Privacy & Information Security Law Blog

On May 27, 2011, the Department of Health and Human Services (“HHS”) issued a notice of proposed rulemaking regarding the HIPAA Privacy Rule provision that requires covered entities to provide an accounting of disclosures of protected health information (“PHI”) to individuals upon request.  The proposed rule revises existing HIPAA Privacy Rule provisions regarding an accounting of disclosures and also gives individuals a new right to obtain an “access report” about which specific individuals have accessed electronic PHI in a designated record set.  The proposed rule also requires covered entities to modify their privacy notices to include that individuals have the right to obtain an access report from the covered entities.

The revisions regarding the accounting of disclosures provisions limit an individual’s right to such an accounting to only the three years prior to the request (the current provisions extend that right to six years prior to the request) and require covered entities to include either the month and year of the disclosure, or a description of when the disclosure occurred from which an individual can readily determine the month and year of the disclosure.

The new access report provision is intended to allow individuals to learn if specific persons have accessed their PHI contained in a designated record set.  The access report must contain certain content requirement such as the date and time of access as well as a description of any action taken by the individuals that accessed the PHI (e.g., create, modify, access or delete).

This rulemaking is required by the Health Information Technology for Economic and Clinical Health (“HITECH”) Act.  The new rules revising the accounting of disclosures provisions becomes effective 180 days after the effective date of the final regulation while the access report provisions become effective January 1, 2013, for electronic designated record set systems acquired after January 1, 2009, and January 1, 2014, for electronic designated record set systems acquired as of January 1, 2009.