Right to Request Communications of PHI By Alternative Means or at Alternative Locations

DISCLAIMER: The information provided in this article, other knowledge base articles, and the Compliancy Group website do not, and are not intended to, constitute legal advice. All information, content, and materials in the Knowledge Base and on the Compliancy Group website are for general informational purposes only.

Introduction

The HIPAA Privacy Rule contains a "Right to request privacy protection for PHI" provision. This provision contains two distinct rights - (1) the right of an individual to request restriction of uses and disclosures of PHI, and (2) the right of an individual to request confidential communications - that is, the right to request (and to have a covered entity to accommodate a reasonable request) to receive communications from a covered entity by alternative means or at alternative locations. The article discusses the second of the two rights, the right of an individual to request comfidential communications - that is, the right to request (and to have a covered entity accommodate a reasonable request) to receive communications from a covered entity by alternative means or at alternative locations. The first of the two rights, the right of of an individual to request restrictions of uses and disclosures of PHI, is discussed in separate article that can be accessed here.

What is the Right to Request Communications by Alternative Means?

"Alternative means" refers to other methods of communication.  For example, if a patient requests to receive communications via text message or email instead of over the phone, the patient has requested to receive communications by alternative means.

Covered entity providers and health plans may require an individual who makes such a request to make the request in writing.  Covered entity providers must accommodate all reasonable requests. Health plans must accommodate all reasonable requests, if the individual clearly states that the disclosure of all or part of the protected health information could endanger the individual. 

The reasonableness of a request must be determined by a covered entity solely on the basis of the administrative difficulty of complying with the request. A covered health care provider or health plan cannot refuse to accommodate a request based on its perception of the merits of the individual’s reason for making the request. A covered health care provider may not require the individual to provide a reason for the request as a condition of accommodating the request. As discussed above, a health plan is not required to accommodate a request unless the individual indicates that the disclosure could endanger the individual. If the individual indicates such endangerment, however, the covered entity cannot further consider the individual’s reason for making the request in determining whether it must accommodate the request.

A covered health care provider or health plan may refuse to accommodate a request, however, if the individual has not provided information as to how payment, if applicable, will be handled.

What is the Right to Request Communications at an Alternative Location?

Under the right to request communications at an alternative location provision, a patient may request that the provider communicate with the individual about that treatment at the individual’s place of employment, by mail to a designated address, or by phone to a designated phone number - as opposed to an address or phone number the patient has previously provided as a means of contact. 

Covered entity providers and health plans may require an individual who makes such a request to make the request in writing.  Covered entity providers must accommodate all reasonable requests. Health plans must accommodate all reasonable requests, if the individual clearly states that the disclosure of all or part of the protected health information could endanger the individual. For example, if an individual requests that a health plan send explanations of benefits about particular services to the individual’s work rather than home address because the individual is concerned that a member of the individual’s household (e.g., the named insured) might read the explanation of benefits and become abusive towards the individual, the health plan must accommodate the request.

The reasonableness of a request must be determined by a covered entity solely on the basis of the administrative difficulty of complying with the request and as otherwise provided in this section. As above, a covered health care provider or health plan cannot refuse to accommodate a request based on its perception of the merits of the individual’s reason for making the request. A covered health care provider may not require the individual to provide a reason for the request as a condition of accommodating the request. As discussed above, a health plan is not required to accommodate a request unless the individual indicates that the disclosure could endanger the individual. If the individual indicates such endangerment, however, the covered entity cannot further consider the individual’s reason for making the request in determining whether it must accommodate the request.

A covered health care provider or health plan may refuse to accommodate a request, however, if an individual has not provided information as to how payment, if applicable, will be handled, or refuses to specify an alternative address or other method of contact.

With respect to rights to request communications by alternative means or at alternative locations, it is a best practice to obtain patient consent to the alternative means or alternative location requested, in writing. If an alternative means such as text or email presents a risk of interception of a message during transmission, a provider may want to include, in a consent form, language that a risk of interception in transmission exists. Inclusion of this language allows the patient to consent to the risk. 

This article was last updated on August 13, 2025.