Health Information Compliance Alert

3. Document paper and electronic disclosures. "The important word to remember is 'disclosure,'" stresses Sue Miller of Sue Miller's HIPAA and Healthcare Services, Concord, MA. Any information you disclose -- whether it's through email, a fax or a privacy or security breach --  that falls outside of incidental disclosures must be listed in the accounting of disclosures.

disclosure. Any organization employee entering information into a disclosure log should be sure to give a "meaningful explanation of what was disclosed" without going overboard, Meeusen asserts.

Example: Harrison Hospital groups the information in its patients' medical records by episode of care. If a privacy breach or staff mistake led to a wrongful disclosure, staffers would note which episode of care was affected rather than all the information within that episode, Meeusen says.

Think of it this way: Apply the minimum necessary standard to your disclosure log, experts suggest. You should list the least amount of information needed for patients to understand what happened.

5. Remember to note disclosure dates. It's very important to log the date a disclosure was made, if you know it, Honeycutt assures. However, if you're recording a disclosure due to a privacy or security breach, you may not have the specific date. In those cases, you should note the date you discovered the disclosure along with some timeline of when the disclosure originated.

Example: Your system was inappropriately accessed in July, but your organization did not uncover the breach until late August. Your disclosure log should include both dates with a comment about why the exact disclosure date is unknown, Meeusen says.

6. Include your mitigation process. You don't have to write out exactly how you investigated and mitigated a wrongful disclosure, but you should note who led the investigation, the dates of the investigation and how you mitigated any fallout. Any relevant documentation -- such as a copy of the incident report -- should accompany the log.

The bottom line: You must record all relevant information -- and only the relevant information -- in your disclosure tracking system so that those disclosures can be easily rounded up when a patient submits a request for an accounting of your PHI disclosures.