|
§
164.528 Accounting of disclosures of protected health information.
(a)
Standard: right to an accounting of disclosures of
protected health information.
(1)
An individual has a right to receive an accounting of disclosures of
protected
health information made by a covered entity in the six years prior to the date
on which the accounting is requested, except for disclosures:
(i)
To carry out treatment, payment and health care operations as provided in §
164.502;
(ii)
To individuals of protected health information about them as provided in §
164.502;
(iii)
For the facility’s directory or to persons involved in the individual’s care
or other notification purposes as provided in § 164.510;
(iv)
For national security or intelligence purposes as provided in § 164.512(k)(2);
(v)
To correctional institutions or
law enforcement officials as provided in §
164.512(k)(5); or
(vi)
That occurred prior to the compliance date for the covered
entity.
(2)(i)
The covered entity must temporarily suspend an individual’s right to receive
an accounting of disclosures to a health oversight agency or
law enforcement official, as provided in § 164.512(d) or (f), respectively, for the time
specified by such agency or official, if such agency or official provides the
covered entity with a written statement that such an accounting to the
individual would be reasonably likely to impede the agency's activities and
specifying the time for which such a suspension is required.
(ii)
If the agency or official statement in paragraph (a)(2)(i) of this section is
made orally, the covered entity must:
(A)
Document the statement, including the identity of the agency or official making
the statement;
(B)
Temporarily suspend the individual’s right to an accounting of disclosures
subject to the statement; and
(C)
Limit the temporary suspension to no longer than 30 days from the date of the
oral statement, unless a written statement pursuant to paragraph (a)(2)(i) of
this section is submitted during that time.
(3)
An individual may request an accounting of disclosures for a period of time less
than six years from the date of the request.
(b)
Implementation specifications: content of the accounting. The covered
entity must provide the individual with a written accounting that meets the
following requirements.
(1)
Except as otherwise provided by paragraph (a) of this section, the accounting
must include disclosures of protected health information that occurred during
the six years (or such shorter time period at the request of the individual as
provided in paragraph (a)(3) of this section) prior to the date of the request
for an accounting, including disclosures to or by
business associates of the
covered entity.
(2)
The accounting must include for each disclosure:
(i)
The date of the disclosure;
(ii)
The name of the entity or person who received the protected health information
and, if known, the address of such entity or person;
(iii)
A brief description of the protected health information disclosed; and
(iv)
A brief statement of the purpose of the disclosure that reasonably informs the
individual of the basis for the disclosure; or, in lieu of such statement:
(A)
A copy of the individual’s written authorization pursuant to § 164.508; or
(B)
A copy of a written request for a disclosure under §§ 164.502(a)(2)(ii) or
164.512, if any.
(3)
If, during the period covered by the accounting, the covered entity has made
multiple disclosures of protected health information to the same person or
entity for a single purpose under §§ 164.502(a)(2)(ii) or 164.512, or pursuant
to a single authorization under § 164.508, the accounting may, with respect to
such multiple disclosures, provide:
(i)
The information required by paragraph (b)(2) of this section for the first
disclosure during the accounting period;
(ii)
The frequency, periodicity, or number of the disclosures made during the
accounting period; and
(iii)
The date of the last such disclosure during the accounting period.
(c)
Implementation specifications: provision of the accounting.
(1)
The covered entity must act on the individual’s request for an accounting, no
later than 60 days after receipt of such a request, as follows.
(i)
The covered entity must provide the individual with the accounting requested; or
(ii)
If the covered entity is unable to provide the accounting within the time
required by paragraph (c)(1) of this section, the covered entity may extend the
time to provide the accounting by no more than 30 days, provided that:
(A)
The covered entity, within the time limit set by paragraph (c)(1) of this
section, provides the individual with a written statement of the reasons for the
delay and the date by which the covered entity will provide the accounting; and
(B)
The covered entity may have only one such extension of time for action on a
request for an accounting.
(2)
The covered entity must provide the first accounting to an individual in any 12
month period without charge. The covered entity may impose a reasonable,
cost-based fee for each subsequent request for an accounting by the same
individual within the 12 month period, provided that the covered entity informs
the individual in advance of the fee and provides the
individual with an
opportunity to withdraw or modify the request for a subsequent accounting in
order to avoid or reduce the fee.
(d)
Implementation specification: documentation. A covered entity must
document the following and retain the documentation as required by §
164.530(j):
(1)
The information required to be included in an accounting under paragraph (b) of
this section for disclosures of protected health information that are subject to
an accounting under paragraph (a) of this section;
(2)
The written accounting that is provided to the individual under this section;
and
(3)
The titles of the persons or offices responsible for receiving and processing
requests for an accounting by individuals.
|
