The HIPAA Privacy Rule requires covered entities to account for certain disclosures of PHI and to provide this accounting to patients upon request.  Under HIPAA, disclosures for treatment, payment and health care operations are exempt from this accounting requirement.  HITECH changes this exemption - disclosures of PHI from an EHR for treatment, payment and health care operations will be required to be in the accounting.  The deadline for this new requirement depends upon when a covered entity adopts an EHR.  Covered entities who had an EHR in place by January 1, 2009 do not have to comply with the new rule until January 1, 2014, while covered entities who did not have an EHR in place by that date will have to comply by the later of January 1, 2011 or the date the EHR is adopted.  HHS is authorized under the HITECH Act to delay the compliance dates up to 2016 and 2013, respectively.

The RFI asks a series of specific questions regarding how the expanded accounting rule may benefit patients and how often covered entities have received accounting requests in the past, what type of information should be included in the accounting of disclosures from EHRs, the capability of existing EHR systems to track uses and disclosures, the detail retained by EHR systems regarding uses and disclosures, the burden to retain such information, whether EHR systems are centralized or decentralized, and how much time it would take for covered entities and vendors to design and install this functionality.

We expect comment submissions from the industry to focus on the effort and cost of new investment to create the functionality needed to track the disclosures from an EHR, especially among multiple interfaces and information systems supporting multiple EHRs within a hospital and the difficulty of implementing this functionality for health information exchanges ("HIE"). 

The RFI and instructions on how to submit comments may be found at http://www.hhs.gov/ocr/privacy/hipaa/understanding/special/healthit/accountingrfi.html.  Comments are due Tuesday, May 18, 2010.  After reviewing the comments, OCR will issue a proposed rule on this topic with a 60 day comment period, giving the industry a second opportunity to submit comments on this topic before a final rule is issued.

If your organization has questions regarding the RFI or would like assistance in submitting comments, please contact Elizabeth Callahan-Morris at ecallahan@hallrender.com or 248.457.7854, Jeffrey W. Short at jshort@hallrender.com or 317.977.1413, or your regular Hall Render attorney.