The HIPAA Privacy rule currently provides the right of an individual to receive an “accounting of disclosures,” essentially a listing, of occurrences where a HIPAA covered entity has disclosed the individual’s information to others–but this rule has not considered disclosures made for treatment, payment, and health care operations information that must be included in the accounting.
Now, the HITECH Act has expanded the list of what must be included in the accounting of disclosures. HITECH, which regulates the use of electronic health records (“EHRs”), provides individuals the right to receive information about disclosures made using the individual’s EHR, including for the purposes of advancing treatment, payment, and health care operations. The Health and Humans Services Office of Civil Rights (“OCR”) is required to set forth rules that balance the rights of individuals with the burden of reporting on HIPAA covered entities.
OCR has issued a request for information from individuals and providers as the first step in its rulemaking, which you can review here.
For more information on HIPAA and HITECH, please visit the HLP’s Compliance and HIPAA page, or contact Esq. or Abby Pendleton, Esq. at (248) 996-8510.