Accounting of PHI Disclosures - Revision history

Afaylor: /* Additional Information */ updated Health Insurance Portability and Accountability Act of 1996 link and HIPAA Security Rule link 2x

2025-09-29T19:43:57Z

Additional Information: updated Health Insurance Portability and Accountability Act of 1996 link and HIPAA Security Rule link 2x

← Older revision		Revision as of 14:43, September 29, 2025
Line 34:		Line 34:
	<big>'''Accounting of Protected Health Information Disclosures Policy'''</big>		<big>'''Accounting of Protected Health Information Disclosures Policy'''</big>
	== Basis for Policy ==		== Basis for Policy ==
	Nebraska Medicine/UNMC implements reasonable and appropriate access controls in alignment with National Institute of Standards and Technology (NIST) standards and guidance to maintain the minimum necessary access. [https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] and the [https://www.cdc.gov/phlp/~~publications~~/~~topic~~/hipaa.html~~#security-rule~~ HIPAA Security Rule] outline considerations for the access control family of security controls.		Nebraska Medicine/UNMC implements reasonable and appropriate access controls in alignment with National Institute of Standards and Technology (NIST) standards and guidance to maintain the minimum necessary access. [https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] and the [https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html HIPAA Security Rule] outline considerations for the access control family of security controls.
	== Policy ==		== Policy ==
	Nebraska Medicine (Nebraska Medical Center, Bellevue Medical Center, and UNMCP)/UNMC shall provide patients, as required by law and upon written request, with a list of applicable individuals/organizations to which their Protected Health Information (PHI) has been disclosed.		Nebraska Medicine (Nebraska Medical Center, Bellevue Medical Center, and UNMCP)/UNMC shall provide patients, as required by law and upon written request, with a list of applicable individuals/organizations to which their Protected Health Information (PHI) has been disclosed.
Line 129:		Line 129:
	*UNMC Policy No. 6057, [[Use and Disclosure of Protected Health Information]]		*UNMC Policy No. 6057, [[Use and Disclosure of Protected Health Information]]
	*[https://info.unmc.edu/_documents/hippa-docs/_accounting-of-disclosures-form.pdf Request for Accounting of Disclosures of Health Information Form]		*[https://info.unmc.edu/_documents/hippa-docs/_accounting-of-disclosures-form.pdf Request for Accounting of Disclosures of Health Information Form]
	*[https://www.cdc.gov/phlp/~~publications~~/~~topic~~/hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)]		*[https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)]
	*[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53]		*[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53]
	*[https://www.cdc.gov/phlp/~~publications~~/~~topic~~/hipaa.html~~#security-rule~~ HIPAA Security Rule]		*[https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html HIPAA Security Rule]

	This page maintained by [mailto:mhurlocker@unmc.edu mh]		This page maintained by [mailto:mhurlocker@unmc.edu mh]

Mhurlocker at 15:14, July 9, 2024

2024-07-09T15:14:19Z

← Older revision		Revision as of 10:14, July 9, 2024
Line 30:		Line 30:
	Policy No.: '''6061'''<br />		Policy No.: '''6061'''<br />
	Effective Date: '''03/17/03'''<br />		Effective Date: '''03/17/03'''<br />
	Revised Date: '''~~draft 10~~/28/22''' <br />		Revised Date: '''06/06/24'''<br />
	Revised Date: ''' ''' ~~<br />~~<br />		Revised Date: '''06/06/24'''<br />
	<big>'''Accounting of Protected Health Information Disclosures Policy'''</big>		<big>'''Accounting of Protected Health Information Disclosures Policy'''</big>
	== Basis for Policy ==		== Basis for Policy ==

Mhurlocker: /* Procedures */

2024-07-09T15:13:12Z

Procedures

Mhurlocker: /* Affiliated Covered Entity (ACE) */

2023-08-15T18:35:27Z

Affiliated Covered Entity (ACE)

