Download Accounting for Disclosures Quick Reference

ACCOUNTING FOR DISCLOSURES
QUICK REFERENCE
The HIPAA Privacy Rule requires covered entities to account for certain disclosures of protected health
information. This accounting will need to include many things that are in your Notice of Privacy Practices
(NPP), especially the ones that may be disclosed without authorization. The following is a list of disclosures
that must be logged on the “PHI Disclosure Log.”
























Health Oversight - Department of Inspection and Appeals
Locating suspects, fugitives, witnesses – to law enforcement
Suspicious deaths – to law enforcement, medical examiner
Abuse, adult and child – to law enforcement, Division of Family Services
Birth reporting to State
Communicable disease reporting
Crime on premises- to law enforcement
Crime victims- to law enforcement
Death certificates, death notification
Employer for work related illness or injury
Significant exposure to communicable disease- to EMS
FDA (Food and Drug Administration)
Foreign military personnel
Funeral director/homes
Government-required releases (trauma registry, birth defect registry, what may be mandated by your state)
Injury reporting - to law enforcement
Medical Examiner
Organ donor services
Public Health Issues
Research (without authorizations)
Subpoenas, court orders, discovery request or other lawful process (unless authorization is provided)
U.S. Embassies
Contractors/ Business Associates (if not for TPO)
Vendors (if not for TPO)
Just because examples of disclosures are listed in the NPP doesn't mean covered entities don't have to account
for them on an individual basis. This is an important part of your HIPAA compliance that could be easily
forgotten. Each disclosure must be logged and the patient has a right to that accounting. There are, however, a
couple exceptions. If a disclosure is made to a health oversight agency or law enforcement official a covered
entity must temporarily suspend an individual’s right to receive an accounting, if such agency or official
submits such a written statement. The written statement must note that any accounting to the individual would
be reasonably likely to impede the agency’s activities and it must specify the time for which such a suspension
is required.