Stop over 7M+ 7 million organizations from using, sharing, or selling your health data

Tracking ID: [[TRACKING_ID]]
Date: [[DATE]]

To: Privacy Officer, [[PROVIDER_NAME]]
Address: [[PROVIDER_ADDRESS]]
Via: [[SUBMISSION_CHANNEL]] (e.g., Certified Mail / Fax [[FAX]] / Secure Portal [[PORTAL_URL]])

RE: Request for Restriction of Uses and Disclosures of PHI (45 CFR §164.522)

Patient: [[PATIENT_NAME]]
DOB: [[DOB]]
MRN (if known): [[MRN]]

Under 45 CFR §164.522, I request that your organization restrict the use and disclosure of my Protected Health Information (PHI) as follows:

1. Prohibit the use or disclosure of my PHI for marketing, advertising, profiling, or analytics unrelated to my treatment.
2. Do not disclose my PHI to Health Information Exchanges (HIEs) or similar networks (including but not limited to any listed under [[NETWORKS]]) without my explicit, written authorization.
3. Do not sell, license, trade, or otherwise transfer my PHI to data brokers, analytics vendors, or other third parties.
4. Do not disclose PHI to health plans for services I have paid for in full out-of-pocket, pursuant to 45 CFR §164.522(a)(1)(vi).
5. Limit internal access to my PHI to the minimum necessary workforce members to accomplish permitted purposes.
6. Do not use or disclose my PHI for research purposes without my explicit authorization, unless required by law.

**Effective date:** [[EFFECTIVE_DATE]] (effective upon receipt).
Please confirm receipt and describe how you will comply with each restriction within 30 days of receipt of this request.

If you decline any portion of this request, please provide a written explanation citing the legal basis for refusal.

Sincerely,

[[PATIENT_NAME]]
[[ADDRESS]]
[[EMAIL]] • [[PHONE]]

Tracking ID: [[TRACKING_ID]]
Date: [[DATE]]

To: Privacy Officer, [[PROVIDER_NAME]]
Address: [[PROVIDER_ADDRESS]]
Via: [[SUBMISSION_CHANNEL]]

RE: Revocation of Prior Authorization(s) (45 CFR §164.508)

Patient: [[PATIENT_NAME]]
DOB: [[DOB]]
MRN (if known): [[MRN]]

Under 45 CFR §164.508, I hereby revoke any and all prior authorizations that permitted your organization to disclose my PHI to third parties, including but not limited to:

- Data brokers or data analytics vendors
- Marketing and advertising vendors
- Research partners or registries (unless otherwise required by law)
- Health Information Exchanges (unless explicitly re-authorized)
- Any other non-treatment, non-payment, or non–health care operations disclosures

This revocation is **effective upon receipt**, **except to the extent your organization has already acted in reliance on a prior authorization**.

Please confirm in writing that this revocation has been recorded, and list any active authorizations you believe remain in effect (including their scope and expiration dates).

Sincerely,

[[PATIENT_NAME]]
[[ADDRESS]]
[[EMAIL]] • [[PHONE]]

Tracking ID: [[TRACKING_ID]]
Date: [[DATE]]

To: [[COMPANY_NAME]] (Non-HIPAA Entity)
Address: [[COMPANY_ADDRESS]]
Via: [[SUBMISSION_CHANNEL]]

RE: Opt-Out, Deletion, and Restriction of Processing of Personal / Health-Related Data
Applicable Law(s): [[STATE]] (e.g., CA CPRA / CO CPA / CT DPA / VA VCDPA / UT UCPA) and any other applicable state privacy laws

Consumer: [[PATIENT_NAME]]
State of Residence: [[STATE]]
Email on Account (if applicable): [[EMAIL]]

I am exercising my rights under applicable state privacy law(s) to:

1. **Opt out** of the sale, sharing, and/or targeted advertising use of my personal and health-related data.
2. **Request deletion** of my personal data, subject to legal exceptions.
3. **Restrict processing** of any sensitive personal data, including health-related data.
4. **Opt out** of profiling for automated decision-making, where applicable.

Please:

- Confirm in writing within the statutory timeframe (typically 45 days) how you will comply.
- Provide a summary of the categories of data you maintain, the purposes, and the third parties to whom data has been disclosed or sold/shared (if applicable).
- Honor this request across all affiliated brands, subsidiaries, and data brokers to whom you provide data.

If you believe you are a covered entity under HIPAA and thus not subject to the state privacy law(s) referenced above, please confirm and identify the HIPAA-covered entity status and basis for exclusion.

Sincerely,

[[PATIENT_NAME]]
[[ADDRESS]]
[[EMAIL]] • [[PHONE]]

Tracking ID: [[TRACKING_ID]]
Date Submitted: [[DATE]]
Submission Channel: [[SUBMISSION_CHANNEL]] (Portal / Fax / Mail / Email)
Entity: [[PROVIDER_NAME]] — [[COVERED_ENTITY_TYPE]]
Form Name / ID: [[FORM_NAME_OR_ID]]

Patient: [[PATIENT_NAME]]
DOB: [[DOB]]
MRN (if known): [[MRN]]

This provider-specific restriction / opt-out form was **auto-completed and submitted on the patient's behalf** based on the preferences they selected. It requests, at minimum:

1. Restriction of use/disclosure of PHI for marketing, analytics, and other secondary uses not required for treatment (45 CFR §164.522).
2. Revocation of all prior authorizations for disclosure of PHI to third parties (45 CFR §164.508), except to the extent already relied upon.
3. Exclusion from HIEs or network sharing (e.g., Care Everywhere, CommonWell, eHealth Exchange) absent explicit authorization.
4. Where applicable, restriction on disclosures to health plans for services paid in full out-of-pocket (45 CFR §164.522(a)(1)(vi)).

**Please confirm receipt, acceptance, and implementation of these restrictions.**
If you require additional steps, please provide them in writing with the legal basis and submission method.

Audit trail:
- Submitted: [[DATE_TIME_STAMP]]
- Tracking ID: [[TRACKING_ID]]
- Confirmation received: [[YES/NO — DATE/TIME]]
- Follow-up / escalation scheduled: [[IF_APPLICABLE]]

Sincerely,

[[PATIENT_NAME]]
[[ADDRESS]]
[[EMAIL]] • [[PHONE]]