Module 5 Patients’ Right to Accounting of Disclosures

1. START to begin… Click Module 5Patients’ Right to Accounting of Disclosures

2. Introduction Patients have a right to receive a written list of certain disclosures we have made of their PHI. This module will explain UNC Health Care System requirements for accounting of these disclosures.

3. Patients’ Right to Accounting of Disclosures Patients may ask for a listing of disclosures we have made of their PHI for up to six (6) years prior to the request (not including disclosures made prior to April 14, 2003). Requests for a listing of accounting of disclosures should be referred to your Privacy Officer.

4. Patients’ Right to Accounting of Disclosures The following disclosures are NOT required to be accounted for: • Treatment, Payment, Healthcare Operations (TPO) • Disclosures authorized by the patient or authorized representative • Disclosures to the patient or persons involved with their care

5. Patients’ Right to Accounting of Disclosures Other disclosures which are not required to be accounted for: • National security or intelligence purposes • Correctional institutions or law enforcement officials having lawful custody of an inmate • Incidental disclosures • Limited Data Sets used for research purposes

6. Patients’ Right to Accounting of Disclosures An accounting is required for disclosures of which the patient may not be aware, e.g., those which are required by law (such as abuse or communicable diseases) or accidental disclosures. Accidental disclosures should also be reported to your Privacy Officer. For a listing of additional disclosures that require accounting, see the Accounting of Disclosures of Protected Health Information Policy.

7. For Example: Susan, a Patient Services Representative in the billing office, is faxing PHI using the appropriate coversheet to a UNC Community Based Clinic. She receives a call from a restaurant that the fax was received there, not at the intended destination. Is this a disclosure that Susan must log into the Disclosure Trac Database?

8. For Example: Yes. When mistakes result in a disclosure of PHI to an unauthorized person, you MUST account for that in the database. Susan must also report the accidental disclosure to her Privacy Officer.

9. For Example: Amanda Jones, the mayor of a small local town, is admitted to UNC Hospitals for surgery. She gives permission for her name, location, and religious affiliation to be included in the hospital’s patient list. She agrees that the disclosure of that information may be made to members of the clergy and to people who ask for her by name. Upon discharge, Mayor Jones asks the hospital for an accounting of her PHI disclosures.

10. For Example: During Mayor Jones’ stay the following disclosures were made: • Her daughter calls and is told that her mother is “stable.” • Later the information desk gives Reverend Smith a list of the names of all newly admitted patients, including hers, and their religious affiliation. • Finally, the small town paper calls and asks if Mayor Jones was admitted. They are transferred to Marketing where they are told, “Yes, she has been admitted and is stable.” Which of these disclosures should have been tracked so we may give her an accurate accounting?

11. For Example: None. Mayor Jones authorized each of these disclosures when she agreed for her name to be included in the patient and clergy lists, upon signing the General Consent for Treatment form.

12. Departmental Responsibilities for Accounting of Disclosures • Identify those disclosures which require an accounting. • Develop internal procedures to enter required disclosure information into the institutional electronic disclosure tracking system (Disclosure Trac). • See UNC HCS HIPAA website (www.unch.unc.edu/HIPAA) for Disclosure Trac training documentation.

13. Prev Next For more information: www.unch.unc.edu/hipaa

14. Congratulations! Prev You have now successfully completed the online HIPAA Accounting of Disclosures Module - Click <HERE> to end show -