Procedure HIPAA 5003 PR.1 Accounting for Disclosures
Revision Date: 1/16/04
Accounting for Disclosures .................................................................................................................................................................1 Disclosure Exceptions ........................................................................................................................................................................1 An accounting is not required for disclosures:....................................................................................................................................1 Disclosures that Commonly Qualify for Accounting ...........................................................................................................................1 Logging Disclosures ............................................................................................................................................................................2 Disclosures of PHI of 50 or More Individuals for a Particular Research Purpose..........................................................................3 Request for Accounting of Disclosures ..............................................................................................................................................3 Suspensions of Accounting ................................................................................................................................................................3 Written Suspension Request. .............................................................................................................................................................3 Oral Suspension Request. .................................................................................................................................................................4 Processing a Request for Accounting................................................................................................................................................4
Accounting for Disclosures
Yale must account for all known disclosures of protected health information outside the covered entity with certain exceptions.
Disclosure Exceptions
An accounting is not required for disclosures: made to carry out treatment, payment, or operations to the patient or the patients personal representative that are incidental disclosures made in connection with a use or disclosure otherwise permitted or required by HIPAA made to persons involved in a patients care or as part of an inpatient directory pursuant to an authorization for release of information signed by the patient or patients personal representative for national security or intelligence purposes to correctional institutions, or to law enforcement officials under certain circumstances to correctional institutions or law enforcement officials under certain circumstances as part of a limited data set, when the recipient has executed a data use agreement, disclosed for research, public health, or certain health care operations purposes that occurred prior to April 14, 2003 Under Connecticut law, a requested accounting of all disclosures of HIV-related information must be provided to the patient or personal representative, except those disclosures that are made to: A federal, state, or local health officer when required or permitted by law. Persons reviewing information or records in the ordinary course of ensuring that a health facility is in compliance with applicable quality of care standards, program evaluation, program monitoring or service review. Life and health insurers, government payers and health care centers in connection with underwriting and claim activity for life, health, and disability benefits.
Disclosures that Commonly Qualify for Accounting
An accounting is required if the disclosure is made and no authorization from the patient or patients personal representative is obtained:
HIPAA Procedure 5003PR.1 - Accounting for Disclosures
In response to a subpoena or other judicial or administrative proceeding if not accompanied by a patient authorization. For public health activities, including reports of vital events, public health surveillance, and investigations; communicable disease; adult and child abuse, neglect, or domestic violence; information associated with an FDA-regulated product or activity; and disclosures to an employer to conduct an evaluation relating to medical surveillance of the workplace or to evaluate whether the individual has a work-related illness or injury (and in addition, the employer needs such information to comply with federal or state law, and notice has been given to the individual at the time care is provided or there is a notice at the work site. For health oversight activities or law enforcement purposes unless the health oversight or law enforcement agency has provided an official statement to temporarily suspend the individuals right to receive an accounting for a specified period of time during which such an accounting would impede the agencys activities. To coroners, medical examiners, funeral directors, and for cadaveric organ donation purposes. To avert a serious threat to health or safety and for specialized government functions except national security and intelligence activities and correctional institutions or other law enforcement custodial situations. For workers compensation purposes pertaining to treatment of potential work-related injuries. For research purposes on decedents For research purposes if a waiver of authorization has been obtained from an IRB In error as a result of a misdirected fax, e-mail, postal mail, etc. By a Business Associate who has notified Yale of the disclosure event.
Logging Disclosures
Disclosures that qualify for accounting must be logged as they occur in the Accounting of Disclosures Log (Exhibit 5003 EX.A) that is filed [in the patients medical record] and/or an electronic equivalent, e.g. Central Database In the event an accounting of disclosures is requested in writing by the patient or their Personal representative, Yale must provide an accurate accounting of all disclosures that qualify and that fit the criteria the patient has indicated in their request, i.e. date range.
