HIPAA Blog

[ Friday, May 27, 2011 ]

 

Accounting Rule Released Today: In addition to laying out the rules providers and plans must abide by in using and disclosing PHI, the original privacy rule sought to outline the specific rights every individual has in their own PHI. One of those rights is a right to know where your information has gone, in the form or a right to request an accounting of disclosures from a covered entity. Obvioualy, there are a lot of disclosures that are usual and customary, and a requirement to provide a full accounting to any patient who asked would be unweildy and expensive. So while the accounting requirement is broadly drafted, many (almost all, actually) disclosures are exempted from the disclosure requirement. A covered entity does not have to account for disclosures that are made for treatment, healthcare or operations purposes (which accounts for virtually all disclosures in the ordinary course of business), disclosures to the individual, or disclosures pursuant to an authorization by the individual. There's a rational basis for these exclusions: individuals should know or expect that these types of disclosures will be made.

The HITECH Act changed the accounting requirement somewhat for covered entities that use electronic health records. Specifically, the exception for treatment, payment, and healthcare operations (TPO) is removed. The thought is that covered entities that use EHRs should be able to easily and automatically track TPO disclosures, simply by setting the EHR to do so. I'm not so sure that's actually as easily done as said.

Today, HHS has pre-published its regulations regarding the new "accounting for disclosures" rule. I haven't reviewed yet, but will do so and will let you know what I think.

UPDATE (already, yeah): Kirk Nahra says they look ugly and obtrusive, and even go beyond what HITECH calls for. The industry concern was that HITECH implied that it would be easy to set an EHR to do the accounting, which isn't the case in some (if not many, if not most) EHRs. Apparently HHS' response to those concerns is, "Drop dead."

Jeff [9:57 AM]

Comments: Post a Comment
http://www.blogger.com/template-edit.g?blogID=3380636 Blogger: HIPAA Blog - Edit your Template