Health Care Department Operations Manual

Cancel

Chapter 2 – Patients’ Entitlements and Responsibilities

Article 2 – Confidentiality and Privacy

View All Sections >

2.2.18 Accounting of Disclosures for Patients’ Protected Health Information

  • Policy

    • California Correctional Health Care Services (CCHCS) shall maintain a process to account for the disclosures of patients’ Protected Health Information (PHI) in compliance with federal and state privacy laws.

  • Purpose

    • To ensure disclosures of patient PHI are tracked and documented in order to provide an accounting of such disclosures to the patient upon their request.

  • Responsibility

    • The Chief Privacy Officer shall have oversight of this policy to comply with privacy laws, policies, and standards for respecting the privacy rights of individuals regarding the collection, use, and disclosure of PHI maintained by CCHCS.

    • Under the direction of the Chief of Health Information Management (HIM), or designee, the HIM workforce members shall receive and respond to requests for an accounting of disclosures and provide reports on organization disclosures to the Privacy Office.

  • Procedure

    • Tracking Disclosures

      • CCHCS program areas and Business Associates (BA) that disclose patient PHI shall ensure that the disclosures are documented and made available in responding to an accounting of disclosures request.

      • CCHCS program areas that disclose patient PHI shall maintain an electronic record of each accounting of disclosures sufficient to demonstrate compliance with the requirements.

        • Tracking information shall be maintained pursuant to the Health Care Department Operations Manual (HCDOM) Sections 2.3.1, Health Information Management Overview, 2.3.2, Security and Privacy, and 2.3.5, Health Information Exchange.

        • CCHCS program areas and BAs shall retain the tracking documentation records for a minimum of six years from the date of its creation or the date when it was last in effect, whichever is later.

        • CCHCS BAs shall be responsible for accounting of disclosures pursuant to the HCDOM Section 2.2.9, Business Associate Use and Disclosure of Protected Health Information, and the Business Associate Agreement.

    • Accounting of Disclosures

      • Processing Request for Accounting of Disclosures

        • HIM shall review the access and disclosure log to determine if the patient has requested an accounting of disclosures within the last 12 months. Subsequent requests of accounting of disclosures shall only include incremental disclosures made since the original accounting.

          • HIM shall print the accounting of disclosures document for the requested dates from the ‘Access HIM’ application within the Electronic Health Record System.

          • HIM shall ensure that the accounting of disclosures include the following, at a minimum:

            • The date(s) of the disclosure(s).

            • The names and title of the entity or person to whom the information was provided, and the recorded address.

            • A brief description of the health information disclosed.

            • The reason for the required or permitted disclosure.

        • HIM shall contact the program areas for the patient’s requested date(s) of disclosure(s). Programs and BAs shall provide to HIM the requested data within five calendar days of the request. HIM shall:

          • Gather, organize, and combine all data into one document.

          • Print and mail the document to the patient.

          • Update the Accounting of Disclosures tracking records.

      • Response Timing

        • HIM shall respond within 60 calendar days after receipt of a request for a patient’s accounting of disclosures.

        • If unable to respond within 60 calendar days, HIM may extend the time by no more than 30 calendar days, provided that within the initial 60-day period, HIM provides the patient with a written statement of the reasons for the delay and the date by which the accounting shall be provided.

          • Only one 30-day extension is permitted.

        • The following types of disclosures are excluded from the accounting of disclosures requirement:

          • Treatment, payment, and health care operations.

          • To the patient about themselves.

          • Resulting from or incident to an otherwise permitted disclosure.

          • Pursuant to an authorization.

          • For a facility’s directory, or to persons involved in the patient’s care or for related purposes.

          • That are part of a Limited Data Set.

          • To correctional institutions or law enforcement officials under the HIPAA corrections exception.

        • Disclosures Accounting for Research Purposes.

          • If during the period of time covered by the requested accounting, CCHCS makes disclosures for specific research purposes regarding 50 or more individuals’ records, CCHCS may account for the disclosures by providing all of the following:

            • The name of the protocol or other research activity.

            • A plain language description of the research protocol or activity, including the purpose of the research and the criteria for selecting certain records.

            • A brief description of the type of health information that was disclosed.

            • The dates or periods of time during which the disclosures occurred, or may have occurred, including the date of the last disclosure during the accounting period.

            • The name, address, and telephone number of the entity that sponsored the research and the researcher to whom the information was disclosed.

            • A statement that the health information may or may not have been disclosed for a particular protocol or particular research activity.

          • If it is reasonably likely that the health information was disclosed for a research protocol or activity, CCHCS shall, if requested by the patient, assist the patient in contacting the entity that sponsored the research and the researcher.

          • Upon request by the patient, state entities are responsible for providing an accounting of disclosures related to research for the six years prior to the request.

      • Charge for the Accounting of Disclosures

        • HIM shall not charge a fee to a currently incarcerated person who requests an accounting of disclosures.

        • HIM may charge a fee to a person no longer incarcerated as follows:

          • The first accounting of disclosures made to a person during any 12-month period of time shall be provided free of charge.

          • For any subsequent request for an accounting of disclosures made by the same person within this 12-month period, HIM may charge a reasonable, cost-based fee for the accounting, provided that HIM informs the person of the charge in advance and provides the person with an opportunity to withdraw or modify the request for a subsequent accounting to avoid or reduce the fee.

    • Reporting of Accountings of Disclosures

      • HIM shall provide a report of all accountings of disclosures to the Privacy Office upon request. This report shall include all information required in each accounting, and the titles of persons or offices responsible for receiving and processing requests for accounting of disclosures.

  • References

    • Code of Federal Regulations, Title 45, Subtitle A, Subchapter C, Part 164, Subpart E, Section 164.528

    • Code of Federal Regulations, Title 45, Subtitle A, Subchapter C, Part 164, Subpart E, Section 164.530(j)

    • California Civil Code, Division 3, Part 4, Section 1798.25

    • Health Care Department Operations Manual, Chapter 2, Article 2, Section 2.2.7, Patient Privacy Rights

    • Health Care Department Operations Manual, Chapter 2, Article 2, Section 2.2.9, Business Associate Use and Disclosure of Protected Health Information

    • Health Care Department Operations Manual, Chapter 2, Article 2, Section 2.2.11, Privacy Incident and Potential Breach Reporting and Case Workflow

    • Health Care Department Operations Manual, Chapter 2, Article 3, Section 2.3.1, Health Information Management Overview

    • Health Care Department Operations Manual, Chapter 2, Article 3, Section 2.3.2, Security and Privacy

    • Health Care Department Operations Manual, Chapter 2, Article 3, Section 2.3.5, Health Information Exchange

    • Eisenhower Medical Center v. Superior Court, 226 Cal.App.4th 430 (2014)

    • Statewide Health Information Policy Manual, Section 2.2.12, Research

    • Statewide Health Information Policy Manual, Section 5.1.1, Accounting of Disclosures

  • Revision History

    • Effective: 10/23/2023

    • Reviewed: 10/09/2024, 11/12/2025