← Older revision		Revision as of 13:35, August 15, 2023
Line 87:		Line 87:
	== Definitions ==		== Definitions ==
	===Affiliated Covered Entity (ACE)===		===Affiliated Covered Entity (ACE)===
	Legally separate covered entities that ~~are affiliated and~~ designate themselves as a single covered entity for the purpose of HIPAA Compliance. Current ACE members are: The Nebraska Medical Center, UNMC Physicians, UNMC, University Dental Associates, Bellevue Medical Center and Nebraska Pediatric Practice, Inc. d/b/a Children’s Specialty Physicians. ACE membership may change from time to time. The Notice of Privacy Practices lists current ACE members~~. Access and amendment rights apply to designated record sets throughout the ACE~~.		Legally separate covered entities that designate themselves as a single covered entity for the purpose of HIPAA Compliance. Current ACE members are: The Nebraska Medical Center, UNMC Physicians, UNMC, University Dental Associates, Bellevue Medical Center and Nebraska Pediatric Practice, Inc. d/b/a Children’s Specialty Physicians. ACE membership may change from time to time. The Notice of Privacy Practices lists current ACE members.

	===Health Care Operations===		===Health Care Operations===
Line 117:		Line 117:
	*an Individual’s genetic tests;		*an Individual’s genetic tests;
	*the genetic tests of an Individual’s family members; or		*the genetic tests of an Individual’s family members; or
	*the manifestation of a disease or disorder in such Individual’s family members (i.e., family medical history)~~; or~~		*the manifestation of a disease or disorder in such Individual’s family members (i.e., family medical history).
	*any request for, or receipt of, genetic services (e.g., genetic test, genetic counseling, genetic education), or participation in clinical research which includes genetic services by the Individual or any family member of the Individual.
	PHI excludes:		PHI excludes:
	*individually identifiable health information of a person who has been deceased for more than fifty (50) years.		*individually identifiable health information of a person who has been deceased for more than fifty (50) years.

Dpanowic at 14:33, October 28, 2022

2022-10-28T14:33:19Z

← Older revision		Revision as of 09:33, October 28, 2022
Line 30:		Line 30:
	Policy No.: '''6061'''<br />		Policy No.: '''6061'''<br />
	Effective Date: '''03/17/03'''<br />		Effective Date: '''03/17/03'''<br />
	Revised Date: '''draft 09/13/22''' <br />		Revised Date: '''draft 10/28/22''' <br />
	Revised Date: ''' ''' <br /><br />		Revised Date: ''' ''' <br /><br />
	<big>'''Accounting of Protected Health Information Disclosures Policy'''</big>		<big>'''Accounting of Protected Health Information Disclosures Policy'''</big>
Line 105:		Line 105:
	#General administrative and business functions;		#General administrative and business functions;
	#Insurance activities relating to the renewal of a contract of health insurance;		#Insurance activities relating to the renewal of a contract of health insurance;
	#Evaluating ~~healthcare~~ provider and plan performance;		#Evaluating health care provider and plan performance;
	#Resolution of internal grievances; and		#Resolution of internal grievances; and
	#Fundraising.		#Fundraising (see [https://wiki.unmc.edu/index.php?title=Use_and_Disclosure_of_Protected_Health_Information&action=edit#Use.2FDisclosure_of_PHI_for_Marketing Use/Disclosure of PHI for Marketing]).
	===Payment===		===Payment===
	Activities undertaken by a health care provider or health plan to obtain premiums, to determine or fulfill its responsibility for coverage and provision of benefits under the health plan or to obtain or provide reimbursement for the provision of health care. Some of these types of activities include determinations of eligibility or coverage (including coordination of benefits or the determination of cost sharing amounts), billing, collection activities, claims management, medical necessity determinations, utilization review activities including pre-certification and pre-authorization of services, disclosure to consumer reporting agencies related to collection of premiums or reimbursement and health care data processing related to the above-listed activities.		Activities undertaken by a health care provider or health plan to obtain premiums, to determine or fulfill its responsibility for coverage and provision of benefits under the health plan or to obtain or provide reimbursement for the provision of health care. Some of these types of activities include determinations of eligibility or coverage (including coordination of benefits or the determination of cost sharing amounts), billing, collection activities, claims management, medical necessity determinations, utilization review activities including pre-certification and pre-authorization of services, disclosure to consumer reporting agencies related to collection of premiums or reimbursement and health care data processing related to the above-listed activities.

