It is good to remember that under HIPAA Privacy and as outlined on your NPP, the patient has many rights. One of these is the right to request an accounting of all non-TPO disclosures (any disclosure that is not for treatment, payment, or health care operations). For this reason, it is required that each patient's chart contain a disclosure log.
Anytime information is disclosed for a non-TPO purpose, except for "incidental disclosures", it must be documented on the patient's "Log for PHI Disclosures" form (can be found in our HIPAA Privacy Forms section).
For example, if a disclosure is made to an attorney, to a school, or to a public health agency, the disclosure should be added to the patient's Log for PHI Disclosures form. That way, if the patient were to request the accounting of non-TPO disclosures (use the "Request for Accounting of PHI Disclosures Form"), the log is already up-to-date. Simply provide the patient with the information contained in the log. The patient may receive an accounting free once in a 12-month period.
Even though most non-TPO uses and disclosures of PHI have to be logged, there are a few exceptions.
Examples of disclosures that do not have to be accounted for include: disclosures made pursuant to an authorization; reporting abuse and neglect; national security and/or intelligence purposes; reported to a correctional institution or law enforcement officer having lawful custody of an inmate about whom the PHI applies; if the PHI is part of a limited data set; the disclosure occurred prior to 4/14/03 and for other reasons listed on your Notice of Privacy Practices.