Covered entities (CE) and business associates (BA) finally know the details of the accounting of disclosures provision in HITECH now that the Department of Health & Human Services (HHS) released a proposed rule on May 27. It was published in the Federal Register on May 31.
The following is a breakdown of the central components of the proposed rule:
What is it: HITECH-required proposed rule, "HIPAA Privacy Rule Accounting of Disclosures under the Health Information Technology for Economic and Clinical Health Act"
What does it do: The HITECH Act requires CEs and BAs to provide an accounting of disclosures of PHI through an electronic health record (EHR), for treatment, payment, and healthcare operations (TPO) dating back three years from such a request. The proposed rule implements this requirement through the right to an "access report," which includes an accounting of who accessed electronic health information in a designated record set (DRS), for any reason. This includes both uses and disclosures, regardless of the purpose.
This is a proposed change in the Rule; it is not yet in effect. We will keep you informed on further developments.