With the new year upon us, here is a helpful HIPAA Privacy reminder for your office. Under HIPAA Privacy and as outlined on your NPP the patient has many rights. One of these is the right to request an accounting of all non-TPO disclosures (any disclosure that is not for treatment, payment, or health care operations). For this reason, it is required that each patient's chart contain a disclosure log. Anytime information is disclosed for a non-TPO purpose, except for "incidental disclosures", it must be documented on the patient's "Log for PHI Disclosures" form (found in the "HIPAA Privacy Forms" section).
For example, if a disclosure is made to an attorney, to a school, or to a public health agency, the disclosure should be added to the patient's Log for PHI Disclosures form. That way, if the patient were to request the accounting of non-TPO disclosures (use the "Request for Accounting of PHI Disclosures Form"), the log is already up-to-date. Simply provide the patient with the information contained on the log. The patient may receive an accounting free once in a 12-month period.
Even though most non-TPO uses and disclosures of PHI have to be logged, there are a few exceptions. Examples of disclosures that do not have to be accounted for are:
- For disclosures pursuant to an authorization
- For reporting abuse and neglect
- For National Security and/or Intelligence purposes
- To a Correctional Institution or Law Enforcement Officer having lawful custody of an inmate about whom the PHI applied
- The PHI is part of a Limited Data Set
- The disclosure occurred prior to 4/14/03
- Other reasons listed on your Notice of Privacy Practices