NRPM: Standards for Privacy of Individually Identifiable Health Information. 6. Accounting for disclosures.


We propose to require covered entities to develop and document their policies and procedures for complying with the requirement in § 164.515 to provide on request an accounting for disclosures for purposes other than treatment, payment or health care operations. In order to respond to requests for accounting within a reasonable period of time, the entity would need to have a system for accounting in place well in advance of any potential requests. The entity would need to evaluate its record keeping system and determine how best to build in the capacity to respond to such a request. For example, if the entity chooses to keep a regular log of disclosures, it would have to begin keeping such logs routinely. If instead the entity chooses to rely on a record keeping system to reconstruct an accounting, it should develop appropriate procedures for members of the workforce to follow when faced with an individual’s request.