Health Information Compliance Alert

Proposed amendments to the Health Insurance Portability and Accountability Act look to lighten the burden of provisions governing the accounting of disclosures of protected health information but you shouldn't let the changes lull you into complacency.

Under the current rule, patients have the right to receive an accounting of disclosures of their protected health information, except in cases where the information is disclosed to carry out treatment, payment or health care operations. The accounting must include the date of disclosure, the name and if known, the address of the party who received the information, a brief description of the disclosed information and an explanation of why the disclosure was made.

Proposed changes to the rule leave those requirements in place but significantly expand the cases in which no accounting is required: Under the new rule, covered entities would no longer need to account for disclosures of protected health information that had been authorized by the patient.

The Department of Health and Human Services made the change on the assumption that patients who had previously authorized a disclosure would know about the disclosure, thereby rendering an accounting of it redundant.

And while the changes are undoubtedly good news to covered entities struggling with the burden of HIPAA implementation, it's important not to get carried away.

"With having to account for less, it might be a little harder to remember which disclosures you need to account for," advises attorney Amy Fehn, with Royal Oaks, MI-based Wachler & Associates.

Moreover, says Fehn, the sorts of disclosures that would still require accounting under the proposed rule are unlikely to happen frequently, and so could be easily overlooked.

Examples of disclosures that still require accounting include those made in the course of: