A HIPAA Disclosure Accounting is a record that must be kept by healthcare providers and other covered entities in accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. This record is used to provide individuals with information about any uses and disclosures that have been made of their protected health information (PHI). The disclosure accounting must include information about the date, type, and purpose of each disclosure, as well as the name of the recipient of the information. This article will provide an overview of the requirements for a HIPAA Disclosure Accounting and the information that must be provided to the data subject.
What is a HIPAA Disclosure Accounting?
A HIPAA Disclosure Accounting is a record that must be kept by healthcare providers and other covered entities in accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. This record is used to provide individuals with information about any uses and disclosures that have been made of their protected health information (PHI). The disclosure accounting must include information about the date, type, and purpose of each disclosure, as well as the name of the recipient of the information.
The HIPAA Privacy Rule requires covered entities to provide individuals with a Disclosure Accounting of all uses and disclosures of their PHI that have been made in the six years prior to the request. If an individual requests a Disclosure Accounting more than once in a 12-month period, the covered entity may charge a reasonable cost-based fee for each accounting requested.
Understanding the Requirements of a HIPAA Disclosure Accounting
When required, the information provided to the data subject in a HIPAA Disclosure Accounting must include the following elements:
- The date of the disclosure
- The name of the person or entity that received the PHI
- A brief description of the PHI disclosed
- The purpose of the disclosure
- A statement as to whether the disclosure was made pursuant to an authorization or for another purpose
- A statement as to whether the disclosure was made for a routine use or for another purpose
- If the disclosure was made for a routine use, a description of the routine use
In addition, the HIPAA Disclosure Accounting must also include a statement that the individual has the right to receive a copy of the Disclosure Accounting upon request.
In some cases, the covered entity may also need to provide additional information, such as the name of the individual who made the disclosure. Additionally, the covered entity must provide a description of the steps taken to limit the PHI disclosed to the minimum necessary to achieve the purpose of the disclosure.
===
