HIPAA Accounting of Disclosures

Under HIPAA, patients have the right to receive an accounting of disclosures, which is a written list of certain disclosures of protected health information (PHI) that the patient has not authorized. UCSF units or researchers who release such PHI are responsible for documenting the disclosures, as described below.



What Disclosures Need to be Recorded?

A person generally has a right to receive an accounting of disclosures in the six years prior to their request, except for disclosures that are: treatment, payment, operations (TPO), part of a limited data set (LDS) shared under a data use agreement, or disclosed with patient authorization. There are other exceptions. Please review UCSF Medical Center Policy 5.02.11 Request for Accounting of Disclosures.

For example, UCSF does not need to account for PHI disclosures to an external party for UCSF’s QI/QA purposes. However, a business associate agreement (BAA) or other agreements may be needed, as well as adherence to HIPAA’s minimum necessary standard.

Moreover, data that is not PHI does not need to be accounted for, such as research health information (RHI) or data properly de-identified under HIPAA’s Safe Harbor or Expert Determination methods. For help classifying the data as PHI or RHI, please contact the UCSF Privacy Office at [email protected] or (415) 353-2570.

Under HIPAA, these are some common disclosures that must be accounted for:

  1. For research purposes, such as disclosures to researchers or others under an IRB Waiver of HIPAA Authorization (i.e., reviews preparatory to research or research on decedents).
  2. For certain public health activities, such as public health reporting and surveillance, and for quality, safety, or effectiveness of FDA products or activities.
  3. To a health oversight agency for health oversight activities authorized by law, such as audits or licensure actions.
  4. To a coroner, medical examiner, or funeral director about decedents.
  5. To organ procurement organizations for cadaveric organ, eye, or tissue donation.
  6. To or by a UCSF BA unless for TPO.
  7. For other uses and disclosures that are not TPO and do not require patient authorization or an opportunity for the patient to object.

For a full list, please review UCSF Medical Center Policy 5.02.11 or 45 CFR § 164.528.