HIPAA Disclosure Documentation

Prior to the establishment of HIPAA Policies and Procedures, no federal regulations existed that required any type of tracking system to account for the release of information.  Now, however, based on the HIPAAprivacy rule, as explained in the Omnibus final rule, covered entities must track protected health information that has been disclosed.  This was instituted to allow an individual to receive an accounting of disclosures for the six years preceding their request.  In order to comply with this regulation, covered entities must have a tracking system in place.

According to HIPAA, disclosures are defined as "the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information." This also applies to any disclosures made to or by business associates of the covered entity (see the HIPAA guidelines for exclusions.)

 
It’s up to the covered entity to determine the most appropriate manner for tracking and reporting disclosures.  While a paper log can be used this is not likely the best option due to the amount of documentation required.  Essentially a record would need to be kept for each individual, such that a copy could be provided to the individual upon request.  The method of maintaining the log would need to be able to account for the possibility of multiple disclosures.  This, at a minimum would mean anyone who could possibly disclose an individual’s PHI would need access to their record to log any disclosures for which they could be responsible.

Abetter method would be to use a computerized system for tracking this information such as a spreadsheet.  The benefits of a computerized system include:

- No physical records need to be pulled each time a disclosure must be documented
- Numerous individuals under the umbrella of the covered entity can document disclosures at a single location
- Only one tracking file is necessary for all records when adequate sorting functions exist
- A report can be quickly printed from a computerized tracking log whenever an accounting of disclosures is requested without the need for additional work

It'simportant to understand the rules for maintaining a record of disclosures for at least six years based on HIPAApolicies and procedures.  The Privacy Rule gives explicit requirements for covered entities in regard to the necessity of this policy.  In order to do so efficiently and accurately without unnecessary work, a computerized spreadsheet is your best option.