TRACKING DISCLOSURES

Until the HIPAA privacy rule, there was no federal law requiring a tracking mechanism for release of information. Under HIPAA, covered entities are required to track disclosures of protected health information (PHI).

The purpose of tracking disclosures is to provide an individual with an account of disclosures for the six years prior to the date of their request. To accommodate this requirement, a tracking mechanism and reporting process will need to be developed.

Legal Requirements

The standards for privacy of individually identifiable health information give an individual the right to receive a written accounting of disclosures of their protected health information made by a covered entity in the six years prior to the date of which the accounting is requested. An individual may request an accounting for a period of time less than six years.

HIPAA defines disclosure as "the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information." This includes disclosures to or by business associates of the covered entity. There are a number of exclusions that do not require tracking.

Disclosures That Do Not Require Tracking

Not all disclosures require tracking or need to be accounted for upon request by an individual. The following disclosures of PHI are excluded:

1. Disclosures made for treatment, payment, and healthcare operation purposes
2. Disclosures made to the individual
3. Disclosures made for directory purposes
4. Disclosures made to persons involved in the individual's care
5. Disclosures made for national security or intelligence purposes
6. Disclosures to correctional institutions or law enforcement officials
7. Disclosure made prior to the date of compliance with the privacy standards

Additional criteria/clarification can be found in the sections referenced after each statement.

All other disclosures of PHI must be tracked. Disclosures are not limited to hard-copy information but any manner that divulges information, including verbal release. Many disclosures that require tracking will be accompanied by an authorization or written request. A mechanism will need to be in place to track other types of disclosures that do not have a paper trail.