Healthcare Provider Law Blog
HITECH Changes to HIPAA Disclosure Accounting Requirements
The American Recovery and Reinvestment Act of 2009 (ARRA) included many changes to HIPAA in the portion of ARRA known as the HITECH Act. One significant change related to accounting requirements for Covered Entities who disclose information during the course of treatment.
Prior to HITECH Covered Entities were required to maintain a log of disclosures of PHI; however, disclosures for purposes of Treatment of the patient were exempted from this requirement.
The HITECH Act removed this exemption for disclosures of Electronic Medical Records (EMR). Covered Entities disclosing EMR to other Covered Entities or Business Associates for purposes of treatment will now be required to keep a log going back 3 years of all such disclosures, which must be made available upon patient request. These types of disclosures are not unauthorized or impermissible since in general Covered Entities may disclose PHI for purposes of Treatment, Payment and Healthcare Operations.
Pursuant to HITECH the compliance date for this depends on if and when the Covered Entity began using EMR.
- Covered Entities using EMR prior to January 1, 2009 have a compliance date of January 1, 2014.
- Covered Entities not using EMR prior to January 1, 2009 have a compliance date of January 1, 2011.
While this accounting requirement applies to disclosures of EMR for treatment purposes, it does not apply to verbal or other non-electronic communications.