Accounting of Disclosures under HIPAA: What the Rules Require Today and What's Changed by the Proposed Rule

Why Should You Attend:

The session will cover the current HIPAA Accounting of Disclosures rule, the HITECH Act's required changes, and the proposed rule to implement HITECH which goes beyond what was required in the law and establishes a new right to an Access Report of all electronic PHI.

The presenter will also explain what information is subject to the accounting of disclosures requirement, and how individuals should be able to request and receive such accountings. The kinds of disclosures that are exempt from the accounting will be described, particularly highlighting changes from the current requirements. The necessity for tracking disclosures that must be and must not be accounted for will be explained.

Since not all electronic systems can readily provide an access report, we will discuss about the impacts and issues involved with the limited audit ability of many systems.

The role of business associates who maintain or support your EHR will also be discussed, and the extension of the accounting out to them by way of their use of Designated Record Set data will be explored, including potential necessary changes to business associate agreements.

Learning Objectives:

• How the rules of Accounting of Disclosures used to work.
• What used to be necessary to be able to respond to requests for accountings.
• How electronic health records change the landscape of accounting for disclosures.
• What the new electronic systems can keep track of, and what they can't.
• How having systems that meet HIPAA Security Requirements for auditing and activity review can help you meet the new requirements to account for all disclosures, even those for treatment, payment, and healthcare operations.
• What the new rules require you to do to respond to requests for accountings of disclosures.
• How the new accounting of disclosures relates to the systems you use to track health information.
• What your systems vendors should be doing to help you meet the new requirements for accounting of disclosures.
• The format and content of the information that is provided to the individuals who ask for an accounting.
• The policies you need to support the new requirements.

Areas Covered in the Seminar:

• Background of Accounting of Disclosures requirements in HIPAA.
• How Accounting of Disclosures works now.
• What's in the HITECH Act for Accounting of Disclosures.
• What's in the new proposed rule on Accounting of Disclosures.
• How Accounting of Disclosures, the HIPAA Security Rule, and Meaningful Use of EHRs for incentive funding are all connected.
• Impacts of the Proposed Accounting of Disclosures Rule.
• What needs to be done now to prepare for changes.

Who Will Benefit:

• Information Security Officers
• Risk Managers
• Compliance Officers
• Privacy Officers
• Health Information Managers
• Information Technology Managers
• Medical Office Managers
• Chief Financial Officers
• Systems Managers
• Legal Counsel
• Operations Directors

Medical offices, practice groups, hospitals, academic medical centers, insurers, business associates (shredding, data storage, systems vendors, billing services, etc.) will benefit from this training.

Instructor Profile:

Jim Sheldon-Dean, is the founder and director of compliance services at Lewis Creek Systems, LLC, a Vermont-based consulting firm founded in 1982, providing information privacy and security regulatory compliance services to a variety of health care providers, businesses, universities, small and large hospitals, urban and rural mental health and social service agencies, health insurance plans, and health care business associates.He serves on the HIMSS Information Systems Security Workgroup, has co-chaired the Workgroup for Electronic Data Interchange Privacy and Security Workgroup, and is a recipient of the 2011 WEDI Award of Merit. He is a frequent speaker regarding HIPAA and information privacy and security compliance issues at seminars and conferences, including speaking engagements at AHIMA national and regional conventions and WEDI national conferences, and before the New York Metropolitan Chapter of the Healthcare Financial Management Association, Health Information Management Associations of Virginia, New York City, New York State, and Vermont, the Connecticut Hospital Association, and the Hospital and Health System Association of Pennsylvania.

Sheldon-Dean has nearly 30 years of experience in policy analysis and implementation, business process analysis, information systems and software development. His experience includes leading the development of health care related Web sites; award-winning, best-selling commercial utility software; and mission-critical, fault-tolerant communications satellite control systems. In addition, he has eight years of experience doing hands-on medical work as a Vermont certified volunteer emergency medical technician.

Sheldon-Dean received his B.S. degree, summa cum laude, from the University of Vermont and his master’s degree from the Massachusetts Institute of Technology.

Topic Background:

The HITECH Act called for changes to allow more detailed information in the Accountings of Disclosures made from Electronic Health Records, and the new proposed rule creates new rights for individuals and responsibilities for those using electronic systems that contain PHI.

The HIPAA Privacy Rule, which went into effect in 2003, required that entities keep track of all the disclosures they make of Protected Health Information (PHI) outside of those necessary for Treatment, Payment, and Healthcare Operations (TPO).  In the days when health information was primarily hard copy-based, the limitation on tracking disclosures to those outside of TPO was quite reasonable, as it could be difficult or impossible to track every individual who looked at a paper record.  But the HITECH Act included a change in the exception, by requiring Electronic Health Record (EHR) systems to keep track of disclosures made for all reasons, including those for TPO, beginning January 1 of 2011 for systems installed in 2009 or 2010.  Older installations have more time under the law to include this capability, but now individuals can request a full accounting of disclosures, including TPO, from EHRs, and every entity that maintains electronic records must be prepared to comply with such requests.

Now a new proposed rule to implement the law alters some important aspects of HIPAA as expected but also goes in new directions by calling for patient-designed access reports for their electronic data, including not only information in a formal electronic medical record, but also any electronic data in the Designated Record Set.  Some of the issues may include:

• The definition of a Designated Record Set in this context
• The use of an Access Report covering all uses and disclosures vs. an Accounting of Disclosures
• The presumption that electronic Access Reports can be generally available for all systems
• Current methods of complying with HIPAA Security audit requirements vs. what would be needed to provide reports to individuals
• New additions to the list of disclosures excluded from an accounting
• Timetable of changes in the rules vs. implementation times and expense of implementation
• Cost of implementation vs. benefit  -- can the expected utilization of this right be balanced with the expense?
• Business Associate impacts -- response time to generate an Access Report so the entity can respond within 30 days

The above session will provide attendees the following tools, benefits, and solutions:

• The features that must be available in new systems and the questions to ask system vendors will be described, and some insights into how you can retrofit existing systems will be discussed.
• The process for responding to requests for accountings of disclosures will be related to the regulations that require it, and the supporting policies necessary will be outlined, including identifying changes that will be necessary in the Notice of Privacy Practices.
• The role of business associates who maintain or support your EHR will be discussed, and the extension of the accounting out to them by way of their use of Designated Record Set data will be explored, including potential necessary changes to business associate agreements.
• The session will leave you with a list of tasks to help you get started with your organization's compliance even in advance of the final rule on the changes.

Follow us :