Final Rule for Standards for Privacy of Individually Identifiable Health Information. What the Rule Covers

Analysis by the AHIMA Policy and Government Relations Team

Accounting of Disclosures of Protected Health Information

Standard: Right to an Accounting of Disclosures of PHI

The Rule states (§164.528) that "an individual has a right to receive an accounting of disclosures of PHI made by a covered entity in the six [6] years prior to the date on which the accounting is requested, except for disclosures:

• "To carry out treatment, payment and health care operations;"
  
  
• "To individuals of PHI about them:"
  
  
• "For the facility’s directory or to persons involved in the individual’s care or other notification purposes;
  
  
• "For national security or intelligence purposes"
  
  
• "To correctional institutions or law enforcement officials, as provided
  
  
• "That occurred prior to the compliance date for the covered entity."

Note, that "an individual may request an accounting of disclosures for a period of time less than six years from the date of the request."

The Rule requires that the covered entity must temporarily suspend an individual’s right to receive an accounting of disclosures to a health oversight agency or law enforcement official as provided elsewhere in the Rule, for the time specified by such agency or official, if such agency or official provides the covered entity with a written statement that such an accounting to the individual would be reasonably likely to impede the agency’s activities and specifying the time for which such a suspension is required. If the request to temporarily suspend is made orally by the agency or official, "the covered entity must:

• Document the statement, including the identity of the agency or official making the statement;
  
  
• Temporarily suspend the individual’s right to an accounting of disclosures subject to the statement; and
  
  
• Limit the temporary suspension to no longer than 30 days from the date of the oral statement, unless a written statement…is submitted during that time."

Specifications: Content of the Accounting
The covered entity must provide the individual with a written accounting that meets the following requirements:

• Except for the items covered under the discussion on temporary suspension (just above) "the accounting must include disclosures of PHI that occurred during the six years…[or a shorter period if requested] prior to the date of the request for an accounting, including disclosures to or by business associates of the covered entity.
  
  
• The accounting for each disclosure must include:
  • The date of the disclosure
  • The name of the entity or person who received the PHI and, if known, the address of such entity or person;
  • A brief statement of the purpose of the disclosure that reasonably informs the individual of the basis for the disclosure; or, in lieu of such [a] statement…a copy of the individual’s written authorizations…or a copy of a written request for a disclosure.

• If, during the period covered by the accounting, the covered entity has made multiple disclosures of PHI to the same person or entity for a single purpose…or pursuant to a single authorization…, the accounting may with respect to such multiple disclosures provide:
  • The information required (and listed above) for the first disclosure during the accounting period;
  • The frequency, periodicity, or number of the disclosures made during the accounting period; and
  • The date of the last such disclosure during the accounting period.

Specifications: Provision of the Accounting
"The covered entity must act on the individual’s request for an accounting, no later than 60 days after receipt of such a request. The covered entity must provide the individual with the accounting requested, or if the covered entity is unable to provide the accounting within the time required by...the covered entity may extend the time to provide the accounting by no more than 30 days." The 30-day extension is permissible, provided that within the first 60-day time period the covered entity must "provide the individual with a written statement of the reasons for the delay and the date by which the covered entity will provide the accounting." The covered entity is only permitted one such extension of time for action on a request for an accounting."

"The covered entity must provide the first accounting to an individual in any 12-month period without charge. The entity may impose a reasonable, cost-based fee for each subsequent request for an accounting by the same individual within the 12-month period, provided that the covered entity informs the individual in advance of the fee and provides the individual with an opportunity to withdraw or modify the request for a subsequent accounting in order to avoid or reduce the fee."

Specifications: Documentation
A covered entity must document the following and retain the documentation as required;

• "The information required to be included in an accounting…that is subject to an accounting under" this Rule.
  
  
• "The written accounting that is provided to the individual;" and
  
  
• "The titles of the persons or offices responsible for receiving and processing requests for an accounting by individuals."

Go to next section, Administrative Requirements.

Go to previous section, Amendment of Protected Health Information.

Go to document index.