Few Requests for Today’s Accountings

HIPAA’s Accounting of Disclosure Provisions Led to Few Patient Requests; Now ARRA Is Upping the Ante

Provisions within the American Recovery and Reinvestment Act extend HIPAA’s accounting of disclosure regulations for providers who maintain electronic health records. The provisions are intended to give patients more information on how their protected health information is used.

The original regulations have been in effect for nearly seven years now. How often have patients availed themselves of the right? What do consumers want or expect from a disclosure? And what challenges do accountings pose for covered entities?

In December 2009 the Journal surveyed AHIMA members on the accountings their organizations have provided to date. Their answers offer a snapshot of the accounting of disclosure experience so far.

In total, 157 HIM professionals responded to the survey. Nearly 60 percent reported that their organization had never received a request for an accounting. Only 14 percent had averaged one or more requests each year since 2003.

The Struggle to Account

When the accounting of disclosure rule was published, HIM professionals foresaw a great administrative challenge, and most expected the resulting value would be small. The following years have borne that out.

Maintaining manual logs is time-consuming, yet the introduction of health IT systems is making the situation worse before it makes it better. As organizations transition to electronic systems incrementally throughout their facilities and departments, record keeping is splitting into paper and electronic systems, adding to the challenge of tracking disclosures. Several respondents whose organizations are farther ahead on the IT curve report that new systems are beginning to ease the workload.

However, for nearly all respondents, tracking disclosures is a frustrating challenge and a near impossibility. Most report that the way their organizations disclose information-from multiple departments through disparate IT systems-makes it difficult to compile a complete and accurate accounting.

Within this decentralized and hybrid environment, it is a challenge to educate and manage the many staff who disclose information, such as those in lab, radiology, and physical therapy. Accordingly, survey respondents report that they cannot vouch for the completeness of the organization’s disclosure record.

Is There a Better Way?

Asked if there were a way to measure the value of the current accounting function, respondents replied universally that there was not.

However, some respondents noted the rule offers benefits that may not be quantifiable. The very process of compliance raises staff awareness of privacy, benefits service to patients, and can improve internal processes.

Few respondents could suggest an alternate method or tool that would better meet patient expectations. The biggest challenges relate to logging disclosures, so presumably better tracking and centralized reporting across an organization’s IT systems would improve accuracy and reduce the burden.

However, some respondents did recommend that a low-tech, high-touch effort to communicate with and educate patients on disclosure would improve the situation. Explaining which disclosures are mandatory and what information is tracked under the current law could meet many consumer needs. Some respondents believe this would be more helpful than providing a log of every disclosure for administrative or clinical use, a requirement of the new ARRA provisions.

It may be difficult to envision a better system in part because the industry may not truly understand what consumers want. Survey respondents whose facilities have fulfilled requests estimated that consumers are roughly split between seeking improper disclosures only, seeking out disclosures to a specific person, and just generally reviewing the record. Approximately a third did not know why accountings were requested.

Several respondents pointed out that ARRA’s new breach notification requirements may meet the needs of those patients who are interested in improper disclosures only. However, as one respondent pointed out, a patient who is informed that his or her information was subject to improper disclosure may well ask to see a record of all disclosures.

ARRA Ups the Ante

In many ways, the new accounting of disclosure requirements in ARRA set forth what EHR systems should be able to do, not what they can do.

ARRA modifies HIPAA to require that covered entities using EHR systems provide an accounting of all record disclosures. This represents a major change from the current rule, which exempt disclosures for treatment, payment, and healthcare operations. However, ARRA shortens the accounting period to three years from the date of the request.

ARRA also requires that covered entities account for the disclosures of their business associates or require the associates to make their own accounting.

Covered entities using EHR systems purchased before January 1, 2009, have until January 1, 2014, to comply. Entities that purchased systems after that date must be compliant by January 1, 2011.