Proposed Changes to HIPAA Accounting of Disclosures Provision and Proposed New Access Report Requirement

On May 31, 2011, the U.S. Department of Health and Human Services (“HHS”) published a proposed rule regarding the provisions of the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”) concerning accounting of disclosures of electronic protected health information (“PHI”). The proposed rule contains two main parts: (1) modifications to the existing accounting of disclosures requirements and (2) a new “access report” requirement.

Under this proposed change, covered entities would be responsible for keeping track of which business associates have designated record set information; obtaining such information from business associates and incorporating it into the access report; and aggregating into a single access report all of the electronic designated record set information that covered entities may have in a number of distinct systems that maintain separate access logs. Comments regarding HHS’ proposed rule may be submitted until August 1, 2011.

Click here for a Womble Carlyle Client Alert with more background on this proposed change.

If you have questions regarding this proposed rule, please contact Sarah Crotts or Jill Girardeau.