Webinar sheds light on proposed OCR disclosure rule
 |
Those two rights are the right of an individual to an access report that discloses “who accessed the report” and the right to an accounting of disclosures focused on “why the reports were accessed,” stated Greene.
The question an access report answers is “Who has seen my record?” he said. Often, individuals want to know if a particular person—such as an ex-spouse, a relative or a neighbor—has seen their medical record, Greene stated. The right to an access report provides a clear answer.
An access report includes any electronic access to designated records sets (DRSs), including medical records, EHRs, billing records, enrollment, payment and claims adjudication. It does not distinguish between “uses” and “disclosures,” meaning that any time someone accesses the DRS electronically, that will be captured in the access logs and expected to be included in the access report.
The proposed access report will include the date and time, the name of the person accessing the record (or organization, if available), description of information accessed (such as medications) if available and user action (view, editing, deleting) if available. The report will cover a three-year period. Individuals can specify whether business associates are included. The rule calls for a 30-day response period with one 30-day extension opportunity, and must provide options to limit the request to specific date, time period or person.
Greene reminded the audience that the access report only relates to electronic information and must be provided in a machine-readable form such as a Word document, Excel document or text-based PDF.
The proposed accounting of disclosures is a more detailed full accounting "that I believe will be welcomed by most covered entities,” stated Greene. The right to accounting of disclosures in the proposed rule differs from the current rule in that the time period of disclosures would change from the current six-year period to a leaner three-year period. “The rationale [is] there isn’t much need beyond three years,” said Greene.
The proposed rule would also include only DRSs instead of all personal health information. “Stray electronic files would no longer be included.” The response time period would also be shortened from 60 days to 30 days to respond to the accounting of disclosure.
Included in the proposed accounting of disclosure is an approximate date (June 2011 or “within month of discharge”), name of recipient (person or entity), brief description of type of information and a brief description of purpose (or copy of the request). For multiple disclosures, the proposed rule allows a range of dates; current law calls for the exact start and end date and frequency of data access. “The proposed rule would not require information about frequency of disclosures,” Greene noted.
The proposed rule of accounting of disclosures would apply to disclosures such as:
- Impermissible disclosures;
- Public health (other than child abuse or neglect);
- Judicial and administrative proceedings;
- Law enforcement;
- To avert a serious threat to health or safety; and
- Worker’s compensation.
The accounting of disclosures, under the proposed rule, would no longer apply to certain disclosures including:
- Adult or child abuse/neglect/domestic violence reports;
- Healthcare oversight;
- Decedents (to coroners, medical examiners, funeral directors and for organ donation);
- Protective services of the president; and
- Required by law (other than to courts or for law enforcement).
For patient needs, an access report focuses on information most relevant to the patient while accounting focuses on types of disclosures most likely to impact the individuals such as a public health investigation, Greene clarified.
“Don’t treat the proposal like a final rule,” Greene concluded. “But do confirm you have a list of all DRS systems and that all electronic access to DRS system is being logged.”