What is an Accounting of Disclosures of PHI?

DISCLAIMER: The information provided in this article, other knowledge base articles, and the Compliancy Group website do not, and are not intended to, constitute legal advice. All information, content, and materials in the Knowledge Base and on the Compliancy Group website are for general informational purposes only.

Under the HIPAA Privacy Rule, an individual has a general right to request and receive, from a covered entity, an accounting of their PHI disclosures made by that covered entity.

What Information Must be Included in an Accounting of Disclosures of PHI?
An individual has a right to receive an accounting of disclosures of protected health information made by a covered entity in the six years prior to the date on which the accounting is requested. 

Generally, the HIPAA accounting of disclosures of PHI must include, for each disclosure:

1. The date of the disclosure;

2. The name of the entity or person who received the protected health information and, if known, the address of such entity or person;

3. A brief description of the protected health information disclosed; and

4. A brief statement of the purpose of the disclosure that reasonably informs the individual of the basis for the disclosure. 
   
   

Accounting discosures must include disclosures to or by business associates of the covered entity.

Can the Accounting of Disclosures Period Be Less Than Six Years?
An individual may request a HIPAA accounting of disclosures of PHI for a period of time less than six years from the date of the request. If such a request is made, the accounting must include disclosures of PHI that occurred during this shorter time period.

What Disclosures Need Not Be Included in an Accounting?
(i) Disclosures to carry out treatment, payment, and health care operations as provided in 45 CFR § 164.506; 

(ii) Disclosures to individuals of protected health information about them as provided in § 164.502; 

(iii) Disclosures Incident to a use or disclosure otherwise permitted or required by the HIPAA Privacy Rule, as provided in § 164.502; 

(iv) Disclosures pursuant to a valid authorization as provided in § 164.508; 

(v) Disclosures for a facility's directory or to persons involved in the individual's care or other notification purposes as provided in § 164.510; 

(vi) Disclosures for national security or intelligence purposes as provided in § 164.512(k)(2); 

(vii) Disclosures to correctional institutions or law enforcement officials as provided in § 164.512(k)(5); 

(viii) Disclosures as part of a limited data set in accordance with § 164.514(e); or

(ix) Disclosures that occurred prior to the compliance date for the covered entity (that is, disclosures that occurred prior to the date by which the covered entity was required to be in compliance with the HIPAA regulations).

By When Must a HIPAA Accounting be Provided?
The covered entity must provide the requested accounting no later than 60 days after it receives the request.

If the covered entity is unable to provide the accounting within the 60 days, the covered entity may extend the time to provide the accounting for up to an additional 30 days, provided that:

1. The covered entity, during the initial 60 days, provides the requesting individual with a written statement of the reasons for the delay and the date by which the covered entity will provide the accounting; and

2. The covered entity may have only one such extension of time for action on a request for an accounting.
   

Can a Covered Entity Charge a Fee for a HIPAA Accounting?
Under the HIPAA Privacy Rule, the covered entity must provide the first accounting to an individual in any 12-month period without charge.

The covered entity may charge a reasonable, cost-based fee (i.e., a fee based on costs incurred by the covered entity with respect to responding to the accounting) for each subsequent request for an accounting by the same individual within the 12-month period, provided that:

1. The covered entity informs the individual in advance of the fee; and

2. The covered entity provides the individual with an opportunity to withdraw or modify the request for a subsequent accounting in order to avoid or reduce the fee.

May a Covered Entity Temporarily Suspend the Right to Receive an Accounting?
A covered entity must temporarily suspend an individual's right to receive an accounting of disclosures to a health oversight agency or law enforcement official, as provided in § 164.512(d) or (f), respectively, for the time specified by such agency or official, if such agency or official provides the covered entity with a written statement that such an accounting to the individual would be reasonably likely to impede the agency's activities and specifying the time for which such a suspension is required. 

If the agency or official statement referenced above is made orally, the covered entity must: 

(A) Document the statement, including the identity of the agency or official making the statement; 

(B) Temporarily suspend the individual's right to an accounting of disclosures subject to the statement; and 

(C) Limit the temporary suspension to no longer than 30 days from the date of the oral statement, unless a written statement, as mentioned above, is submitted during that time.

What are the Documentation Requirements for an Accounting of Disclosures of PHI?
A covered entity must document the following, and retain the documentation:  

(1) The information required to be included in an accounting under paragraph (b) of this section for disclosures of protected health information that are subject to an accounting;

(2) The written accounting that is provided to the individual; and 

(3) The titles of the persons or offices responsible for receiving and processing requests for an accounting by individuals.

Required documentation must be maintained by the covered entity for six years from the date of its creation or the date when it last was in effect, whichever is later.