Privacy and Security
Use and Disclosure, Accounting of Disclosures
Current Effective Date:
2/1/16, 11/15/15, 3/30/05
Original Effective Date:
DHHS covered health care components shall, upon written request, provide clients or their personal representative with an accounting of disclosures of the client’s individually identifying health information made by the component, including disclosures made by any of the agency’s internal or external business associates, as appropriate.
Such accounting shall be for the time period requested up to six years prior to the request date, except as otherwise specified within this policy. The elements in the accounting and the provision of the accounting shall be consistent with all stipulations within this policy. DHHS covered health care components and internal business associates shall develop procedures for responding to requests by clients or their personal representatives for an accounting of the disclosures made about the client, and for ensuring the accountings are provided in a timely manner. Business Associate Agreements with external business associates shall include the requirement for providing the covered health care component with a listing of disclosures made by external business associates, upon request of the component.
For the purposes of this policy, ‘disclosure’ shall mean the release, transfer, provision of access to, or otherwise divulging of individually identifiable health information outside of the agency holding the information, and shall include disclosures made in written, oral, or electronic form.
DHHS covered health care components and internal business associates shall designate a staff member who is responsible for receiving requests for accounting of disclosures. It is strongly recommended that this responsibility be limited to one (1) person in the agency. Agencies are encouraged to designate a privacy official as the designated staff member. Each agency shall document the title of the staff member responsible for receiving and processing requests for an accounting. Documentation related to the designation of the staff member must be maintained for at least six (6) years.
The types of disclosures listed below do not have to be included in the Accounting of Disclosures:
Other than the exceptions noted above, all other disclosures of individually identifiable health information must be included in the accounting and may include any of the types of disclosures listed below.
Each DHHS covered health care component shall develop a process for documenting the accounting of disclosures. For those types of disclosures that must be tracked, such process must include tracking disclosures made by the component and their internal and external business associates of individually identifying health information that are disclosed either orally, on paper, or electronically. Disclosures may be tracked manually or in electronic form ensuring accurate and complete accounting of disclosures. Such process could include computerized tracking systems that have the ability to sort by individual and/or date or manual logs with one (1) log per client maintained in the client’s medical record or other file. Each component shall ensure that appropriate staff and business associates receive training on the tracking process.
Each covered component shall determine if documentation of disclosures will be maintained in a centralized (e.g., all accountings maintained in a single database accessible to appropriate agency staff and business associates) or de-centralized fashion (e.g., each location that discloses information maintains an accounting for their location only). Such determination should be based upon complexity of the component and their internal and external business associates and the number of locations disclosing information that would have to be tracked.
If documentation of accounting of disclosures is de-centralized, the designated staff member shall identify all possible locations where disclosures may be made and where such accountings should be maintained; and shall ascertain if information about the client whose accounting is requested has been disclosed by any of the possible locations. It is the responsibility of the designated staff person to collect de-centralized accountings which may remain as many separate documents or be compiled into a single document.
When disclosures are made to a single source for multiple clients, it is not necessary to track each disclosure by making a notation in each medical record that has been accessed. The covered component need only document the following:
It would be sufficient, for instance, for the covered component to maintain a separate notation of such disclosures, applicable to all records so accessed. Then, if an individual requests an accounting, the covered entity need only determine whether the individual’s records were among the universe of records to which the person/agency was granted access. All individuals whose records were accessed in this fashion would receive the same accounting for the disclosure. For example, retrospective review of medical records for all clients treated by a health care provider may be required to identify cases of new or previously unknown infectious agents. If a client requesting an accounting was treated by the health care provider during the period covered by the retrospective review, then the retrospective review should be included as part of the client’s accounting.
If access to a universe of records is provided for a discrete period of time, the accounting can include the range of dates (e.g., access was provided from August 1 to August 3, 2003; or during the week of August 10, 2003). If the disclosure is routinely made within a set period from an event, the component is permitted to provide the date of the event and the normal interval (e.g., hospital discharges reported on 15th of the following month for all discharges during the month of June 2003).
