§164.502(h) Standard: Confidential communications: A covered health care provider or health plan must comply with the applicable requirements of §164.522(b) in communicating protected health information.
§164.522(b)(1) Standard: Confidential communications requirements: (i) A covered health care provider must permit individuals to request and must accommodate reasonable requests by individuals to receive communications of protected health information from the covered health care provider by alternative means or at alternative locations. (ii) A health plan must permit individuals to request and must accommodate reasonable requests by individuals to receive communications of protected health information from the health plan by alternative means or at alternative locations, if the individual clearly states that the disclosure of all or part of that information could endanger the individual.
§164.522(b)(2) Implementation specifications: Conditions on providing confidential communications: (i) A covered entity may require the individual to make a request for a confidential communication described in paragraph (b)(1) of this section in writing. (ii) A covered entity may condition the provision of a reasonable accommodation on: (A) When appropriate, information as to how payment, if any, will be handled; and (B) Specification of an alternative address or other method of contact. (iii) A covered health care provider may not require an explanation from the individual as to the basis for the request as a condition of providing communications on a confidential basis. (iv) A health plan may require that a request contain a statement that disclosure of all or part of the information to which the request pertains could endanger the individual.
Audit Inquiry
Obtain and review policies and procedures regarding requests for confidential communications. Evaluate whether the policies and procedures are consistent with the established performance criterion.
Obtain and review a sample of confidential communications requests made by individuals. Evaluate whether the requests were evaluated and accepted or denied consistent with the established performance criterion and the entity established policies and procedures.
Obtain a review a sample of communications to individuals for which a confidential communication request was accepted. Evaluate whether the communication was conducted consistent with the established performance criterion and the entity established policies and procedures.