The Confidential Communication Request, Step by Step

What a confidential communication request is

A confidential communication request is a formal notice asking a health plan to contact you by an alternative means, such as email or a portal, or at an alternative address, rather than through the policyholder's usual mail. HIPAA requires a health plan to accommodate a reasonable request when you state that the ordinary disclosure could endanger you 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2013).Notice of Privacy Practices for Protected Health Information.A health plan must accommodate a reasonable request to receive communications by alternative means or at an alternative location when the individual states that disclosure could endanger them.. It exists precisely because the plan is otherwise allowed to send the policyholder an Explanation of Benefits (EOB) that lists your visits as part of routine payment activity 2Ref 2U.S. Department of Health and Human Services, Office for Civil Rights (2013).Uses and Disclosures for Treatment, Payment, and Health Care Operations.HIPAA permits disclosure of protected health information for payment, including sending an Explanation of Benefits to the policyholder, without patient authorization..

So the request does not fight a leak that broke the rules; it uses one right to redirect a disclosure that the rules permit. That framing matters when you write it: you are not accusing the plan of wrongdoing, you are exercising a named entitlement that sits alongside your other individual HIPAA rights 3Ref 3U.S. Department of Health and Human Services, Office for Civil Rights (2024).HIPAA for Individuals.HIPAA gives individuals a set of rights over their own protected health information, and the Office for Civil Rights enforces those rights..

Who can file one, and to whom

Any individual whose protected health information the plan holds can make the request, including an adult dependent on a spouse's or parent's plan. The right belongs to you as a patient, not to whoever pays the premium 3Ref 3U.S. Department of Health and Human Services, Office for Civil Rights (2024).HIPAA for Individuals.HIPAA gives individuals a set of rights over their own protected health information, and the Office for Civil Rights enforces those rights.. The request goes to the health plan or insurer, which is the entity that mails the EOB, and it can also be made to a provider for the communications they send.

Minors have standing too. Because every state and the District of Columbia lets minors consent to STI testing and treatment on their own 4Ref 4Guttmacher Institute (2024).Minors' Access to STI Services.All 50 states and the District of Columbia allow minors to consent to STI testing and treatment on their own, some with a minimum age., a minor who lawfully consented to that care can generally make a confidential communication request tied to it, though how a plan handles a dependent minor's request varies. When in doubt, the plan's member services or privacy office can say who on the policy is recognized to file.

What to actually say, line by line

A workable request names four things: who you are, what you want redirected, where to send it instead, and the endangerment statement that triggers the plan's duty to accommodate. You do not have to explain your medical situation or prove the danger; the law asks you to state it, not to document it 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2013).Notice of Privacy Practices for Protected Health Information.A health plan must accommodate a reasonable request to receive communications by alternative means or at an alternative location when the individual states that disclosure could endanger them..

• Identify yourself and the policy: your full name, member ID, and the group or plan number from your insurance card.
• State the request: ask that all communications, or specifically Explanations of Benefits and billing statements, be sent by an alternative method or to an alternative location.
• Give the alternative: the exact email, phone, portal preference, or mailing address where you can safely receive them.
• State the endangerment basis: a sentence that disclosure of this information to the address or person currently on file could endanger you.

Keep the danger statement plain and do not over-explain; "disclosure could endanger me" is the phrasing the rule turns on.

How to send it and what to expect back

Put the request in writing and keep a dated copy, because a paper or electronic trail is what you fall back on if the redirect does not happen. Many plans accept the request through their member portal, by secure message, or by mail to the privacy officer; the address is on the plan's Notice of Privacy Practices and usually on its website. Sending it before your next claim posts gives the plan time to update your file.

HIPAA also gives you a companion right worth knowing: you can request a copy of your own health and billing records, and a covered entity generally must respond within thirty days, in the form you asked for when that is readily producible, and may charge only a reasonable, cost-based fee 5Ref 5U.S. Department of Health and Human Services, Office for Civil Rights (2024).Individuals' Right under HIPAA to Access their Health Information.Individuals have a right to access their health and billing records; covered entities generally must respond within thirty days, in the requested form when readily producible, and may charge only a reasonable, cost-based fee.. That access right lets you see what the plan actually recorded, separate from where it mails the summary.

What the request cannot do

Redirecting the EOB changes where the mail lands; it does not erase the visit or seal it from every system. The care stays in your medical record, and for reportable conditions a report still goes to the public health department. For HIV, a confidential positive is reported to the health department, though identifiers are stripped before data reaches the CDC 6Ref 6HIV.gov (U.S. Department of Health and Human Services) (2024).Limits on Confidentiality.A confidential HIV positive is reported to the health department, with identifiers removed before data reaches the CDC; confidential communication requests do not stop required public-health reporting.. A confidential communication request is a billing-privacy tool, not a way to undo disease surveillance.

Its reach also depends on the plan honoring the alternative faithfully. If a shared online account or a co-policyholder's login can still see claim history, the mailed EOB is only one channel among several. Checking who has portal access, and confirming the plan applied your request, closes the gap between the letter you sent and the privacy you wanted.

If the plan does not comply

A plan that ignores or refuses a reasonable, endangerment-based request has not met its obligation, and you have escalation paths. Start with a written follow-up to the plan's privacy officer that references your original dated request. Reasonable accommodation is the standard the plan is held to, so a flat refusal without a format-based reason is worth challenging in writing 1Ref 1U.S. Department of Health and Human Services, Office for Civil Rights (2013).Notice of Privacy Practices for Protected Health Information.A health plan must accommodate a reasonable request to receive communications by alternative means or at an alternative location when the individual states that disclosure could endanger them..

Beyond the plan, individuals can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights, which enforces these HIPAA rights 3Ref 3U.S. Department of Health and Human Services, Office for Civil Rights (2024).HIPAA for Individuals.HIPAA gives individuals a set of rights over their own protected health information, and the Office for Civil Rights enforces those rights.. Keeping every message, request, and response dated turns a vague frustration into a documented timeline, which is exactly what an escalation or complaint needs.

A template you can adapt

This is a model to adapt in your own words and details, not a fixed legal form, and rewriting it plainly is fine. Fill in every bracket with your own information, keep the endangerment sentence intact because that is the phrase the rule turns on, and remove this instruction line before you send it to the plan's privacy office. What follows is the body of a request you can copy and change.

> To the Privacy Officer, [plan or insurer name]: > > I am a member on policy [member ID], group [group number]. Under 45 CFR 164.522(b), I request that the plan send me confidential communications by alternative means. Please send all Explanations of Benefits and billing statements to me only, at [email / portal / mailing address], and not to the address or policyholder currently on file. Disclosure of this information to the contact currently on file could endanger me. > > Please confirm in writing that this request has been applied. Thank you. > > [Your name, date, and contact information]

Using plain, direct language here is not just courtesy; clear requests are easier for a plan to act on correctly the first time, which is the whole point of writing it down rather than calling.