Multiple Disclosures to the Same Person or Entity for a Single Purpose
If, during the relevant accounting period, multiple disclosures of the patients PHI have been made (1) to HHS for the purpose of determining Yales compliance with the Privacy Rule or (2) to the same person or entity for a single purpose, and the purpose is: Required by law For a public health or health oversight activity To report abuse, neglect or domestic violence For judicial and administrative proceedings For law enforcement purposes To a medical examiner or funeral director For organ and tissue donation For research that does not require individual Authorization To avert a serious threat to health or safety For specialized government functions; or To comply with laws relating to workers compensation; Then the Accounting for Disclosures Log and Response forms may provide: For the first such disclosure, the date of the disclosure, the name and address of the organization or person to whom the disclosure was made, a brief of description the PHI disclosed and the purpose of the disclosure.
1/16/2004 Page 2 of 4
HIPAA Procedure 5003PR.1 - Accounting for Disclosures
The frequency, periodicity or number of additional disclosures made during the accounting period and
the date of the last such disclosure during the accounting period.
Disclosures of PHI of 50 or More Individuals for a Particular Research Purpose
If, during the relevant accounting period, Yale has disclosed, for a particular research purpose which does not require individual Authorization, the PHI of fifty or more individuals, and PHI about the patient may have been included in the disclosure(s): The Accounting for Disclosures Log and Response forms may provide the name of the protocol or other research activity, a description of the research protocol or activity (including the purpose of the research and the criteria for selecting particular records), a description of the type of PHI disclosed, the date or period of time during which the disclosures occurred (including the date of the last disclosure during the accounting period), the name, address and telephone number of the research sponsor and of the researcher, and a statement that the PHI of the patient may or may not have been disclosed for a particular research protocol or activity. If it is reasonably likely that the patients PHI was disclosed for the research protocol or activity, Yale will, at the patients request, assist in contacting the research sponsor and the researcher.
Request for Accounting of Disclosures
Patients (or their Personal Representatives see Yale Policy 5038 - Personal Representatives) may request an accounting of disclosures by submitting a request in writing using the Request for Accounting of Disclosures of Protected Health Information form, or other sufficient written documentation requesting the information, to the [Health Information Services Department]. The request should state the time period for which the accounting is to be supplied, which may not be longer than six years and may not include dates before April 14, 2003. If no time period is stated, Yale should contact the patient for clarification; or if the patient cannot be reached, assume that the time period for the request is either six years or from April 14, 2003 to the date of the request, whichever is shorter. The request should state whether the patient wishes to be sent the accounting via postal mail, fax or if they will pick it up in person.
Suspensions of Accounting
In some cases, a health oversight agency or law enforcement official may request that Yale suspend a patients right to receive an accounting of the disclosures made to that agency or official. Contact the Yale Privacy Officer to determine if a portion of or the entire medical record is under suspension. If no such suspension exists, continue with the procedures under Processing a Request for Accounting, otherwise, the following procedures must be followed.
Written Suspension Request.
The agency or official must present to Yale a statement, in writing, that providing the patient with an accounting of disclosures made to the agency or official would be reasonably likely to impede the agency or officials activities. This statement must also specify how long the suspension will be required. During the period of suspension, Yale staff must prepare the accounting list requested by the patient, but exclude any disclosures that were made to the agency or official. Do not notify the patient that these disclosures were excluded. When the suspension period is over, Yale staff must record the disclosures made to the agency or official in an accounting for the patient in the Accounting of Disclosures Log.
1/16/2004
Page 3 of 4
HIPAA Procedure 5003PR.1 - Accounting for Disclosures
Oral Suspension Request.
If the agency or official asserts that there is insufficient time to prepare a written statement, Yale staff may grant a suspension for 30 days based on the agency or officials oral representation that suspension is needed for the reasons above (in person or on the telephone). A Yale staff member must document that the agency or official in person or on the phone made these statements. The staff member must also record the identity of the agency or the official. After 30 days, the Yale staff must record the disclosures made to the agency or official in an accounting fo...