FAQs Categories

Right to an Accounting of Disclosures

Are covered entities required to document incidental disclosures permitted by the HIPAA Privacy Rule, in an accounting of disclosures provided to an individual?
Does the HIPAA Privacy Rule require a business associate to provide individuals with access to their protected health information or an accounting of disclosures, or an opportunity to amend protected health information?
Does the HIPAA Privacy Rule require that covered entities document all oral communications?
To provide individuals with an accounting for disclosures, does a covered entity have to document each medical record that may be accessed by a public health authority in the course of surveillance activities that involve all patient records?
How can a covered entity account for the date of access if it is not known for certain?
Must a covered entity provide an accounting for disclosures if the only information disclosed to a public health authority is in the form of a limited data set?
May a covered entity hire a business associate to create a limited data set, and may the public health authority be a business associate for that purpose, even if the public health authority is also the intended recipient of the limited data set?
When must a covered entity account for disclosures of protected health information made during the course of litigation?