• Accounting for Disclosures

HIPAA Procedure 5003 PR.1
Accounting for Disclosures
Revision Date: 1/16/04
Accounting for Disclosures .................................................................................................................................................................1
Disclosure Exceptions ........................................................................................................................................................................1
An accounting is not required for disclosures:....................................................................................................................................1
Disclosures that Commonly Qualify for Accounting ...........................................................................................................................1
Logging Disclosures ............................................................................................................................................................................2
Disclosures of PHI of 50 or More Individuals for a Particular Research Purpose..........................................................................3
Request for Accounting of Disclosures ..............................................................................................................................................3
Suspensions of Accounting ................................................................................................................................................................3
Written Suspension Request. .............................................................................................................................................................3
Oral Suspension Request. .................................................................................................................................................................4
Processing a Request for Accounting................................................................................................................................................4
Accounting for Disclosures
Yale must account for all known disclosures of protected health information outside the covered entity
with certain exceptions.
Disclosure Exceptions
An accounting is not required for disclosures:
• made to carry out treatment, payment, or operations
• to the patient or the patient’s personal representative
• that are incidental disclosures made in connection with a use or disclosure otherwise permitted or
required by HIPAA
• made to persons involved in a patient’s care or as part of an inpatient directory
• pursuant to an authorization for release of information signed by the patient or patient’s personal
representative
• for national security or intelligence purposes to correctional institutions, or to law enforcement officials
under certain circumstances
• to correctional institutions or law enforcement officials under certain circumstances
• as part of a limited data set, when the recipient has executed a data use agreement, disclosed for
research, public health, or certain health care operations purposes
• that occurred prior to April 14, 2003
Under Connecticut law, a requested accounting of all disclosures of HIV-related information must be
provided to the patient or personal representative, except those disclosures that are made to:
• A federal, state, or local health officer when required or permitted by law.
• Persons reviewing information or records in the ordinary course of ensuring that a health facility is in
compliance with applicable quality of care standards, program evaluation, program monitoring or
service review.
• Life and health insurers, government payers and health care centers in connection with underwriting
and claim activity for life, health, and disability benefits.
Disclosures that Commonly Qualify for Accounting
An accounting is required if the disclosure is made and no authorization from the patient or patient’s
personal representative is obtained:
 HIPAA Procedure 5003PR.1 - Accounting for Disclosures
• In response to a subpoena or other judicial or administrative proceeding if not accompanied by a
patient authorization.
• For public health activities, including reports of vital events, public health surveillance, and
investigations; communicable disease; adult and child abuse, neglect, or domestic violence;
information associated with an FDA-regulated product or activity; and disclosures to an employer to
conduct an evaluation relating to medical surveillance of the workplace or to evaluate whether the
individual has a work-related illness or injury (and in addition, the employer needs such information to
comply with federal or state law, and notice has been given to the individual at the time care is
provided or there is a notice at the work site.
• For health oversight activities or law enforcement purposes unless the health oversight or law
enforcement agency has provided an official statement to temporarily suspend the individual’s right to
receive an accounting for a specified period of time during which such an accounting would impede
the agency’s activities.
• To coroners, medical examiners, funeral directors, and for cadaveric organ donation purposes.
• To avert a serious threat to health or safety and for specialized government functions except national
security and intelligence activities and correctional institutions or other law enforcement custodial
situations.
• For workers’ compensation purposes pertaining to treatment of potential work-related injuries.
• For research purposes on decedents
• For research purposes if a waiver of authorization has been obtained from an IRB
• In error as a result of a misdirected fax, e-mail, postal mail, etc.
• By a Business Associate who has notified Yale of the disclosure event.
Logging Disclosures
Disclosures that qualify for accounting must be logged as they occur in the Accounting of Disclosures Log
(Exhibit 5003 EX.A) that is filed [in the patient’s medical record] and/or an electronic equivalent, e.g.
Central Database
In the event an accounting of disclosures is requested in writing by the patient or their Personal
representative, Yale must provide an accurate accounting of all disclosures that qualify and that fit the
criteria the patient has indicated in their request, i.e. date range.
Multiple Disclosures to the Same Person or Entity for a Single Purpose
If, during the relevant accounting period, multiple disclosures of the patient’s PHI have been made (1) to
HHS for the purpose of determining Yale’s compliance with the Privacy Rule or (2) to the same person or
entity for a single purpose, and the purpose is:
• Required by law
• For a public health or health oversight activity
• To report abuse, neglect or domestic violence
• For judicial and administrative proceedings
• For law enforcement purposes
• To a medical examiner or funeral director
• For organ and tissue donation
• For research that does not require individual Authorization
• To avert a serious threat to health or safety
• For specialized government functions; or
• To comply with laws relating to workers’ compensation;
Then the Accounting for Disclosures Log and Response forms may provide:
• For the first such disclosure, the date of the disclosure, the name and address of the organization or
person to whom the disclosure was made, a brief description of the PHI disclosed and the purpose of
the disclosure.
1/16/2004 Page 2 of 4
 HIPAA Procedure 5003PR.1 - Accounting for Disclosures
• The frequency, periodicity or number of additional disclosures made during the accounting period and
the date of the last such disclosure during the accounting period.
