Under HIPAA Privacy and as outlined on your NPP, the patient has many rights. One of these is the right to request an accounting of all non-TPO disclosures (any disclosure that is not for treatment, payment, or health care operations). For this reason, it is required that each patient's chart contain a disclosure log. Anytime information is disclosed for a non-TPO purpose, except for "incidental disclosures", it must be documented on the patient's "Log for PHI Disclosures" form (found in the "HIPAA Privacy Forms" section).
For example, if a disclosure is made to an attorney, to a school, or to a public health agency, the disclosure should be added to the patient's Log for PHI Disclosures form. That way, if the patient were to request the accounting of non-TPO disclosures (use the "Request for Accounting of PHI Disclosures Form"), the log is already up-to-date. Simply provide the patient with the information contained in the log. The patient may receive an accounting free once in a 12-month period.
Even though most non-TPO uses and disclosures of PHI have to be logged, there are a few exceptions. Examples of disclosures that do not have to be accounted for are:
* For disclosures pursuant to an authorization
* For reporting abuse and neglect
* For National Security and/or Intelligence purposes
* To a Correctional Institution or Law Enforcement Officer having lawful custody of an inmate about whom the PHI applies
* The PHI is part of a Limited Data Set
* The disclosure occurred prior to 4/14/03
* Other reasons listed on your Notice of Privacy Practices