Section 22: Requests for Accounting of Disclosures
In general, individuals shall have the right to receive an accounting of PHI disclosures made by the Callier Center in the six (6) years prior to a request. The Callier Center is not required to account for any disclosures that occurred prior to the compliance date of April 14, 2003.
The Callier Center must account for disclosures of PHI for occurrences other than Treatment, Payment or health care Operations (TPO). These require an authorization from either the patient or personal representative. However, referring physicians (physicians requesting consults or specialty procedures) will not require an authorization or accounting of disclosure of PHI. Disclosures for law enforcement purposes or required by statutory law do not need an authorization.
Right to Accounting of Disclosure of PHI
The Callier Center must provide the individual with a written accounting that includes disclosures of PHI that occurred during the six (6) years (or shorter time period if requested) prior to the date of the request. This includes disclosures to and by business associates.
Content Standards for the Accounting of Disclosure of PHI
The accounting for each disclosure must include:
- The date of the disclosure;
- The name of the entity or person who received the PHI and, if known, the address of such entity or person;
- A brief description of the PHI disclosed; and
- A brief statement of the purpose of the disclosure that reasonably informs the individual of the basis for the disclosure; or, in lieu of such statement a copy of the individual’s written authorization; or a copy of a written request for a disclosure if any.
If the Callier Center has made multiple disclosures of PHI to the same person or entity for a single purpose, or pursuant to a single authorization, the accounting may, with respect to such multiple disclosures, provide:
- The information required above;
- The frequency, periodicity, or number of the disclosures made during the accounting period; and
- The date of the last such disclosure during the accounting period.
Content Standards for Research
The accounting for each disclosure must include:
- The name of the protocol or other research activity;
- A description, in plain language, of the research protocol or other research activity, including the purpose of the research and the criteria for selecting particular records;
- A brief description of the type of PHI that was disclosed;
- The date or period of time during which such disclosures occurred, or may have occurred, including the date of the last such disclosure during the accounting period;
- The name, address, and telephone number of the entity that sponsored the research and of the researcher to whom the information was disclosed;
- A statement that the PHI of the individual may or may not have been disclosed for a particular protocol or other research activity.
Compliance Standards
The Callier Center must act on the individual’s request for an accounting, no later than 60 days after receipt of such a request, as follows.
- Provide the individual with the accounting requested; or
- If the Center is unable to provide the accounting within the time required above, the Center may extend the time to provide the accounting by no more than 30 days, provided that:
- The Center, within the time limit of 60 days, provides the individual with a written statement of the reasons for the delay and the date by which the Center will provide the accounting; and
- The Center may have only one such extension of time for action on a request for an accounting.
The Callier Center must provide the first accounting to an individual in any 12-month period without charge. The Center may impose a reasonable, cost-based fee for each subsequent request for an accounting by the same individual within the 12-month period, provided that the Center informs the individual in advance of the fee and provides the individual with an opportunity to withdraw or modify the request for a subsequent accounting in order to avoid or reduce the fee. The fee schedule for these services is set by the State of Texas. To obtain the fee schedule contact the Medical Records Administrator (MRA).
Documentation for Accounting of Disclosures
Callier Center personnel need to account for disclosures of PHI by documenting any such disclosures. The MRA or its designee will account for disclosures in the release of information software. All subsidiary medical record holders will account for disclosure in the Center’s designated electronic tracking system. The MRA will be responsible for receiving and processing requests for an accounting of disclosures. The MRA must document and maintain a copy of the following:
- The required information to be included in an accounting of disclosures, as outlined in the earlier section Accounting of Disclosure of PHI.
- The written accounting that is provided to the individual requesting an accounting of disclosures.
Exceptions to the Right of Accounting of Disclosures
In accounting for disclosures of PHI:
The Callier Center must temporarily suspend an individual’s right to receive an accounting of disclosures to a health oversight agency or law enforcement official if such agency or official provides the Center with a written statement that such an accounting to the individual would be reasonably likely to impede the agency’s activities. The written statement must specify the time for which such a suspension is required.
If the agency or official suspends an individual’s right to receive an accounting of disclosures and the statement is made orally, the Callier Center must:
- Document the statement, including the identity of the agency or official making the statement;
- Temporarily suspend the individual’s right to an accounting of disclosures subject to the statement; and
- Limit the temporary suspension to no longer than 30 days from the date of the oral statement, unless a written statement from the suspending agency or official is submitted during the time period.
The Callier Center is not required to account for the following disclosures:
- To carry out TPO;
- To individuals requesting their own PHI;
- For the facility’s directory or to persons involved in the individual’s care or other notification purposes;
- For national security or intelligence purposes;
- To correctional institutions or law enforcement officials; or
- Information that occurred prior to the compliance date of April 14, 2003.
HIPAA Regulatory Citation: 45 CFR § 164.528, § 164.504(e)(2)(G) Effective: 04/14/2003
Revised: 05/26/2015, 03/13/2013
Reviewed: 10/21/2022, 03/26/2021, 12/08/2015
Heather Zimmerman, HIPAA Privacy Officer
UT Dallas Callier Center
