NRPM: Standards for Privacy of Individually Identifiable Health Information. i. Form or format.


This proposed rule does not specify a particular form or format for the accounting. In order to satisfy the accounting requirement, a covered entity could elect to maintain a systematic log of disclosures or it could elect to rely upon detailed record keeping that would permit the entity to readily reconstruct the history when it receives a request from an individual. We would require that covered entities be able to respond to a request for accounting within a reasonable time period. In developing the form or format of the accounting, covered entities should adopt policies and procedures that will permit them to respond to requests within the 30-day time period in this proposed rule.