Proposed regulation released on HIPAA privacy accounting of disclosures

The Department of Health and Human Services Office for Civil Rights (OCR) published a proposed regulation outlining new requirements for accounting of disclosures under the HIPAA Privacy Rule. The proposal details an individual’s right to a full accounting, for up to three previous years, of all disclosures of their health information, including those disclosures made for the purposes of treatment, payment and health care operations. In addition, individuals may request a more concise report on who has electronically accessed their protected health information and when that information was viewed. These changes were mandated in the Health Information Technology for Economic and Clinical Health (HITECH) Act-part of the American Recovery and Reinvestment Act of 2009.  Although physician practices and other covered entities are currently required by the HIPAA Security Rule to track access to electronic protected health information, they are not required to share this information with people. 

These new requirements would go into effect beginning Jan. 1, 2013, for practices that acquired their EHR systems after Jan. 1, 2009. For those practices that acquired their EHRs prior to Jan. 1, 2009, the requirements would go into effect Jan. 1, 2014.
OCR lists its privacy and security enforcement activities on its Web site.

Dallas L Alford IV, CPA is a licensed Certified Public Accountant in the state of North Carolina and owner of Atlantic Financial Consulting, a consulting firm that provides comprehensive medical billing services, practice management consulting, coding audits, Medicare compliance, Medicare RAC support and other general medical practice consulting services.
To learn more about Atlantic Financial Consulting you may visit their website at
http://atlanticfinancial.us  or contact Dallas L Alford IV, CPA directly at 1 888-428-2555, Ext. 200.