When is hipaa disclosure accounting required

The process is simple and requires an electronic compilation of personal health records and a list of who you do business with. Once the initial 30 days are nearing completion, you can inform your patient in writing of the delay and a detailed account of why the delay took place. You can get an extension of only 30 days. Keep in mind, though, that you can request an extension only once. The main provision about the form and format as per HIPAA accounting of disclosure requirements is that it should be readable.

There is a recommendation that you should provide access to the patient about their information in the form and format they requested it in, if producible. If you are unable to produce the accounting in said format, a readable hard copy will work too.

Other forms, such as electronic access, are also acceptable, provided that you and the person making the request can agree to it. As a small medical practice, chances are that you might be relying on paper to manage information about your clients — files with their PHI, history, and more. If you can produce it, well and good. If not, a readable alternative electronic format or even a hard copy will also be acceptable, provided you both can agree upon it.

The problem only begins if the patient declines any other format than the requested electronic copy. HIPAA accounting of disclosure requirements may seem to be rather harsh at times if you have a medical practice, but it is important to understand that at the end of the day, the goal of these requirements is to give patients full control over their health information, and also to minimize liability.

Be sure to follow the 24By7Security Blog for valuable insights from Rema and her colleagues. The JH Privacy Office responds to patient requests for accountings and uses the information provided by the principal investigator and by HIM for this purpose.

Not all disclosures must be tracked : For example, the Privacy Rule does not require JHM to account for disclosures that a person has authorized. Disclosures that need not be tracked include:. The first category is general disclosures. General disclosures of PHI include those made as required by or authorized by other law such as disclosures to public health authorities or law enforcement , or made in response to court orders, subpoenas, etc with certain exceptions, as noted above.

General disclosures should be tracked using the form 8. When a general disclosure is made from research records, this tracking form should be submitted to the JH Privacy Office via email hipaa jhmi.

When a general disclosure is made from clinical records, form 8. If disclosing patient data for research, data sales, or using PHI for marketing purposes is a part of your business operations, it would need to be strategically analyzed and procedurally assessed to ensure compliance with HIPAA laws. Still not sure if or when you need to practice disclosure accounting?

The compliance consultants here at Gazelle can help!