8.00 - Accounting for Disclosures of Protected Health Information

I. Purpose:
To issue instructions to all ADAMH workforce members regarding the provision of an accounting of disclosures of protected health information (PHI).

II. Applicability:
This policy applies to all ADAMH workforce members.

III. Authority:
45 CFR Parts 160 & 164

IV. Definitions:

Disclosure means the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information.

Use means with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information.

Protected Health Information (PHI) means individually identifiable information relating to the past, present or future physical or mental health or condition of an individual, provision of health care to an individual, or the past, present or future payment for health care provided to an individual.

Treatment, Payment and Health Care Operations (TPO) includes all of the following:

Treatment means the provision, coordination, or management of health care and related services, consultation between providers relating to an individual, or referral of an individual to another provider for health care.
Payment means activities undertaken to obtain or provide reimbursement for health care, including determinations of eligibility or coverage, billing, collection activities, medical necessity determinations and utilization review.
Health Care Operations include functions such as quality assessment and improvement activities, reviewing competence and qualifications of health care professionals, conducting or arranging for medical review, legal services, and auditing functions, business planning and development, and general business and administrative activities.

Workforce Members means Board of Trustees members, employees, volunteers, trainees, and other persons whose conduct, in the performance of work for ADAMH, is under the direct control of ADAMH, regardless of whether they are paid by ADAMH.

V. Policy:

1. Generally: In compliance with 45 CFR 164.528, an individual has a right to receive an accounting of disclosures of PHI by the ADAMH Board during a time period specified up to six (6) years prior to the date of the request for an accounting, except for disclosures:
   1. To carry out TPO as permitted under law;
   2. To the individual about his or her own information;
   3. To persons involved in the individual's care, or other notification purposes permitted under law;
   4. Pursuant to the individual's authorization;
   5. For national security or intelligence purposes;
   6. To correctional institutions or law enforcement officials as permitted under law;
   7. That occurred prior to April 14, 2003.
   The individual's right to receive an accounting of disclosures of PHI to a health oversight agency or law enforcement official must be suspended for the time period specified by such agency, or official if the agency or official provides a written statement asserting that the provision of an accounting would be reasonably likely to impede the activities of the such agency, and specifying a time period for the suspension. Such a suspension may be requested and implemented based on an oral notification for a period of up to thirty (30) days. Such oral request must be documented, including the identity of the agency or official making the request. The suspension may not extend beyond thirty (30) days unless the written statement described herein is submitted during that time period.
2. Content Requirements: The written accounting must meet the following requirements:
   1. Other than as excepted above, the accounting must include disclosures of PHI that occurred during the six (6) years (or such shorter time period as is specified in the request) prior to the date of the request, including disclosures by or to business associates;
   2. The accounting for each disclosure must include:
      1. Date of disclosure;
      2. Name of entity or person who received the PHI, and, if known, the address of such entity or person;
      3. A brief description of the PHI disclosed;
      4. A brief statement of the purpose of the disclosure that reasonably informs the individual of the basis for the disclosure, or in lieu thereof, a copy of the individual's authorization or the request for a disclosure;
   3. If, during the time period for the accounting, multiple disclosures have been made to the same entity or person for a single purpose, or pursuant to a single authorization, the accounting may provide the information as set forth above for the first disclosure, and then summarize the frequency, periodicity, or number of disclosures made during the accounting period and the date of the last such disclosure during the accounting period.
3. Provision of the Accounting: The individual's request for an accounting must be acted upon no later than sixty (60) days after receipt, as follows:
   1. Provide the accounting as requested, or;
   2. If unable to provide the accounting within sixty (60) days, the time for response may be extended by no more than thirty (30) additional days, provided that:
      1. Within the first sixty (60) days, the individual is given a written statement of the reasons for the delay and the date by which the accounting will be provided, and;
      2. There are no additional extensions of time for response.
   3. The first accounting in any twelve month period must be provided to the individual without charge. A reasonable, cost-based fee may be charged for additional accountings within the twelve month period, provided the individual is informed in advance of the fee, and is permitted an opportunity to withdraw or amend the request.
4. Documentation Requirements: The ADAMH Board must document and retain documentation, in written or electronic format, for a period of six (6) years:
   1. All information required to be included in an accounting of disclosures of PHI;
   2. All written accountings provided to individuals, and;
   3. Titles of persons or offices responsible for receiving and processing requests for an accounting from individuals.