Center for Eye Care

Tracking Disclosures

 

Until the HIPAA privacy rule, there was no federal law requiring a tracking mechanism for release of information. Under HIPAA, covered entities are required to track disclosures of protected health information (PHI).

The purpose of tracking disclosures is to provide an individual with an account of disclosures for the six years prior to the date of their request. To accommodate this requirement, a tracking mechanism and reporting process will need to be developed.

Legal Requirements

The standards for privacy of individually identifiable health information give an individual the right to receive a written accounting of disclosures of their protected health information made by a covered entity in the six years prior to the date of which the accounting is requested. An individual may request an accounting for a period of time less than six years. HIPAA defines disclosure as "the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information." This includes disclosures to or by business associates of the covered entity. There are a number of exclusions that do not require tracking.

Disclosures That Do Not Require Tracking

Not all disclosures require tracking or need to be accounted for upon request by an individual. The following disclosures of PHI are excluded:

  1. Disclosures made for treatment, payment, and healthcare operation purposes
  2. Disclosures made to the individual
  3. Disclosures made for directory purposes
  4. Disclosures made to persons involved in the individual's care
  5. Disclosures made for national security or intelligence purposes
  6. Disclosures to correctional institutions or law enforcement officials
  7. Disclosure made prior to the date of compliance with the privacy standards

 

All other disclosures of PHI must be tracked. Disclosures are not limited to hard-copy information but any manner that divulges information, including verbal release. Many disclosures that require tracking will be accompanied by an authorization or written request.

 

Tracking Procedures

 

The Center for Eye care will track all disclosures not for the purposes listed above. The Public Information Officer will maintain a written journal listing any unauthorized PHI disclosures. Information will include the nature of the disclosure, the information disclosed and by whom.

 

A standardized form is available from the Public Information Officer for requesting an accounting of disclosures of PHI.