Skip to main content

Policy/Memo 118

Number: Policy Memo 118
Date Issued: April 14, 2003
Policy File Ref: A1830
Subject: Individual Rights

ISSUE:

Accounting of Disclosures of PHI

PURPOSE:

To issue instructions to EBD workforce members regarding the process for an individual to submit, and EBD's responsibility to respond to, requests for an accounting of certain disclosures or protected health information (PHI). Under HIPAA, individuals have the right to receive a written accounting of certain disclosures of their PHI made by a health plan or its business associates.

Policy:

Upon request, EBD will provide an individual with a written accounting of disclosures of their PHI made by EBD and its business associates for up to six (6) years prior to the date of the request for an accounting, except for disclosures:

  • For treatment, payment or health care operations (TPO);
  • To the individual;
  • Authorized by the individual;
  • Incident to a use or disclosure otherwise permitted, as listed in this section;
  • To persons involved in the individual's care, or for other specific notification purposes such as in emergency notifications or disaster relief efforts;
  • For national security or intelligence purposes;
  • To correctional institutions or law enforcement officials, when PHI is for an individual in custody and is necessary for certain purposes related to the health and safety of the individual, other inmates, or institution employees;
  • As part of a limited data set; or
  • That occurred prior to April 14, 2003.

The individual's right to receive an accounting of disclosures of PHI to a health oversight agency or law enforcement official must be suspended for the time period specified by such agency or official if the agency or official provides a written statement asserting that the provision of an accounting would be reasonably likely to impede the agency's activities and specifying a time period for the suspension. Such a suspension may be requested and implemented based on an oral notification for a period of up to thirty (30) days. Such oral request must be documented, including the identity of the agency or official making the request. The suspension may not extend beyond thirty (30) days unless a written statement is submitted during that time period.

Procedure:

Tracking of Disclosures:
EBD staff will report disclosures required for accounting purposes to the EBD Privacy Official. The EBD Privacy Official will maintain a database of disclosures of PHI for use when responding to requests for an accounting of disclosures.

Provision of Accounting:
The EBD Privacy Official is responsible for receiving and processing requests for an accounting of disclosures.

All requests received by staff should be forwarded to the EBD Privacy Official.

Within sixty (60) days of receipt of request, the Privacy Official must:

  • Provide the accounting as requested, or;
  • Provide the individual a written statement of the reasons for the delay and the date by which the accounting will be provided. The maximum time to delay a response is an additional thirty (30) days.

Fees: The first accounting of disclosures provided to an individual in any 12 month period will be provided without charge. A reasonable, cost-based fee may be charged for subsequent requests by an individual within the 12 month period. The individual must be notified in advance of the fee and given an opportunity to withdraw or modify the request.

Content Requirements: The written accounting will include the following detail:

  • The accounting shall include all reportable disclosures of PHI that occurred during the six (6) years prior to the date of the request (or shorter time period as specified in the request), including disclosures by or to business associates.
  • The accounting for each disclosure shall include:
    • Date of disclosure;
    • Name of entity or person who received the PHI, and, if known, the address of such entity or person;
    • A brief description of the PHI disclosed; and
    • A brief statement of the purpose of the disclosure that reasonably informs the individual of the basis for the disclosure, or a copy of a written request for a disclosure.
  • If multiple disclosures have been made to the same entity or person for a single purpose, the accounting shall provide the information required for the first disclosure, and then summarize the frequency or number of disclosures made, and the date of the last such disclosure during the accounting period.

Documentation
All documentation related to an accounting of disclosures shall be documented and maintained for a period of six (6) years. This documentation shall include: the information required to be included in an accounting; the written accounting provided to requesting individuals; and the titles of persons or offices responsible for receiving and processing requests for an accounting of disclosures.