Health Information Compliance Alert

The accounting requirement's not as open as you think.

The good news is you don't have to account for every disclosure that you make. The bad news is some disclosures are wrought with secrecy that you must protect. Here's some expert advice to help you determine the difference.

There are several types of disclosures that you can make outside of the standard payment, treatment and operations scenarios. For example, the government mandates that you disclose PHI to protect public safety or public health, explains attorney Bill Mandell, a partner with Pierce & Mandell in Boston. As always, HIPAA cannot trump state laws that require reporting, he reminds. You can also disclose through the legal process if the proper steps are taken.

Remember: The ability to disclose is a permissive clause under HIPAA. While you aren't required to disclose the information, you won't violate HIPAA if you decide to, Mandell clarifies. "You can always choose to go before a judge or magistrate to balance the request against your patient's rights," he says.

However, no matter which of these reasons you use to disclose a patient's PHI, you have to provide the patient with an accounting of that disclosure if they request it. Is It Our Secret?

If you receive a National Security Act or presidential order for a patient's health information, you have to disclose the information. But any disclosure made for intelligence purposes is exempt from the accounting requirement. That information should never appear on a patient's accounting of disclosures, Mandell maintains.

On the other hand, if the disclosure is made for routine law enforcement, it can only be withheld from the accounting if the request is accompanied by a written statement that says the patient's knowledge of the request will impede the agency's investigation (see § 164.512[d; f]), Mandell counsels.

Conditions: The disclosure can only be suspended for a finite amount of time.

Most important: The note must provide the date when the suspension is lifted. Do not either accept or act on a suspension notice that uses 'until further notice' as an expiration date, Mandell says.

Note that law enforcement agencies can verbally ask you to withhold a disclosure made to them, but the disclosure must appear on the accounting after 30 days. Once that suspension period is up, account for the disclosure.

Tip: Make the affected patient aware of this 'new' disclosure and share a copy of the letter you received, Mandell recommends. This will help maintain your patient's trust and allow her to follow up on the activity.

Be sure to discuss all disclosures outside of payment, treatment and operations with your attorney, Mandell advises. And even if you will never account for a disclosure in a patient's request, you must keep a record of all disclosures you make, he says.