Policy Summary
The HIPAA Privacy Rule requires that certain disclosures of patients' protected health information be tracked for purposes of providing an accounting to patients or their legally authorized representative (when the patient is a minor, incompetent, or deceased) upon the patient’s or the legally authorized representative’s request. This policy describes how UW–Madison complies with the Privacy Rule’s accounting requirements by tracking those disclosures which are required to be included in the accounting for disclosures.
Policy Detail
- Disclosures of protected health information for which an accounting is required from records maintained by the University of Wisconsin Hospital and Clinics (UWHC) or the University of Wisconsin Medical Foundation (UWMF) will be accounted for by UWHC or UWMF, respectively.
- Types of Disclosures that Must Be Included in the Accounting. The following disclosures of protected health information from records maintained by a unit within the UW HCC may be made pursuant to state law without authorization from the patient. However, such disclosures (whether made orally, electronically, manually, or faxed) must be tracked for purposes of providing an accounting to patients or their legally authorized representative (when the patient is a minor, incompetent, or deceased) upon the patient’s or the legally authorized representative’s request:
- In response to a court order.
- In response to a written request by a federal or state agency to perform a legally authorized function, such as management audits, financial audits, program monitoring and evaluation, and investigation of patient complaints.
- In response to a request by a county agency or other investigating agency for investigation of elder abuse or by a county protective services agency for investigation of suspected abuse of a vulnerable adult.
- In response to a request by the designated protection and advocacy agency for the purpose of protecting and advocating the rights of a person with a developmental disability or mental illness.
- To a county department, a sheriff or police department, or a district attorney for purposes of reporting suspected child abuse.
- In response to a request by a county department, a sheriff or police department, or a district attorney for purposes investigating suspected child abuse/neglect or for purposes of prosecution of alleged child abuse/neglect, if the person conducting the investigation or prosecution identifies the subject of the record by name;
- To a court conducting a termination of parental rights proceeding, or to an agency, district attorney, corporation counsel performing official duties relating to such a proceeding, or to the attorney or guardian ad litem for any party to such proceeding for purposes of conducting, preparing for, or performing official duties relating to the proceeding.
- To school district employee or agent, if the employee or agent has responsibility for preparation or storage of patient health care records or if access to the patient health care records is a requirement of state or federal law.
- To the Department of Health Services or to a sheriff, police department, or district attorney for investigation of the death of patients related to the uses of physical restraints or psychotropic medications or suicides.
- To a coroner, deputy coroner, medical examiner, or medical examiner assistant for purposes of completing a death certificate.
- To a funeral director, for medical certification of the cause of death on a death certificate.
- To a coroner, deputy coroner, medical examiner, or medical examiner assistant for purposes of reporting and investigating deaths that are unexplained, unusual, or suspicious; homicides; suicides; deaths following an abortion; deaths due to poisoning; and deaths following accidents.
- To the police department or county sheriff’s office, gunshot wounds, any wound if there is reasonable cause to believe that wound occurred as the result of a crime, and burns if there is reasonable cause to believe that the burn occurred as a result of a crime.
- To the local health officer or to the Department of Health Services:
- Communicable disease cases and deaths.
- Sexually transmitted disease cases.
- Sexually transmitted disease cases who cease or refuse treatment.
- To the state epidemiologist, positive HIV test results and persons significantly exposed.
- To the Wisconsin Department of Health Services:
- Birth defects.
- Lead poisoning cases.
- Induced abortions (only medical record number may be disclosed, and not any other direct identifier).
- Cancer and precancerous cases.
- Deaths of patients admitted to any facility or unit providing treatment of alcoholic, drug-dependent, mentally ill, or developmentally disabled persons for which there is reasonable cause to believe that the death was related to the use of physical restraints or a psychotropic medication or that the death was as suicide.
- Caregiver misconduct.
- To the Wisconsin Department of Transportation, impaired drivers (report must be made by a physician).
- To the U.S. Food and Drug Administration, adverse device and drug events.