Dpanowic: /* Affiliated Covered Entity (ACE) */

2022-09-26T17:10:44Z

Affiliated Covered Entity (ACE)

← Older revision		Revision as of 12:10, September 26, 2022
Line 87:		Line 87:
	== Definitions ==		== Definitions ==
	===Affiliated Covered Entity (ACE)===		===Affiliated Covered Entity (ACE)===
	Legally separate covered entities that designate themselves as a single covered entity for the purpose of HIPAA Compliance. Current ACE members are: The Nebraska Medical Center, UNMC Physicians, UNMC, University Dental Associates, Bellevue Medical Center and Nebraska Pediatric Practice, Inc. d/b/a Children’s Specialty Physicians. ACE membership may change from time to time. The Notice of Privacy Practices lists current ACE members. Access and amendment rights apply to designated record sets throughout the ACE.		Legally separate covered entities that are affiliated and designate themselves as a single covered entity for the purpose of HIPAA Compliance. Current ACE members are: The Nebraska Medical Center, UNMC Physicians, UNMC, University Dental Associates, Bellevue Medical Center and Nebraska Pediatric Practice, Inc. d/b/a Children’s Specialty Physicians. ACE membership may change from time to time. The Notice of Privacy Practices lists current ACE members. Access and amendment rights apply to designated record sets throughout the ACE.

	===Health Care Operations===		===Health Care Operations===
	The following activities related to the Organization's functions as a health care provider and sponsor of a self-insured health plan:		The following activities related to the Organization's functions as a health care provider and sponsor of a self-insured health plan:

Dpanowic at 18:42, September 22, 2022

2022-09-22T18:42:50Z

← Older revision		Revision as of 13:42, September 22, 2022
Line 127:		Line 127:
	*[mailto:debrbishop@nebraskamed.com Privacy Officer], at 402-559-5136		*[mailto:debrbishop@nebraskamed.com Privacy Officer], at 402-559-5136
	*[mailto:mailto:Privacy@NebraskaMed.com Privacy Office]		*[mailto:mailto:Privacy@NebraskaMed.com Privacy Office]
	UNMC Policy No. 6057, [[Use and Disclosure of Protected Health Information]]		*UNMC Policy No. 6057, [[Use and Disclosure of Protected Health Information]]
	*[https://info.unmc.edu/_documents/hippa-docs/_accounting-of-disclosures-form.pdf Request for Accounting of Disclosures of Health Information Form]		*[https://info.unmc.edu/_documents/hippa-docs/_accounting-of-disclosures-form.pdf Request for Accounting of Disclosures of Health Information Form]
	*[https://www.cdc.gov/phlp/publications/topic/hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)]		*[https://www.cdc.gov/phlp/publications/topic/hipaa.html Health Insurance Portability and Accountability Act of 1996 (HIPAA)]

Dpanowic at 21:57, September 13, 2022

2022-09-13T21:57:22Z

Show changes

Dpanowic at 13:26, May 9, 2022

2022-05-09T13:26:08Z

← Older revision		Revision as of 08:26, May 9, 2022
Line 30:		Line 30:
	Policy No.: '''6061'''<br />		Policy No.: '''6061'''<br />
	Effective Date: '''03/17/03'''<br />		Effective Date: '''03/17/03'''<br />
	Revised Date: '''~~DRAFT 04~~/13/22''' <br />		Revised Date: '''05/09/22''' <br />
	Revised Date: <br /> <br />		Revised Date: '''05/09/22''' <br /><br />
	<big>'''Accounting of Protected Health Information Disclosures Policy'''</big>		<big>'''Accounting of Protected Health Information Disclosures Policy'''</big>
	=== Basis for Policy ===		=== Basis for Policy ===

