TUSDM Policy on an Individual’s Right to an Accounting of PHI Disclosures

I. Purpose and Scope:

The purpose of this policy is to establish a process by which Tufts University School of Dental Medicine (TUSDM) will respond to individual requests for an accounting of TUSDM’s disclosures of their Personal Health Information (PHI).

II. Policy Statement:

It is TUSDM’s policy, upon request, to provide individuals with a timely accounting of certain disclosures of their PHI as required by law.

III. Definitions:

Protected Health Information

IV. General Rules:

RIGHT TO AN ACCOUNTING OF DISCLOSURES.
1. Basic Right to an Accounting of Disclosures. The individual has a right to receive an accounting of certain disclosures of his or her PHI made by TUSDM or TUSDM’s business associates and made other than through an electronic health record (“EHR”) for the six-year period (or such shorter time period as the individual may request) prior to the date of the request. Such an accounting includes treatment, payment and health care operations disclosures and is available for the three-year period prior to the date of the request (or such shorter time period as the individual may request). If TUSDM had an EHR in place as of January 1, 2009, this expanded accounting right will apply to disclosures made after January 1, 2014.
2. Exceptions to the Accounting Requirement. TUSDM is not required to provide an accounting of disclosures that were made by TUSDM:
  1. prior to April 14, 2003, the compliance date of the Privacy Regulation;
  2. for purposes of treatment of the patient when such disclosures were made other than through an EHR;
  3. for payment activities, including billing, claims management, eligibility determinations, coordination of benefits, determination of cost-sharing amounts, and adjudication of health benefit claims when such disclosures were made other than through an EHR;
  4. for healthcare operations, including management and administrative activities, patient service, quality assessment and improvement activities, training programs, auditing, compliance, business planning and development, and certain due diligence activities conducted in connection with the sale or transfer of assets when such disclosures were made other than through an EHR;
  5. to the individual requesting the accounting;
  6. pursuant to a valid authorization from the individual;
  7. for TUSDM’s directory or to individuals involved in a patient’s care where the patient verbally agreed to the disclosure;
  8. incident to a use or disclosure otherwise permitted or required by the Privacy Regulation;
  9. as part of a limited data set, as defined by the Privacy Regulation;
  10. to authorized federal officials for the conduct of lawful intelligence, counter-intelligence, and certain other national security activities; and
  11. to a correctional institution or law enforcement official, upon a request by, and during such time as, the correctional institution or law enforcement official had lawful custody of the individual.
3. Suspension of Accounting. Under certain circumstances a health oversight agency or law enforcement official may request that TUSDM temporarily suspend the individual’s right to receive an accounting of disclosures to the health oversight agency or law enforcement official. Upon appropriate request, TUSDM must temporarily suspend an individual’s right to receive an accounting of these disclosures for the time specified by such agency or official, if such agency or official provides TUSDM with a written statement that:
  1. such an accounting to the individual would be reasonably likely to impede the agency’s activities; and
  2. specifies the time period for which such a suspension is required.
  3. But, if the agency or official statement is made orally to TUSDM, TUSDM must:
    1. document the statement, including the identity of the agency or official making the statement;
    2. temporarily suspend the individual’s right to an accounting of disclosures subject to the statement; and
    3. limit the temporary suspension to no longer than 30 days from the date of the oral statement, unless a written statement from the agency or official is submitted during that time.
4. Time Period for Action. TUSDM must act on the individual’s request for an accounting no later than 60 days after receipt of such a request, in the following way:
  1. TUSDM must provide the individual with the accounting requested; or
  2. if TUSDM is unable to provide the accounting within 60 days of receipt of the request, TUSDM may extend the time to provide the accounting once, by no more than 30 days, provided that TUSDM, within 60 days of receipt of the request, provides the individual with a written statement of the reason(s) for the delay and the date by which TUSDM will provide the accounting.
5. Fees for Providing an Accounting. TUSDM must provide the first accounting to the patient in any 12-month period without charge. TUSDM may impose a reasonable, cost-based fee for each subsequent request for an accounting by the same individual within the same 12-month period, provided that TUSDM informs the individual in advance of the fee and provides the individual with an opportunity to withdraw or modify the request for a subsequent accounting in order to avoid or reduce the fee.
REQUIRED CONTENTS OF AN ACCOUNTING OF DISCLOSURES.
1. Core Elements. An accounting of disclosures must be in writing and must contain the following elements for each disclosure:
  1. the date of the disclosure;
  2. the name of the entity or person who received the PHI;
  3. the address of the entity or person who received the PHI, if known;
  4. a brief description of the PHI disclosed; and
  5. either of the following:
    1. a brief statement of the purpose of the disclosure that reasonably informs the patient of the basis for the disclosure; or
    2. a copy of a written request for a disclosure made pursuant to TUSDM’s policy for national priority exceptions or made by the Secretary of HHS to determine TUSDM’s compliance.
2. Multiple Disclosures. For certain disclosures that occur on a regular basis, TUSDM may provide a summary accounting addressing the series of disclosures rather than a detailed accounting of each disclosure in the series.
  1. When a Summary Accounting is Permissible. A summary accounting for multiple disclosures is permissible if, during the period covered by the accounting, TUSDM has made multiple disclosures of PHI:
    1. for a single purpose to HHS so it may investigate or determine TUSDM’s compliance with the Privacy Regulation; or
    2. to the same person or entity for a single national priority purpose (as set forth in TUSDM’s policy regarding national priority disclosures).
  2. Required Information for a Summary Accounting. In these circumstances, TUSDM may limit the accounting related to a series of disclosures to the following information:
    1. the core elements for the first disclosure during the accounting period;
    2. the frequency or number of the disclosures made during the accounting period; and
    3. the date of the most recent disclosure in the series during the accounting period.
  3. Accountings for Certain Research. For certain disclosures for research purposes, TUSDM may provide a type of summary accounting rather than a detailed accounting of each disclosure. Employees should consult the HIPAA Research Policy for more information on these requirements.
RECORD RETENTION REQUIREMENTS.
1. Required Documentation. TUSDM must create and maintain the following documentation:
  1. the core elements of each disclosure;
  2. the written accounting that is provided to the individual; and
  3. the titles of the persons or offices within TUSDM responsible for receiving and processing requests for an accounting by individuals.
2. Retention Period. For disclosures made other than through an EHR, TUSDM must retain the required documentation for a period of six years from the date of its creation or the date when it was last in effect, whichever is later. For disclosures made through an EHR, TUSDM must retain the required documentation for a period of three years from the date of its creation or the date when it was last in effect, whichever is later.

V. Policy Compliance Monitoring and Enforcement:

The TUSDM Security and Privacy Officer is responsible for the monitoring and enforcement of this policy. However, directors and managers are also responsible for monitoring compliance with procedures specific to their areas.

VI. Potential Disciplinary Actions and Sanctions:

Failure to follow standard operating procedures may trigger review for potential disciplinary action under the TUSDM Sanctions for HIPAA Violations Policy.

VIII. Approval and Review Cycle:

This policy shall be subject to annual review, revision, and approval by the TUSDM Compliance Committee.