does apply, it is only effective for information created or received after they informed you.
Read the first one carefully. The restriction a provider must grant is also the restriction they cannot unilaterally revoke. Once your self-paid service is restricted, that is settled unless you change your mind. That is a meaningful protection, and it is the reason this right is worth knowing rather than merely noting.
The limits, honestly
A right is only useful if you know its edges.
Emergency treatment. Under 164.522(a)(1)(iii), if you need emergency treatment and the restricted information is needed to provide it, the provider may use it, or disclose it to another provider, to treat you. If they do disclose it for emergency treatment, 164.522(a)(1)(iv) requires them to request that the receiving provider not further use or disclose it. Your health comes first; the rule is explicit about that and it is the right call.
Some disclosures are outside the restriction entirely. Under 164.522(a)(1)(v), an agreed restriction is not effective to prevent uses or disclosures permitted or required under 45 CFR 164.502(a)(2)(ii), 164.510(a), or 164.512. In plain terms, certain disclosures — including those required by law and various public-interest categories — are not blocked by your restriction. That is a real limit, and anyone who tells you a restriction makes a record invisible is overstating it.
It only binds who you asked. Each covered entity is separate. Your physician's restriction does not travel to the imaging center.
Timing is everything. After the claim goes out, this right cannot help with that claim.
Other restrictions you can request
The out-of-pocket restriction is the mandatory one, but it sits inside a broader right worth knowing.
45 CFR 164.522(a)(1)(i) lets you request that a covered entity restrict:
- Uses or disclosures to carry out treatment, payment, or health care operations; and
- Certain disclosures under 45 CFR 164.510(b) — the provision covering sharing with family members and others involved in your care.
You can ask for these. But 164.522(a)(1)(ii) is candid: except for the out-of-pocket case, a covered entity is not required to agree. Many will decline as a matter of policy, and that is permitted.
The upside: if they do agree, it binds them. 164.522(a)(1)(iii) says a covered entity that agrees to a restriction may not use or disclose the information in violation of it, subject to the emergency exception. An agreed restriction is a real commitment, not a courtesy note.
So the honest summary is: one request they must grant, and a category of requests they may grant and must then keep. It costs nothing to ask.
Asking to be contacted privately
A related right, in the same section, that solves a problem the restriction right does not.
Under 45 CFR 164.522(b)(1)(i), a covered health care provider must permit you to request, and must accommodate reasonable requests, to receive communications of your health information “by alternative means or at alternative locations.” Call the cell, not the landline. Mail to this address. Do not leave details on voicemail.
The best part is at 164.522(b)(2)(iii): a covered health care provider may not require you to explain why as a condition of communicating with you confidentially. You do not have to justify the request.
What they may do, under 164.522(b)(2)(i) and (ii): require the request in writing, and condition the accommodation on information about how payment will be handled, when appropriate, and on you specifying an alternative address or method of contact. Which is fair — they cannot mail to an address you did not give them.
Health plans have a narrower version of this at 164.522(b)(1)(ii): a plan must accommodate reasonable requests for alternative means or locations if you clearly state that the disclosure could endanger you, and under 164.522(b)(2)(iv) the plan may require the request to contain such a statement. So for providers, no explanation is needed. For plans, that specific statement may be required.
Used together, these two rights are the practical toolkit: pay in full and restrict, so the plan is never told; and request confidential communications, so the mail goes where you want it.
Common questions
Can I stop my doctor from telling my insurance about a visit?
Yes, if you pay for it yourself in full. Under 45 CFR 164.522(a)(1)(vi), a covered entity must agree to your request to restrict disclosure of your health information to a health plan when the disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law, and the information relates solely to a health care item or service that you, or someone other than the health plan on your behalf, has paid the provider in full. Both conditions have to be met. Pay in full and ask, and the provider must agree.
Does a provider have to agree to any privacy restriction I request?
No. 45 CFR 164.522(a)(1)(i) gives you the right to request a restriction on uses or disclosures for treatment, payment, or health care operations, and on certain disclosures to family or others involved in your care. But 164.522(a)(1)(ii) says a covered entity is not required to agree to a restriction, with one exception: the out-of-pocket restriction at 164.522(a)(1)(vi), which they must agree to. So you can ask for anything, they can decline most things, and there is exactly one request they cannot refuse.
Can a provider cancel a restriction they agreed to?
Usually yes, but not the out-of-pocket one. Under 45 CFR 164.522(a)(2), a covered entity may terminate a restriction if you agree or request it in writing, if you agree orally and the agreement is documented, or if the covered entity informs you it is terminating the agreement. That last option has two limits at 164.522(a)(2)(iii): termination is not effective for information restricted under the out-of-pocket provision at 164.522(a)(1)(vi), and where it does apply it only affects information created or received after they told you.
Can I ask my doctor to contact me somewhere private?
Yes. Under 45 CFR 164.522(b)(1)(i), a covered health care provider must permit you to request, and must accommodate reasonable requests, to receive communications by alternative means or at alternative locations. That covers asking them to call your cell instead of your home, or mail to a different address. Importantly, 164.522(b)(2)(iii) says a covered health care provider may not require you to explain why. They can ask for the request in writing, and they can ask how payment will be handled and for the alternative address, but they cannot demand a reason.