Publications: OCR Requests Comments on Expansion of Accounting of Disclosures Under HITECH Act

On May 3, 2010, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) published a request for information (RFI) on the Health Information Technology for Economic and Clinical Health (HITECH) Act's expansion of an individual's right to receive an accounting of disclosures under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. The HITECH Act expands the Privacy Rule by requiring covered entities to account for disclosures of protected health information (PHI) made for treatment, payment, and healthcare operations if the disclosures are made through an electronic health record (EHR). As it prepares to issue proposed regulations, OCR poses specific questions to, and requests comments from all stakeholders, including covered entities, EHR system vendors, and, in particular, individuals and consumer advocates.

OCR asks how covered entities inform individuals of their right to an accounting of disclosures and how many accounting of disclosures requests a covered entity has received. OCR inquires as to whether a covered entity uses a single EHR system, and whether the system automatically generates an accounting of disclosures or whether the covered entity has a separate system that generates this information. Finally, as the HITECH Act requires covered entities acquiring EHR systems after January 1, 2009, to account for EHR disclosures for treatment, payment, and healthcare operations by January 1, 2011, OCR asks whether compliance with this deadline is feasible and, if not, how long it would take a covered entity to install a feature to track these disclosures.

OCR also directs questions at individuals and consumer advocates, inquiring as to the benefits of an accounting of disclosures, particularly disclosures made for treatment, payment, and healthcare operations; whether individuals are aware of their right to receive an accounting of disclosures; and, if an individual received an accounting of disclosures, whether it provided the information the individual sought. Individuals are queried as to how they use information obtained from an accounting of disclosures; how familiar they are with the activities that constitute "health care operations" under HIPAA; and how important it is to know the specific purpose of a disclosure (rather than just "treatment" or "payment").

Additional questions target EHR system vendors, including whether an EHR system is able to distinguish between PHI "uses" and "disclosures." If the system cannot make the distinction, OCR inquires as to what information the system tracks related to PHI access, how long the tracking information is retained, and the burden of retaining this information for three years. If the EHR system distinguishes "disclosures," OCR asks what disclosure data is automatically collected, whether the system records a standardized description of disclosures (e.g., requiring users to choose from select options), and what data is manually entered. OCR asks about the additional burden on the EHR system to account for disclosures for treatment, payment, and healthcare operations (e.g., additional hardware requirements, an impact on system performance), the feasibility of an EHR module dedicated to accounting for disclosures, and whether such a module is compatible with decentralized EHR systems. In addition, if a vendor's system will be unable to account for EHR disclosures for treatment, payment, and healthcare operations by January 1, 2011, OCR inquires how long it will take the vendor to implement a feature that accounts for such disclosures.

Finally, OCR asks stakeholders whether an accounting of disclosures for treatment, payment, and healthcare operations should include to whom the disclosure was made and the reason for the disclosure.

Comments are due by May 18, 2010.

Copyright 2010 American Health Lawyers Association, Washington, DC
Reprint permission granted.
Further reprint requests should be directed to American Health Lawyers Association
1025 Connecticut Avenue, NW, Suite 600
Washington, DC 20036
(202) 833-1100
For more information on Health Lawyers content, visit us at www.healthlawyers.org.

For more information on the Proposed Rule see Proposed Rule Modifies HIPAA Requirements for Accounting Disclosures.