Disclosures of PHI of 50 or More Individuals for a Particular Research
Purpose
If, during the relevant accounting period, Yale has disclosed, for a particular research purpose which does
not require individual Authorization, the PHI of fifty or more individuals, and PHI about the patient may
have been included in the disclosure(s):
• The Accounting for Disclosures Log and Response forms may provide the name of the protocol or
other research activity, a description of the research protocol or activity (including the purpose of the
research and the criteria for selecting particular records), a description of the type of PHI disclosed,
the date or period of time during which the disclosures occurred (including the date of the last
disclosure during the accounting period), the name, address and telephone number of the research
sponsor and of the researcher, and a statement that the PHI of the patient may or may not have been
disclosed for a particular research protocol or activity.
• If it is reasonably likely that the patient’s PHI was disclosed for the research protocol or activity, Yale
will, at the patient’s request, assist in contacting the research sponsor and the researcher.
Request for Accounting of Disclosures
Patients (or their Personal Representatives – see Yale Policy 5038 - Personal Representatives) may
request an accounting of disclosures by submitting a request in writing using the Request for Accounting
of Disclosures of Protected Health Information form, or other sufficient written documentation requesting
the information, to the [Health Information Services Department].
The request should state the time period for which the accounting is to be supplied, which may not be
longer than six years and may not include dates before April 14, 2003. If no time period is stated, Yale
should contact the patient for clarification; or if the patient cannot be reached, assume that the time period
for the request is either six years or from April 14, 2003 to the date of the request, whichever is shorter.
The request should state whether the patient wishes to be sent the accounting via postal mail, fax or if
they will pick it up in person.
Suspensions of Accounting
In some cases, a health oversight agency or law enforcement official may request that Yale suspend a
patient’s right to receive an accounting of the disclosures made to that agency or official. Contact the
Yale Privacy Officer to determine if a portion of or the entire medical record is under suspension. If no
such suspension exists, continue with the procedures under Processing a Request for Accounting,
otherwise, the following procedures must be followed.
Written Suspension Request.
The agency or official must present to Yale a statement, in writing, that providing the patient with an
accounting of disclosures made to the agency or official would be reasonably likely to impede the agency
or official’s activities. This statement must also specify how long the suspension will be required.
• During the period of suspension, Yale staff must prepare the accounting list requested by the patient,
but exclude any disclosures that were made to the agency or official. Do not notify the patient that
these disclosures were excluded.
• When the suspension period is over, Yale staff must record the disclosures made to the agency or
official in an accounting for the patient in the Accounting of Disclosures Log.
1/16/2004 Page 3 of 4
 HIPAA Procedure 5003PR.1 - Accounting for Disclosures
Oral Suspension Request.
If the agency or official asserts that there is insufficient time to prepare a written statement, Yale staff
may grant a suspension for 30 days based on the agency or official’s oral representation that suspension
is needed for the reasons above (in person or on the telephone).
A Yale staff member must document that the agency or official in person or on the phone made these
statements. The staff member must also record the identity of the agency or the official.
After 30 days, the Yale staff must record the disclosures made to the agency or official in an accounting
for the patient in the Accounting of Disclosures Log, unless the agency or official has provided a written
statement seeking further suspension. The agency’s written statement must meet the requirements
explained above about why the suspension is necessary and how long it will last.
Processing a Request for Accounting
Contact the Yale Privacy Officer to determine if the patients designated record set is under suspension,
as described in the section on Suspensions of Accounting.
Contact the Yale Privacy Officer to determine if any other disclosures of the patient’s designated records
set were reported, e.g. University-wide or from Business Associates.
Review the Accounting of Disclosures Log and/or electronic equivalent to determine whether there are
disclosures applicable to the time period for which an accounting is being requested.
Complete the Accounting for Disclosures Response form to supply:
• the date(s) of disclosure(s),
• the name(s) and address(es) of organizations or persons to whom the disclosure(s) were made,
• a brief description of the protected health information disclosed,
• the purpose of the disclosure(s),
• the name and title of the information privacy official responsible for receiving and processing requests
for accounting of disclosures
• the date the Form was mailed.
The Accounting for Disclosures Response form must be sent to the patient within 60 days of receiving the
request. If an extension is required, send the Accounting for Disclosures Response form to the patient
indicating a 30 day extension is needed to complete the process. Indicate the date that the accounting
will be sent and check off the reason for the delay. Use the same Form to record any extension request
as well as the final accounting for that patient.
Distribute copies of the Accounting for Disclosures Response form as follows:
1. One copy is mailed to the patient or the patient's Personal Representative
2. Original is [filed or scanned] in the [patient's medical record]
These documents must be retained for a period of six years from the later of the date each is created or
was last in effect.
Notify the Yale Privacy Officer that a request for an Accounting of Disclosures was completed, and
provide the patient’s name.
Yale will provide the first accounting to a patient in any 12-month period without charge. For any
subsequent request within the 12-month period, we will charge a reasonable, cost-based (i.e. supplies,
labor, postage) fee. The patient must be informed of the fee in advance and provided with an opportunity
to withdraw or modify the request for a subsequent accounting in order to avoid or reduce the fee.
The official version of this information will only be maintained in an on-line web format. Any and all printed copies of this material are
dated as of the print date. Please make certain to review the material on-line prior to placing reliance on a dated printed version.
1/16/2004 Page 4 of 4