Key features of an accounting of disclosures tracking system should include:
Request for Accounting of Disclosures
A client or personal representative’s request for an accounting of disclosures must be made in writing. Each agency shall designate the person within the agency who will be responsible for receiving and processing all requests for an accounting. Agencies shall forward such requests to the designated person for action.
DHHS covered health care components shall develop and implement procedures for clients or their personal representatives to request an accounting of disclosures; and shall negotiate procedures with their internal and external business associates to coordinate requests for accountings disclosed by the separate agencies/work units.
Providing Accounting of Disclosures to Client or Personal Representative
Upon request, a client or personal representative shall be provided a written accounting of all disclosures of individually identifying health information made after April 14, 2003 by the covered health care component. Such accounting may include any period of time within the six years prior to the date on which the accounting is requested.
Covered health care components are required to act on a request for an accounting of disclosures within 60 days after receipt of the request. If the component cannot provide the accounting within 60 days, the component may extend the time to provide the accounting; however, only one 30-day extension is permitted per request. Any extension requires the component to provide a written statement to the requester regarding the reason for the delay and the expected completion date.
DHHS agencies shall provide the client or personal representative’s first request for an accounting at no charge to the client or personal representative. Agencies may charge the client or personal representative a reasonable, cost-based fee for any subsequent accountings within 12 months from the time the first request is received, provided that the fee includes only the cost of:
Exception: DMH/DD/SAS agencies are bound by 10A North Carolina Administrative Code (NCAC) 26B .0105 when determining fees for copying health information, including accountings of disclosure.
Agencies must inform the client or personal representative in advance of the fee and provide the client or personal representative with an opportunity to withdraw or modify the request for a subsequent accounting in order to avoid or reduce the fee. Adequate time shall be allowed for the client or personal representative to withdraw the request before incurring any costs.
Disclosures made to health oversight agencies or law enforcement officials shall be temporarily excluded from an accounting if the covered component has been notified by the oversight agency or law enforcement official that providing a client or personal representative with an accounting of the disclosures made to them could impede the progress of their activities (e.g., fraud investigation or investigation of possible criminal activities when a client should not be aware of such scrutiny). Such request from a health oversight agency or law enforcement official should be in writing; however an oral request may be accepted with stipulations, as noted below. Suspensions requested in writing shall remain in effect for the duration specified in the written request, unless the request for suspension is rescinded earlier by the health oversight agency or law enforcement official.
If a health oversight organization or law enforcement official requests this temporary suspension orally, the component shall perform the following:
Each component shall retain the following documentation for no less than six (6) years from the date the accounting request was received:
In the facilities operated by DMH/DD/SAS, the request for accounting and copy of the accounting provided to the client shall be maintained in the client’s medical record. All other covered components shall determine the most appropriate location for maintaining the documentation.
Contents of the Accounting of Disclosures to Clients or Their Personal Representatives
Each accounting of a disclosure shall contain the following elements:
Disclosures for research purposes wherein authorization for use and disclosure of individually identifiable health information for research purposes has been waived or is not required must be included in the accounting of disclosures; however, disclosures for research purposes wherein authorization has been obtained for use and disclosure of such information do not have to be included in the accounting of disclosures.
If disclosures are made for 50 or more clients for research purposes, the accounting must include:
If the component provides the modified content described above (in lieu of the standard content for an accounting), upon request by the client or personal representative, the component shall assist the client or personal representative in contacting the researcher if disclosures for research purposes were made by the component.
Due to the complexity of this policy and the involvement of numerous clinical, professional, clerical, and administrative staff, as well as business associates who must ensure disclosures are accounted for, each agency will need to develop a system for routinely monitoring compliance with this policy.
DHHS covered health care components must develop procedures that address the following processes for ensuring their clients’ right to an accounting of disclosures of their health information. Procedures need to be coordinated between covered health care components and internal and external business associates.
For questions or clarification on any of the information contained in this policy, please contact DHHS Privacy Officer. For general questions about department-wide policies and procedures, contact the DHHS Policy Coordinator.