HIPAA GENERAL OPERATING POLICY #30
ACCOUNTING OF DISCLOSURES OF PHI
I. Right to an Accounting of Disclosures of PHI
An individual has right to receive an accounting of disclosures of PHI made by a HCC in the six years prior to the date on which the accounting is requested, except for disclosures:
a. To carry out treatment, payment and health care operations;
b. To individuals of PHI about them;
c. Incident to a use or disclosure otherwise permitted or required;
d. Pursuant to an authorization;
e. For the facility’s directory or to persons involved in the individual’s care or other notification purposes;
f. For national security or intelligence purposes;
g. To correctional institutions or law enforcement officials in custodial situations;
h. As part of a limited data set; or
i. That occurred prior to April 14, 2003.
II. Suspension of Right to an Accounting
The HCC must suspend an individual’s right to receive an accounting of disclosures to a health oversight agency or law enforcement official for the time specified by such agency or official, if such agency or official provides a written statement that such an accounting would be reasonably likely to impede the agency’s activities and specifying the time for which such a suspension is required.
a. If the agency or official statement is made orally, the HCC must:
b. Document the statement, including the identity of the agency or official making the statement;
c. Temporarily suspend the individual’s right to an accounting of disclosures; and
d. Limit the temporary suspension no longer than 30 days from the date of the oral statement, unless a written statement is submitted during that time.
III. Time Period
An individual may request an accounting of disclosures for a period of time less than six years from the date of the request.
IV. Content of the Accounting
The HCC must provide the individual with a written accounting that meets the following requirements:
a. Except as otherwise provided in section (I) above, the accounting must include disclosures of PHI that occurred during the six years (or a shorter period of time at the request of the individual) prior to the date of the request, including disclosures to or by business associates of the HCC.
b. Except as otherwise provided by paragraphs © and (d) below, the accounting must include for each disclosure:
i. The date of the disclosure;
ii. The name of the entity or person who received the PHI and, if known, the address of such entity or person;
iii. A brief description of the PHI disclosed; and
iv. A brief statement of the purpose of the disclosure that reasonably informs the individual of the basis for the disclosure or a copy of the written request for a disclosure, if any.
c. If, during the period covered by an accounting, the HCC has made multiple disclosures of PHI to the same person or entity for a single purpose, the accounting may, with respect to such multiple disclosures, provide:
i. The information required by paragraph (b) above for the first disclosure during the accounting period;
ii. The frequency, periodicity, or number of the disclosures made during the accounting period; and
iii. The date of the last disclosure during the accounting period.
d. If, during the period covered by the accounting, the HCC has made disclosures of PHI for a particular research purpose for 50 or more individuals, the accounting may, with respect to such disclosures for which PHI of the individual may have been included, provide:
i. The name of the protocol or other research activity;
ii. A description in plain language of the research protocol or activity, including the purpose and criteria for selecting particular records;
iii. A brief description of the type of PHI disclosed;
iv. The date or period of time during which such disclosures occurred, or may have occurred, including the date of the last such disclosure during the accounting period;
v. The name, address and telephone number of the entity that sponsored the research and of the researcher to whom the PHI was disclosed; and
vi. A statement that the PHI may or may not have been disclosed for a particular protocol or other research activity.
vii. If the HCC provides an accounting for research disclosures in accordance with this section, and if it is reasonably likely that the PHI of the individual was disclosed for such research, the HCC shall, at the request of the individual, assist in contacting the entity that sponsored the research and the researcher.
V. Provision of the Accounting
a. The HCC must act on an individual’s request for an accounting, no later than 60 days after receipt of such a request, as follows:
i. The HCC must provide the accounting requested: or
ii. If the HCC is unable to provide the accounting within the time required, the HCC may extend the time for such action by no more than 30 days, provided that it provides a written statement to the individual within the original time limit stating the reasons for the delay and the date by which it will provide the accounting, and the HCC may have only one such extension.
b. The HCC must provide the first accounting to an individual in any 12 month period without charge. The HCC may impose a reasonable, cost-based fee for each subsequent request for an accounting by the same individual within the 12 month period, provided that the HCC informs the individual in advance of the fee and provides the opportunity to withdraw or modify the request in order to avoid or reduce the fee.
VI. Documentation
A HCC must document the following and retain the documentation as required by the regulations:
a. The information required to be included in an accounting for disclosures of PHI that are subject to an accounting;
b. The written accounting that is provided to an individual; and
c. The titles of the persons or offices responsible for receiving and processing requests for an accounting by individuals.