Accounting for Disclosures of Protected Health Information

Statement of Policy

Washington University and its member organizations (collectively, “Washington University” or “WU”) are committed to conducting business in compliance with all applicable laws, regulations, and WU policies. As part of this commitment, WU has adopted a policy to facilitate accounting (an Accounting) for Disclosures of Protected Health Information (PHI).

Scope of Policy

Individuals have the right to request an Accounting of certain types of Disclosures made of their PHI. WU will provide an appropriate Accounting consistent with this Policy.

1) Disclosure Policies

a. General Disclosure Policy.

i) WU acknowledges that Individuals have a right to receive an Accounting of certain types of Disclosures of their PHI made by WU, including Uses or Disclosures by or to its Business Associates, for purposes other than Treatment, Payment or Health Care Operations or Disclosures made pursuant to an Authorization. Such right to an Accounting shall include those Disclosures made in the six-year period prior to the request date. This Policy applies even if the Individual’s name is not included as a data element unless the PHI is completely de-identified.

ii) Some examples of Disclosures of PHI that must be included in an Accounting are those made:

  • to Health Oversight Agencies;
  • for certain Research, including Disclosures pursuant to a waiver of a authorization for research;
  • when an Authorization is required and one was not obtained;
  • for public health activities; and
  • by Business Associates for purposes other than for Treatment, Payment or Health Care Operations.

iii) WU will document the Disclosures made by WU and the titles of persons or offices responsible for receiving and processing requests for Accounting by Individuals. WU will document the written Accounting provided to Individuals.

b. Exceptions. The following types of Disclosures, including Disclosures by or to a Business Associate of WU, are not subject to the Accounting requirement:

i) Disclosures made to carry out Treatment, Payment and Health Care Operations;
ii) Disclosures made to Individuals of their own PHI;
iii) Disclosures made to persons involved in the Individual’s care or for purposes of notifying such person of an Individual’s condition or status (see WU HIPAA Policy on Verbal/Inferred Agreement to Use or Disclose Protected Health Information);
v) Disclosures made for national security or intelligence purposes;
vi) Disclosures made to Correctional Institutions or to Law Enforcement Officials having lawful custody of an inmate;
vii) Disclosures that occurred prior to April 14, 2003;
viii) Disclosures of de-identified PHI;
ix) Disclosures made to Law Enforcement Officials or Health Oversight Agencies when such Officials or Agencies have made a request to suspend an accounting (See Section 3 below);
x) Disclosures of Limited Data Sets related to research;
xi) Disclosures that are incidental to Treatment, Payment and Health Care Operations (such as overheard conversations containing PHI); and
x) Disclosures made pursuant to the Individual’s Authorization.

2) Procedure for Responding to a Request for an Accounting

a. Responsible Department. The Privacy Office will be responsible for receiving and responding to requests for an Individual Accounting of Disclosure.

b. Request for an Accounting Form. WU will inform Individuals
that all requests for an Accounting of PHI must be submitted in writing on the form attached as Exhibit A.

c. Verification of Individual Access for an Accounting. The Privacy Office will be responsible for verifying that an Individual has the appropriate authority to request an Accounting consistent with the WU HIPAA Policy on Uses or Disclosures of Protected Health Information without Verbal or Written Authorization.

d. Response Timeframes and Extensions.

i) Response. WU will act upon a request for an Accounting within 60 days following its receipt of a request by either providing the requested Accounting or, if unable to provide the Accounting within 60 days, obtaining a one-time extension in accordance with Section (d) (ii) below.

ii) Extensions. WU may obtain a one-time extension of no more than 30 days within which it must complete its response by contacting the requesting Individual, in writing and within 60 days of the request, and stating the reasons for the delay and the date by which WU will provide the Accounting. (See attached form, Exhibit B.)

e. Costs for an Accounting:

i) One-time/No Fee. WU will provide the first Accounting to an Individual within any 12-month period at no charge.

ii) Additional Requests. WU may impose a reasonable cost-based fee for each additional request by the same Individual within a 12-month period. Prior to imposing any fee for an Accounting, WU will first inform the Individual of the fee and provide the Individual with an opportunity to withdraw or modify his/her request in order to avoid or reduce the fee.

3) Suspension of the Right to an Accounting.

a. Written Requests for Suspensions. WU will temporarily suspend an Individual’s Accounting right in accordance with the Privacy Regulations for a specified time if requested by a Health Oversight Agency or Law Enforcement Official in writing. If requested to suspend an Accounting, WU will request each Health Oversight Agency or Law Enforcement Official to state, in writing, that the Accounting would be reasonably likely to impede the Agency’s activities and the time period for the required suspension prior to implementing the suspension.

b. Oral Requests for Suspensions. WU will also abide by the oral request(s) of a Health Oversight Agency or Law Enforcement Official for the temporary suspension of an Individual’s right to an Accounting. WU will document the name of the agency or official and the statement requesting the suspension and will limit the suspension to no longer than 30 days unless a written statement from the agency/official is received.

4) Content of the Accounting

a. General Rules. WU will provide a written Accounting, for any period up to the six-year period preceding the request, that includes the following:

i) except for PHI excluded from Disclosure as set forth in Section (I)(b), all the Disclosures of PHI, including Disclosures to or by Business Associates, occurring before the request date and within the requested period;

ii) with each Disclosure listed include:

  • the date of the Disclosure;
  • the name of the entity or person receiving the PHI, and, if known, the address;
  • a brief description of the PHI Disclosed; and
  • a brief statement of the purpose of the Disclosure that reasonably informs the Individual of the basis for the Disclosure or, in lieu of a statement, a copy of the Individual’s written Authorization for the Disclosure or a copy of the written request for Disclosure where no Authorization was required. (See attached Exhibit C.)

b. Multiple Disclosures. If WU made multiple Disclosures during the requested Accounting period of the PHI to the same person or entity for a single purpose or pursuant to a single Authorization, the Accounting may, with respect to such multiple Disclosures, provide the information required above for the first Disclosure and a listing of the frequency, periodicity or number of the Disclosures during the period and the date of the last Disclosure.

5) Documentation

a. General Rules. WU will retain:

i) the information subject to an Accounting of Disclosures for at least 6 years;
ii) the written Accounting provided to an Individual pursuant to this Policy; and
iii) the titles of persons or offices responsible for receiving and processing requests for an Accounting.

Creation Date: November 22, 2002
Effective Date: April 14, 2003
Last Revision Date: February 28, 2003