The Department of Health and Human Services (HHS) recently issued a proposed rule that modifies the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule's standard for the accounting of disclosures of protected health information (PHI).
This proposed rule addresses changes mandated by the Health Information Technology for Economic and Clinical Health (HITECH) Act, which requires HIPAA-covered entities and business associates to account for PHI disclosures made through an electronic health record for the purpose of treatment, payment, and healthcare operations.
[ILLUSTRATION OMITTED]
The proposed rule divides the accounting rights into two distinct individual rights. The first follows the long-standing accounting of disclosure rules, modifying the existing rule to require an accounting for three years before an individual's request instead of the current six years. The second offers individuals a new right to receive a written 'access report' that describes uses and disclosures of their PHI made through an 'electronic designated record set.'
This report would include information on a covered entity's workforce members who have accessed information and would apply to information in an electronic designated record set, not only information in an electronic health record, as required by HITECH.
The proposed rule was published in the Federal Register May 31 and is available at www. ofrgovOFRUploadOFRData/2011-13297_PI.
