HHS issues new HIPAA accounting of disclosures rule

The proposed rule divides the accounting rights into two distinct individual rights. The first right follows the long-standing accounting of disclosure rules, modifying the existing rule to require an accounting for three years prior to an individual’s request instead of the current six years. The second provides a individuals with a new right to receive a written “access report” that describes uses and disclosures of their PHI made through an “electronic designated record set.” This new access report would include information on a covered entity’s workforce members who have accessed information and would apply to information in an electronic designated record set, not only information in an electronic health record, as required by HITECH. 

The proposed rule is available today at http://www.ofr.gov/OFRUpload/OFRData/2011-13297_PI.pdfand will be published in the Federal Register on Tuesday, May 31.

Authored by the HL Chronicle of Data Protection Team