HIPAA Privacy Rule: Recording of Disclosures

Oct 20, 2021 | Compliance Corner

Please Review: Employees are encouraged to review the Accounting of Disclosures Policy #415. It outlines the disclosure guidelines. It can be found in the 400 HIPAA folder in the VCS Policies on Vincentian computers.
The HIPAA Privacy Rule gives seven rights to anyone using the U.S. healthcare system. That includes our Vincentian residents and you when you receive treatment from a physician, hospital, or skilled nursing facility. 

One of those rights is the accounting of disclosures. It means that at any time our residents have the right to request a written record (an accounting) of when Vincentian has made certain disclosures of protected health information (PHI). Disclosures occur when PHI is shared by Vincentian with a person or organization outside of Vincentian.

Here’s a summary of the types of disclosures that need to be recorded by Vincentian and those that do not:

Two Types of Disclosures that Must Be Recorded:

  1. Inappropriate disclosures by staff, which include:
    • Disclosing PHI to a family member or friend(s) of the resident without obtaining the permission of the resident,
    • Disclosing PHI to the wrong person (e.g., giving discharge instructions to the wrong resident or sending the incorrect medical record to an attorney),
    • Disclosing PHI to your family member or friend who is acquainted with the resident,
    • A misdirected fax with PHI that is inadvertently sent to the local auto body repair shop, for example.
  1. Disclosures of PHI for a required These disclosures are required by law or federal or state regulation and are permissible by HIPAA without a signed authorization:
    • Court orders, subpoenas, judicial and administrative proceedings,
    • Law enforcement purposes,
    • Public health authorities (e.g., Allegheny County Health Department),
    • Health oversight activities (e.g., Pennsylvania Department of Health),
    • Decedents (e.g., disclosures made to a funeral director),
    • Disclosures to avert a serious threat to health or safety,
    • Disclosures related to worker’s compensation programs.

Types of Disclosures that Do Not Need To Be Recorded:

There are instances when disclosures do not need to be recorded. For example, the HIPAA Privacy Rule does not require Vincentian to account for disclosures that we make to the resident about his/her own PHI. Other disclosures that do not to be recorded include:

  • Disclosures for treatment, payment, and healthcare operations. (Healthcare operations include the facility quality assurance committee, risk management, compliance, or legal purposes),
  • Disclosures covered by a HIPAA authorization form that the resident or his/her POA or personal representative has signed,
  • Disclosures involving our facility’s directory,
  • Disclosures to persons involved in the resident’s care.

How do you record disclosures?

Management and Licensed Nursing staff

  1. In the resident’s record in PCC, go to “Clinical” and select “Risk Management” under the “Care Management” tab.
  2. Under “Active” tab select “New”
  3. Complete all appropriate fields and under “Type/Nature of Incident,” select
    “HIPPA Disclosure”
  4. Complete UDA in its entirety.

All other staff

  1. Complete the Vincentian Incident Form, describing the disclosure in detail.
  2. Give completed form to your direct supervisor.
  3. If your supervisor has access to the Risk Management Tab in PCC, please follow the instructions for Management and Licensed Nursing staff above. If your supervisor does not have access to the Risk Management Tab, give completed Vincentian Incident Form to the Director of Nursing, Assistant Director of Nursing, Administrator, or Assistant Administrator.
  4. Director of Nursing, Assistant Director of Nursing, Administrator, or Assistant Administrator will complete the HIPPA Disclosure UDA and report the disclosure to the Vincentian Compliance and Privacy Officer.