Accounting of Disclosures of Protected Health Information (PHI) Policy

Title

The University of North Carolina at Chapel Hill Accounting of Disclosures of Protected Health Information (PHI) Policy

Policy

Pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), individuals have the right to request an accounting of disclosures of their Protected Health Information (PHI) made by a UNC-Chapel Hill covered health care provider in the six years prior to the request (but no earlier than April 14, 2003).

UNC-Chapel Hill is not required to account for the following disclosures:

1. To carry out Treatment, Payment or Operations activities;
2. Pursuant to an authorization from the patient;
3. To individuals requesting their own PHI;
4. For the facility's directory or to persons involved in the individual's care or other notification purposes;
5. Incidental to a permissible use or disclosure;
6. For national security or intelligence purposes;
7. To correctional institutions or law enforcement officials;
8. As part of a limited data set;
9. Deidentified data; or
10. That occurred prior to the compliance date of April 14, 2003.

Procedure

Right to Accounting of Disclosure of PHI

Except as otherwise provided by law, an individual may request a written accounting of all PHI disclosures that occurred during the six years (or shorter time period if requested) prior to the date of the request. This includes disclosures to and by Business Associates

Content Standards for the Accounting of Disclosure of PHI

1. The accounting for each disclosure must include:
   1. The date of the disclosure;
   2. The name of the entity or person who received the PHI and, if known, the address of such entity or person;
   3. A brief description of the PHI disclosed; and
   4. A brief statement of the purpose of the disclosure that reasonably informs the individual of the basis for the disclosure; or, in lieu of such statement a copy of a written request for a disclosure, if any.
2. If UNC-Chapel Hill has made multiple disclosures of PHI to the same person or entity for a single purpose, or pursuant to a single authorization, the accounting may, with respect to such multiple disclosures, provide:
   1. The information required above;
   2. The frequency or number of the disclosures made during the accounting period; and
   3. The date of the last such disclosure during the accounting period.

Accounting for Research Disclosures

If disclosures are made for a particular research purpose for 50 or more individuals pursuant to a waiver of authorization by an IRB or Privacy Board, the accounting may, with respect to such disclosures for which the PHI about the individual may have been included, provide:

1. The name of the protocol or other research activity;
2. A brief description of the research protocol or other research activity, including the purpose of the research and the criteria for selecting particular records;
3. A brief description of the type of PHI that was disclosed;
4. The date or period of time during which disclosures occurred;
5. The name, address and telephone number of the entity that sponsored the research and of the researcher to whom the information was disclosed; and
6. A statement that the PHI of the individual may or may not have been disclosed for a particular protocol or other research activity.

If any disclosures of this type are made, a separate accounting form ("Accounting of Disclosures of PHI for Research when Entity has made Disclosures of PHI for 50 or more individuals") will be used to account for these disclosures and provided along with the standard accounting form.

For disclosures for a particular research purpose pursuant to a waiver of authorization by an IRB or Privacy Board for 49 or fewer individuals, the content of the accounting shall be in accordance with earlier section, "Content Standards for the Accounting of Disclosures of PHI".

Time to Respond

1. UNC-Chapel Hill must respond to the individual's request for an accounting within 60 days after receipt of such a request, as follows:
   1. Provide the individual with the accounting requested; or
   2. If UNC-Chapel Hill is unable to provide the accounting within the time required above, UNC-Chapel Hill may extend the time to provide the accounting by no more than 30 days, provided that:
      1. UNC-Chapel Hill, within the time limit of 60 days, provides the individual with a written statement of the reasons for the delay and the date by which the covered entity will provide the accounting; and
      2. UNC-Chapel Hill may have only one such extension of time for action on a request for an accounting.
2. UNC-Chapel Hill must provide the first accounting to an individual in any 12-month period without charge. UNC-Chapel Hill may impose a reasonable, cost-based fee for each subsequent request for an accounting by the same individual within the 12-month period, provided that UNC-Chapel Hill informs the individual in advance of the fee and provides the individual with an opportunity to withdraw or modify the request for a subsequent accounting.

Required Documentation for Accounting of Disclosures

UNC-Chapel Hill personnel need to account for disclosures of PHI by documenting any such disclosures. All other medical record holders will account for disclosures in their designated system. The Health Information Management (HIM) department of the UNC- Chapel Hill covered health care provider will be responsible for receiving and processing requests for an accounting of disclosures. HIM department must document and maintain a copy of the following:

1. The "Request for Accounting of Disclosures of PHI" form completed by the individual.
2. The written accounting that is provided to the individual requesting an accounting of disclosures.
3. The required information to be included in an accounting of disclosures, as outlined in the earlier section "Content Standards for the Accounting of Disclosure of PHI."

Temporary Suspension of the Individual's Right of Accounting of Disclosures

An official from a health oversight or law enforcement agency may request a temporary suspension of an individual's right to an accounting for disclosures to those particular agencies under the following circumstances:

1. UNC-Chapel Hill must temporarily suspend an individual's right to receive an accounting of disclosures to a health oversight agency or law enforcement official if such agency or official provides UNC-Chapel Hill with a written statement that such an accounting to the individual would be reasonably likely to impede the agency's activities.
   
   The written statement must specify the time period for which such a suspension is required.
2. If the agency or official suspends an individual's right to receive an accounting of disclosures and the statement is made orally, UNC-Chapel Hill must:
   1. Document the statement, including the identity of the agency or official making the statement;
   2. Temporarily suspend the individual's right to an accounting of disclosures subject to the statement; and
   3. Limit the temporary suspension to no longer than 30 days from the date of the oral statement, unless a written statement from the suspending agency or official is submitted during the time period.

The suspension of accounting ONLY applies to accountings to the particular health oversight or law enforcement agency requesting the suspension. An accounting to individuals or entities other than the specified health oversight or law enforcement agency requesting the suspension of accounting shall be made in accordance with this policy.

Reference

45 C.F.R. §164.528