HIPAA Today

Patients' right to an accounting of disclosures

A pharmacy sends a medication profile to a physician in response to a request and for use in treating a patient. A pharmacy sends to a drug plan sponsor the protected health information (PHI) necessary to collect payment for prescriptions dispensed to a beneficiary. A pharmacy accidentally dispenses Mr. Smith's Rxs to Ms. Jones, who returns them to the pharmacy upon discovering the mistake. During a routine inspection, a pharmacy board investigator examines prescriptions in the Schedule II Rx file to determine compliance with record-keeping requirements. Do you know which of these disclosures of PHI must be included on the Health Insurance Portability & Accountability Act's accounting of disclosures?

HIPAA grants patients the right to receive an accounting of disclosures of PHI made by a pharmacy, including to a pharmacy's business associates, for the six-year period prior to the date on which the patient requests the accounting.

• The accounting must be provided within 60 days of the date of the request, but a one-time extension of 30 days is permitted if, within the 60-day period, the patient is notified in writing of the reason for the delay and given a date by which the accounting will be provided.

• The first accounting in any 12-month period must be provided without charge, but a reasonable, cost-based fee may be charged for additional accountings during the same 12-month period if that patient is notified in advance of the fee and allowed to withdraw or modify the request.

• A patient may request an accounting for a period of less than six years.

There is only one exception to a patient's right to obtain an accounting of disclosures. A pharmacy may temporarily suspend the right, as to disclosures made to a health oversight agency or law enforcement official, if the agency or official gives the pharmacy a written statement that informing the patient of the disclosure would impede the activities of the agency or official and specifying the time period for which the suspension is required. If the agency or official provides only an oral statement, the pharmacy must document the statement, including the identity of the agency or official. The pharmacy may then suspend the right, but for no longer that 30 days from the date of the oral statement, unless a written statement is received within the 30-day period.

Because six years is a long time and the accounting must be provided within 60 days (90 days with an extension), pharmacies are encouraged to maintain a perpetual record of disclosures subject to the accounting requirement. This will avoid difficulties that could arise in trying to construct the accounting after a patient request.

For example, suppose that on Jan. 2, 2004, the pharmacy makes a disclosure of PHI that is subject to the accounting requirement. On Dec. 31, 2009, the patient requests an accounting for the full six-year period. Ask yourself if you have established a record-keeping system that will ensure inclusion of this disclosure on the accounting. Keep in mind that many states require prescriptions and related records to be maintained for only two years, consistent with the DEA regulations.

It is recommended that simultaneous with actually making a disclosure subject to an accounting, you create a permanent record of the disclosure. For some this has been made easy by prescription dispensing software that includes a tool for creating a HIPAA accounting. Absent such a tool in your software, consider creating an accounting by using an electronic spreadsheet.

First create a template by titling the spreadsheet columns with a brief description of each item of information required on an accounting. Then when the need arises to create a patient-specific accounting, open the template and enter the required information in each column, and then record the patient's name in the "header." When finished, perform a "save as" function using the patient's name as the electronic file name and saving it to an electronic file folder named "HIPAA Accountings" that you created on the computer's desktop or hard drive. Finally, for tracking purposes, you can place a note on the patient's electronic profile that an accounting has been created.

So what information needs to be on the accounting?

• Date of the disclosure

• Name (and address if known) of the entity or person receiving the PHI

• Brief description of the PHI disclosed

• Brief statement that reasonably informs the patient of the purpose of the disclosure, or as an alternative, if applicable, including a copy of a written request from HHS for a disclosure to determine the pharmacy's compliance or a written request from an entity recognized by HIPAA (i.e., public health authority) allowed to obtain PHI.

Fortunately, HIPAA excludes a variety of disclosures from the accounting requirement, including disclosures made:

• to carry out treatment, payment, and healthcare operations

• directly to the patient

• as an incidental disclosure to a permitted or required use or disclosure

• pursuant to an authorization by the patient

• to correctional institutions or law enforcement officials "having lawful custody" of the person to whom the PHI relates

• that occurred prior to the compliance date of April 14, 2003

• as part of a limited data set

So what are the answers to the four scenarios at the beginning? For the first two, the disclosures do not need to be included in the accounting because they were for purposes of carrying out treatment and payment. As to the third, the disclosure of Mr. Smith's PHI to Ms. Jones is required on Mr. Smith's accounting, since such a disclosure is not among the exclusions. In the last scenario, the disclosures to the investigator need to be included on the accounting, since the exclusion for law enforcement officials is limited to those "having custody" of the person to whom the PHI relates. This was recently confirmed in an opinion issued by the HHS Office of Civil Rights.

From the above discussion, and especially the list of exclusions immediately above, you should now be able to correctly determine the answer to the many other scenarios that routinely arise in a pharmacy.

Walter L. Fitzgerald Jr., R.Ph., J.D.

The AUTHOR, a pharmacist-attorney, is a professor of pharmacy at the University of Tennessee College of Pharmacy and author of the NCPA HIPAA Compliance Handbook for Independent Pharmacy. To access the NCPA Web site, go to: www.ncpanet.org .

 

Walter Fitzgerald. Patients’ right to an accounting of disclosures. Drug Topics Dec. 8, 2003;147:82.