Accounting for unusual uses and disclosures of Protected Health Information (PHI) is a patient's right under the HIPAA Privacy legislation. What this means is that the rule mandates that a use or disclosure of your PHI, outside acceptable limits, must be written into your medical record by a doctor, hospital or health plan. As part of your HIPAA member rights, you are entitled to a reporting of these uses and disclosures. This is called an Accounting of Disclosures.
However, this is a limited right. There is no accounting for the use or disclosure of your PHI for treatment, payment or health care operations. For example, your doctor may talk to a specialist about your treatment without needing to make notes in your medical record. Additionally, your doctor may release your PHI for the purpose of payment for the medical services and treatment you received. Additionally, your doctor may release your PHI to a business associate for health care operations, such as a quality assessment or outcomes evaluation projects focused on the medical practice.
Nor will there be an accounting of a use of disclosure that you have permitted under a written authorization or other release document, nor to your personal representative such as an adult child or your spouse.
So, what is the laundry list of unusual uses and disclosures of your PHI that must be written into your medical record? They include the following:
- Disclosures of PHI that are required by law;
- Disclosures of PHI for public health purposes;
- Disclosure of PHI to report child abuse, or other abuse, neglect or domestic violence;
- Disclosures of PHI to employers under OSHA and other similar laws;
- Disclosures of PHI to state and federal regulators;
- Disclosures due to subpoenas, court orders, discovery requests and other legal processes;
- Disclosures of PHI for law enforcement purposes;
- Use and disclosures of PHI for research purposes;
- Uses and disclosures of psychotherapy notes;
- Disclosures of PHI to avert a serious threat to health or safety;
- Disclosures of PHI for certain government functions;
- Disclosures of PHI to workers' compensation programs;
- Disclosures of PHI of deceased individuals;
- Disclosures of PHI by a whistleblower; and
- Disclosures of PHI by workforce members who are victims of a crime.
Practically speaking this means that if you have a communicable disease such as the flu that is reported to your state health authorities it will be recorded in your medical record. If your PHI is included in the hand notes of a mental health clinician and this special type of clinical information is disclosed it will be recorded in your medical record. If for some reason, such as the OSHA laws, your PHI is disclosed it will be written into your medical record. Most patients have very few of these unusual uses or disclosures of their PHI during their lifetime.
If you want an accounting from your doctor or hospital you must ask for it. In most cases the doctor or hospital will require that you ask for an accounting in writing or they may have a specific form for you to complete. Your doctor or hospital only needs to give you an accounting of the last six years and may ask you to pay for the accounting document that is provided to you. This should not be too much money unless your medical record is three inches thick and they need to search through their archives to complete your request. In most cases, it will cover the cost of the document copies.
Your requested accounting document must include the following data elements for each unusual use or disclosure of your PHI:
- The date of the use or disclosure;
- The name and address, if known, of the person or business entity who received your PHI;
- A description of the PHI used or disclosed;
- A statement of the purpose of the use or disclosure; and
- Any documentation the doctor received asking for your PHI.
One important thing to remember when you request the disclosures - since medical records are not yet linked electronically you may need to ask all your doctors and your hospital for an accounting to have a complete record. For example, you may need to ask your PCP, allergist and surgeon, in addition to your hospital, to get a complete record of unusual uses and disclosures of your PHI.
Remember this patient right is for unusual uses and disclosures of your PHI only! Don't be surprised if it is an empty report or contains very few entries.