- To a worker’s compensation carrier for a person who has filed a worker’s compensation claim.
- To the Secretary of the U.S. Department of Health and Human Services for purposes of monitoring compliance with the HIPAA Privacy Rule.
- To law enforcement officials (or another person reasonably able to prevent or lessen the threat), serious or imminent threats to the health or safety of a person or the public.
- To researchers, if the disclosure is made pursuant to an institutional review board (IRB) waiver of authorization (see "HIPAA - Researchers" for additional information concerning accounting for disclosures of protected health information for research).
- Types of Disclosures Not Required to be Included in the Accounting.
- Disclosures made for treatment, payment, and most healthcare operations purposes (see UW-104 Uses and Disclosures of Protected Health Information Not Requiring Authorization or Opportunity to Agree or to Object).
- Disclosures made prior to April 14, 2003.
- Disclosures made to the patient.
- Disclosure made based on a written patient authorization.
- Disclosures made in discussions with family members or others involved in the patient’s care or for notification purposes (see UW-105 Uses and Disclosures of Protected Health Information that Require Providing the Patient with an Opportunity to Agree or to Object).
- Incidental disclosures.
- Disclosures about an inmate to correctional institutions or law enforcement officials having custody of the inmate.
- Disclosures made as part of a limited data set.
- Disclosures made for national security or intelligence purposes.
- Tracking Disclosures for Accounting. Each unit of the UW HCC must have procedures for tracking those disclosures subject to the accounting requirement. Sample forms for manual tracking are available within the “Forms” tab at hipaa.wisc.edu.
- Processing of Patient Requests for Accounting.
- Designation of Privacy Coordinator. Each unit in the UW HCC must designate a privacy coordinator responsible for receiving and processing requests by patients for an accounting of disclosures.
- Content of Accounting. For each disclosure required to be included in the accounting, the following information must be maintained and provided upon request of the patient:
- Date of disclosure;
- Name of the individual (or entity) who received the information and, if known, the address of the individual or entity;
- Brief description of the protected health information disclosed; and
-
Brief statement of the purpose of the disclosure that reasonably informs the person of the basis for the disclosure or a copy of the written request for the disclosure, if any.
If during the period covered by the accounting request, multiple disclosures of the patient’s protected health information have been made to the same party for a single purpose, the accounting is only required to provide:
- The data elements listed above for the first disclosure;
- The frequency or number of disclosures made during the accounting period; and
- The date of the last such disclosure during the accounting period.
-
Suspension of Right to Receive an Accounting. The UW HCC must temporarily suspend a patient’s right to an accounting of disclosures to a health oversight agency or law enforcement official, for the time specified by the agency or official, if the agency or official provides the UW HCC with a written statement that such accounting to the individual would be reasonably likely to impede the agency’s activities and specifying the time period for which the suspension is required.
-
Charges for Accounting. Each unit of the UW HCC will provide an accounting of disclosures to the patient at no charge once per any 12-month period. For additional requests, the UW HCC unit may charge a reasonable fee.
-
Timeframe for Providing Accounting. The UW HCC unit will provide the patient with an accounting of disclosures within 60 days after receipt of the request. The UW HCC unit may take one 30-day extension if the UW HCC unit notifies the patient within the original time period with a written statement of the reasons for the delay and the expected completion date.
-
Coordination within UW ACE. For those UW HCC units that are also in the UW ACE, the patient must be provided with a listing of other entities in the UW ACE with information concerning how to obtain an accounting of disclosures from any of those entities at which the patient may have received health care.
Consequences for Noncompliance
Failing to comply with this policy may result in discipline for the individual(s) responsible for such noncompliance.
Further, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy and Security Rules, and an individual’s noncompliance may result in institutional noncompliance and/or an investigation by OCR. OCR attempts to resolve investigations by obtaining voluntary compliance and entering into corrective action plans and resolution agreements. Failure to comply with HIPAA or cooperate with OCR in an investigation may result in civil and/or criminal penalties.
