Earlier this year, the Department of Health and Human Services issued proposed regulations under the privacy rule of the Health Insurance Portability and Accountability Act of 1996. The proposed regulations address the changes to the accounting requirement under the HIPAA privacy rule, pursuant to the Health Information Technology for Economic and Clinical Health Act. The regulations also create a new requirement that covered entities – health plans, health care clearinghouses and health care providers – provide an access report to individuals upon request.
Under the HIPAA privacy rule, people have the right to obtain an accounting of disclosures of their protected health information made by the covered entity. Generally, covered entities are required to provide this accounting within 60 days of the individual’s request. Certain disclosures don’t have to be included, such as disclosures to carry out treatment, payment, or health care operations, and disclosures pursuant to the individual’s authorization. Most disclosures made by group health plans fall within the treatment, payment, or health care operations classification. However, some disclosures made by a group health plan will not fall within the exceptions to the accounting requirement, such as accidental disclosures or disclosures pursuant to a subpoena or court order.
