OCR Requests Input on Pending Accounting of Disclosures Regulation
The Office for Civil Rights published a request for information on accounting of disclosures today, seeking input on its upcoming regulation to enact new provisions specified under the HITECH Act.
The information, OCR writes, will help it “better understand the interests of individuals with respect to learning of such disclosures” as well as “the administrative burden on covered entities and business associates of accounting for such disclosures.”
Most notably, HITECH requires covered entities to account for disclosures made for purposes of treatment, payment, and healthcare operations, disclosures which had been exempted under HIPAA. It also requires entities that purchased EHR systems on or after January 1, 2009, to begin providing these accountings on January 1, 2011. (Entities with older systems have until 2014 to comply.)
In all, OCR poses nine questions (abbreviated here):
- What are the benefits to the individual of an accounting of disclosures, particularly of disclosures made for treatment, payment, and health care operations purposes?
- Are individuals aware of their current right to receive an accounting of disclosures?
- If you are a covered entity, how do you make clear to individuals their right to receive an accounting of disclosures? How many requests for an accounting have you received from individuals?
- For individuals that have received an accounting of disclosures, did the accounting provide the individual with the information he or she was seeking?
- Should an accounting for treatment, payment, and health care operations disclosures include to whom a disclosure was made (i.e., recipient) and the reason or purpose for the disclosure?
- For entities with existing EHRs, OCR asks several questions about the system’s capabilities, including its ability to distinguish between use and disclosure, the data it captures, whether the system is centralized or decentralized, and whether it currently generates and accounting of disclosure.
- For entities that purchased a system on or after January 1, 2009, OCR asks if they will be able to begin accounting for disclosures for treatment, payment, and operations by the January 1, 2011, deadline? If not, how much time would it take vendors to implement such a feature?
- Is it feasible for an EHR module to handle the accounting function, particularly in entities with a decentralized EHR system?
- Is there any other information that would be helpful to the Department regarding accounting for disclosures through an electronic health record to carry out treatment, payment, and health care operations?
Earlier this year the Journal polled AHIMA members on the number of requests their organizations had filled under HIPAA. Nearly 60 percent had not received a request since the privacy rule took effect in April 2003. Most reported that disclosures were made throughout their organizations via decentralized systems, making it a challenge to ensure all disclosures are properly and fully recorded.
Comments are due to OCR by May 18. Share your answers here, too–what benefits, demand for, and challenges do you see in accounting for disclosures?