click here to download MS Word format

UNIVERSITY POLICY

To establish a policy and procedure to ensure UMDNJ’s compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) in providing an individual the right to receive an accounting of disclosures of his/her Protected Health Information (PHI) made by UMDNJ and/or its covered entities.

II.       ACCOUNTABILITY

Under the direction of the President, the Deans, Senior Vice President for Administration and Finance, Senior Vice President for Academic Affairs, Vice President for Legal Management, Vice President for Research, Vice President for Finance and Treasurer, Presidents/CEOs of the Healthcare Units, and the University Hospital Medical Director, shall ensure compliance with this policy.

III.      APPLICABILITY

This policy shall apply to health information that is generated during provisions of health care to patients in any of the University’s patient care units, patient care centers or faculty practices as well as Human Subjects research under the auspices of the University or by any of its agents in all UMDNJ Schools, Units, Departments and University owned or operated facilities.

IV.     DEFINITION

Protected Health Information (PHI) - For a full definition of what constitutes protected health information, see University policy, 00-01-15-15:00, Uses and Disclosures of Health Information With and Without an Authorization.

V.      REFERENCES

A.       45 CFR 164.528, Title 45, Code of Federal Regulations, Part 164, Section 528, Security and Privacy, Accounting of Disclosures of Protected Health Information.

B.       45 CFR 164.512 (i), Title 45, Code of Federal Regulations, Part 164, Section 512, Security and Privacy, Uses and Disclosures for Which Consent, an Authorization or Opportunity to Agree or Object is not Required, Uses and Disclosures for Research Purposes

C.       45 CFR 164.514(e), Title 45, Code of Federal Regulations, Part 164, Section 514, Subpart E, Security and Privacy, Privacy of Individually Identifiable Health Information.

D.       Uses and Disclosures of Health Information                                                00-01-15-15:00
           With and Without an Authorization

The following policies provide additional and related information:

E.       Standards for Privacy of Individually Identifiable Health Information             00-01-15-05:00

F.       Access of Individuals to Health Information                                                 00-01-15-10:00

A.       Requirements:

1.       UMDNJ and/or its units will provide an individual with an accounting of all disclosures of their PHI upon the individual’s written request as required by state and federal law.  A request for Accounting of Disclosures Form can be accessed at the following website: http://www.umdnj.edu/complweb/policies/hipaapols/RequestforAccountingofDisclosuresForm.pdf.

2.               Units will act on an individual’s request for an accounting within sixty (60) days of receipt of the request.  If a unit is unable to provide the accounting within sixty (60) days, it may extend the time period to provide the accounting by no more than thirty (30) days; however, within the original sixty (60) days, units must provide the individual with a written statement of the reasons for the delay and the date by which units will provide the accounting.  Units are only permitted one extension per request.

3.               The first accounting in a twelve-month period to an individual must be provided without charge.  However, units may impose a reasonable cost-based fee for each subsequent request for an accounting made by the same individual within the twelve-month period provided the unit informs the individual of the fee prior to complying with the request, thus giving the individual the opportunity to withdraw or modify the request.

4.               As part of the accounting of the disclosures, the unit will coordinate the releases of PHI with business associates.

5.               A unit must temporarily suspend an individual’s right to receive an accounting of disclosures made to a health oversight agency or law enforcement official, for the time specified by such agency or official, if such agency or official provides the unit with a written statement that such an accounting to the individual would be reasonably likely to impede the agency’s activities and it must include the time frame for which such a suspension is required.

6.               A unit must temporarily suspend an individual’s right to receive an accounting of disclosures made to a health oversight agency or law enforcement official, for the time specified by such agency or official, if such agency or official provides the unit with an oral statement that such an accounting to the individual would be reasonably likely to impede the agency’s activities and it must include the time frame for which such a suspension is required.  However, inasmuch as the statement was given orally, units must:

a.               document the statement, including the identity of the agency or official making the statement;

b.       limit the temporary suspension to no longer than thirty (30) days from the date of the oral statement, unless a written statement is submitted during that time.

7.       Requests made for accountings of disclosures of PHI must be made to the employee or department designated by the Dean, President/CEO of the Healthcare Unit, and/or Unit Privacy Officer.

B.       Responsibilities:

1.               Each unit will implement a process to provide an accounting to individuals of all disclosures except:

a.               disclosures to carry out treatment, payment and healthcare operations;

b.              disclosures to the individual of PHI about themselves;

c.               disclosures for the facility’s directory or to persons involved in the individual’s care or other notification purposes;

d.              disclosures for national security or intelligence purposes;

e.               disclosures to correctional institutions or law enforcement officials, as provided;

f.                disclosures that occurred prior to April 14, 2003;

g.               disclosures pursuant to an authorization;

h.               disclosures incident to a use and disclosure otherwise permitted;

i.                 disclosures that are part of a limited data set in accordance with 45 CFR 164.514(e).

2.               An accounting must cover a period of six (6) years, unless the request specifies a shorter period.

3.       The accounting for each disclosure must include:

a.               the date of the disclosure;

b.              the name and address of the entity or person who received the PHI;

c.               brief description of the PHI disclosed;

d.              brief statement of the purpose of the disclosure that reasonably informs the individual of the basis for the disclosure or, in lieu of such statement, a copy of a written request for disclosure (i.e. subpoena, etc).

4.               If a unit has made multiple disclosures of PHI to the same person or entity for a single purpose, the accounting with respect to such multiple disclosures should provide:

a.               the information required as described in section VI..A.3. for the first disclosure during the accounting period;

b.              the frequency or number of the disclosures made during the accounting period;

c.               the date of the last disclosure during the accounting period.

5.               All units must document and retain for six (6) years the following information:

a.               The information required to be included in an accounting as discussed in section VI.B.3.

b.              The written accounting itself that was given to the requesting individual.

c.               The titles of persons or offices responsible for receiving and processing requests for an accounting.

6.       If, during the period covered by the accounting, a unit has made disclosures of PHI for a particular research purpose in accordance with CFR 164.512(i) for fifty (50) or more individuals, the accounting may, with respect to such disclosures for which the PHI about the individual may have been included, provide:

a.       The name of the protocol or other research activity;

b.       A description, in plain language, of the research protocol or other research activity, including the purpose of the research and the criteria for selecting particular records;

c.       A brief description of the type of PHI that was disclosed;

d.       The date or period of time during which such disclosures occurred, or may have occurred, including the date of the last such disclosure during the accounting period;

e.       The name, address, and telephone number of the entity that sponsored the research and of the researcher to whom the information was disclosed; and

f.        A statement that the PHI of the individual may or may not have been disclosed for a particular protocol or other research activity. 

7.       If the unit provides an accounting for research disclosures in accordance with section VI.B.6. and it is reasonably likely that the PHI of the individual was disclosed for such research protocol or activity, the unit must, at the request of the individual, assist in contacting the entity that sponsored the research and the researcher.

By Direction of the President:

                                                                               
Vice President for Legal Management

Policy Manual Table of Contents

OPPM Home Page

UMDNJ Home Page