HHS Releases Request for Information for Accounting of Disclosures Rulemaking

OCR published a request for information seeking comments to better inform upcoming rulemaking that will expand an individual's right to receive an accounting of disclosures under the HIPAA Privacy Rule.  Currently, the HIPAA Privacy Rule provides an individual with the right to receive a listing, known as an accounting of disclosures, that provides information about when a HIPAA covered entity discloses the individual's information to others.  The current HIPAA Privacy Rule does not require a covered entity to list disclosures to carry out treatment, payment, and health care operations.

The Health Information Technology for Economic and Clinical Health (HITECH) Act, part of the American Recovery and Reinvestment Act of 2009, provides that an individual has a right to receive information about disclosures made through a covered entity's electronic health record for purposes of carrying out treatment, payment, and health care operations.  The HITECH Act requires the Secretary to balance the interests of individuals in learning about these disclosures with the administrative burden on HIPAA covered entities to track the disclosures.

This request for information seeks comments so that OCR can learn more about the interests of individuals and the burden on covered entities with respect to accounting for disclosures for purposes of treatment, payment, and health care operations.  The request for information will be followed by a proposed rule, providing further opportunity for comment.

View the Request for Information.