Dpanowic at 17:59, April 13, 2022

2022-04-13T17:59:45Z

← Older revision		Revision as of 12:59, April 13, 2022
Line 30:		Line 30:
	Policy No.: '''6061'''<br />		Policy No.: '''6061'''<br />
	Effective Date: '''03/17/03'''<br />		Effective Date: '''03/17/03'''<br />
	Revised Date: '''DRAFT''' <br />		Revised Date: '''DRAFT 04/13/22''' <br />
	Revised Date: <br /> <br />		Revised Date: <br /> <br />
	<big>'''Accounting of Protected Health Information Disclosures Policy'''</big>		<big>'''Accounting of Protected Health Information Disclosures Policy'''</big>
Line 70:		Line 70:
	#*To the individual about his or her own information		#*To the individual about his or her own information
	#*Authorized by the individual (signed authorization)		#*Authorized by the individual (signed authorization)
	#*For the facility directory or to persons involved in the individual's care, or other notification purposes permitted under law;		#*For the facility directory or to persons involved in the individual's care, or other notification purposes permitted under law
	#*For national security or intelligence purposes;		#*For national security or intelligence purposes
	#*To correctional institutions or other law enforcement officials who have custody of an individual as permitted under law.		#*To correctional institutions or other law enforcement officials who have custody of an individual as permitted under law
	#*As part of a limited data set (see Use & Disclosure of PHI policy)		#*As part of a limited data set (see Use & Disclosure of PHI policy)
	#Individuals shall make their requests to the Health Information Management Department, using the [Request for Accounting of Disclosures of ~~Protected~~ Health Information Form].		#Individuals shall make their requests to the Health Information Management Department, using the [https://info.unmc.edu/_documents/hippa-docs/_accounting-of-disclosures-form.pdf Request for Accounting of Disclosures of Health Information Form]
	#Content Requirements. The accounting for each disclosure must include:		#Content Requirements. The accounting for each disclosure must include:
	#*Date of disclosure;		#*Date of disclosure;
Line 105:		Line 105:
	#:*An IRB waiver;		#:*An IRB waiver;
	#:*decedent PHI; or		#:*decedent PHI; or
	#:*use of PHI preparatory to research (if over 50 records reviewed, only need to provide description of protocol, purpose of research, description of type of PHI disclosed, time period disclosure occurred, name address, etc. etc.)		#:*use of PHI preparatory to research (if over 50 records reviewed, only need to provide description of protocol, purpose of research, description of type of PHI disclosed, time period disclosure occurred, name address, etc. etc.).
	#Department Responsibilities. Health Information Management (HIM) is the designated department for release of patient information. In limited circumstances other areas may release minimal information for such purposes as pre-insurance certification, urgent care, provider communication, releasing test results to the patient, or as otherwise expressly permitted by this or another UNMC policy. All other requests shall be forwarded to the Health Information Management Department for processing. All departments making permitted disclosures of patient information shall document the disclosures in a manner approved by HIM. Departments that maintain health information systems shall alert HIM of the system. When such departments disclose PHI subject to the accounting requirement, department staff shall complete Quick Disclosure tracking documentation in One Chart or establish other record keeping systems for other health information systems and inform HIM of those record keeping systems. A record of such disclosures must be maintained for six years from the date of the disclosure. Departments shall respond to the Health Information Management Department requests for information in response to individual accounting requests within 10 days.		#Department Responsibilities. Health Information Management (HIM) is the designated department for release of patient information. In limited circumstances other areas may release minimal information for such purposes as pre-insurance certification, urgent care, provider communication, releasing test results to the patient, or as otherwise expressly permitted by this or another UNMC policy. All other requests shall be forwarded to the Health Information Management Department for processing. All departments making permitted disclosures of patient information shall document the disclosures in a manner approved by HIM. Departments that maintain health information systems shall alert HIM of the system. When such departments disclose PHI subject to the accounting requirement, department staff shall complete Quick Disclosure tracking documentation in One Chart or establish other record keeping systems for other health information systems and inform HIM of those record keeping systems. A record of such disclosures must be maintained for six years from the date of the disclosure. Departments shall respond to the Health Information Management Department requests for information in response to individual accounting requests within 10 days.
	#Provision of Accounting. The Health Information Management Department in coordination with the Privacy Officer shall respond to accounting requests no later than sixty (60) days after receipt. The response time may be extended by no more than thirty (30) additional days, provided that within the first sixty (60) days, the individual is given a written statement of the reasons for the delay and the date by which the accounting will be provided.		#Provision of Accounting. The Health Information Management Department in coordination with the Privacy Officer shall respond to accounting requests no later than sixty (60) days after receipt. The response time may be extended by no more than thirty (30) additional days, provided that within the first sixty (60) days, the individual is given a written statement of the reasons for the delay and the date by which the accounting will be provided.
Line 111:		Line 111:
	#Suspension of the Right to Accounting. Upon request by a health oversight agency or a law enforcement official, a patient/legal guardian's right to an accounting of disclosures to a health oversight agency or law enforcement official may be suspended for the time period specified by the official if the official asserts that the provision of the accounting would be reasonably likely to impede the activities of the official.		#Suspension of the Right to Accounting. Upon request by a health oversight agency or a law enforcement official, a patient/legal guardian's right to an accounting of disclosures to a health oversight agency or law enforcement official may be suspended for the time period specified by the official if the official asserts that the provision of the accounting would be reasonably likely to impede the activities of the official.
	===Additional Information===		===Additional Information===
	*[mailto:debrbishop@nebraskamed.com Privacy Officer], at 402-559-~~4705~~		*[mailto:debrbishop@nebraskamed.com Privacy Officer], at 402-559-5136
	*[mailto:mailto:Privacy@NebraskaMed.com Privacy Office]		*[mailto:mailto:Privacy@NebraskaMed.com Privacy Office]
	*[Request for Accounting of Disclosures of ~~Protected~~ Health Information Form] ~~- UNDER CONSTRUCTION~~		*[https://info.unmc.edu/_documents/hippa-docs/_accounting-of-disclosures-form.pdf Request for Accounting of Disclosures of Health Information Form]

