In all cases, a covered entity may deny an individual's request to restrict the use or disclosure of his or her PHI.