	This page maintained by [mailto:dpanowic@unmc.edu dkp]		This page maintained by [mailto:dpanowic@unmc.edu dkp]

← Older revision		Revision as of 10:13, July 9, 2024
Line 42:		Line 42:
	It is the policy of Nebraska Medicine (Nebraska Medical Center, Bellevue Medical Center and UNMCP)/UNMC to comply with the procedures set forth below.		It is the policy of Nebraska Medicine (Nebraska Medical Center, Bellevue Medical Center and UNMCP)/UNMC to comply with the procedures set forth below.
	#An individual has a right to receive an accounting of disclosures of PHI made by the ACE during a time period specified up to six (6) years prior to the date of the request, except for disclosures:		#An individual has a right to receive an accounting of disclosures of PHI made by the ACE during a time period specified up to six (6) years prior to the date of the request, except for disclosures:
	#*To carry out treatment, payment or health care operations (including permissible disclosures to other providers for their treatment, payment or health care operations);		#*To carry out treatment, payment or health care operations (including permissible disclosures to other providers for their treatment, payment or health care operations).
	#*To the individual about his or her own information ;		#*To the individual about his or her own information;
	#*Authorized by the individual ~~'''(signed~~ authorization~~) is this [https://info.unmc.edu/_documents/hippa-docs/_accounting-of-disclosures-form.pdf Request for Accounting of Disclosures of Health Information Form]??'''~~;		#*Authorized by the individual written authorization;
	#*For the facility directory or to persons involved in the individual's care, or other notification purposes permitted under law;		#*For the facility directory or to persons involved in the individual's care, or other notification purposes permitted under law;
	#*For national security or intelligence purposes;		#*For national security or intelligence purposes;
	#*To correctional institutions or other law enforcement officials who have custody of an individual as permitted under law;		#*To correctional institutions or other law enforcement officials who have custody of an individual as permitted under law;
	#*As part of a limited data set (see UNMC Policy No. 6057, [[Use and Disclosure of Protected Health Information]]);		#*As part of a limited data set (see UNMC Policy No. 6057, [[Use and Disclosure of Protected Health Information]]);
	#Individuals shall make their requests to the Health Information Management Department (HIM), using the '''~~is this the most recent form and the correct one to use in place of Attachment 1? If not, I will need a link to Attachment 1~~ [https://info.unmc.edu/_documents/hippa-docs/_accounting-of-disclosures-form.pdf Request for Accounting of Disclosures of Health Information Form]??''';		#Individuals shall make their requests to the Health Information Management Department (HIM), using the '''[https://info.unmc.edu/_documents/hippa-docs/_accounting-of-disclosures-form.pdf Request for Accounting of Disclosures of Health Information Form]''';
	#Content Requirements. The accounting for each disclosure must include:		#Content Requirements. The accounting for each disclosure must include:
	#*Date of disclosure;		#*Date of disclosure;
Line 133:		Line 133:
	*[https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule]		*[https://www.cdc.gov/phlp/publications/topic/hipaa.html#security-rule HIPAA Security Rule]

	This page maintained by [mailto:~~dpanowic~~@unmc.edu ~~dkp~~]		This page maintained by [mailto:mhurlocker@unmc.edu mh]