For a better experience, click the Compatibility Mode icon above to turn off Compatibility Mode, which is only for viewing older websites.

Accounting of Disclosures

Drexel University Clinical Covered Entities
Privacy Program Policies and Procedures

Policy Title: Accounting of Disclosures
Policy Number: PPS-11
Effective Date: April 14, 2003; September 23, 2013
Last Revision: September 1, 2017
Responsible Officer: Executive Vice President, Treasurer and Chief Operating Officer

Table of Contents


This policy applies to all Covered Entities within Drexel University.

Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards.

I. Policy

Right to an Accounting of Disclosures. Drexel University (DU) supports the right of the patient to request an "accounting of disclosures." The "Accounting" is a list of the disclosures of medical information made by DU or its business associates, other than as set forth below, not related directly to treatment, payment or operations.

II. Request Procedure

The patient must submit a request in writing to the practice treating the patient. A copy of the request is to be provided to the Chief Privacy Officer.

The request must state a time period not longer than six (6) years back; provided, however that with respect to disclosures regarding treatment, payment and operations through an Electronic Health Record (as defined below), the period is no longer than three (3) years. The request should indicate in what form the patient is requesting production of the list (for example, on paper, electronically). The patient will be notified of the cost involved and may choose to withdraw or modify the request at that time before any costs are incurred.

III. Tracking Disclosures

Clinical practices must initiate a "Disclosure Tracking" form at the time of any disclosure not related to treatment, payment or operations unless such disclosures are made through an Electronic Health Record, in which case they must be included on the "Disclosure Tracking". An "Electronic Health Record" means an electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and their staff.

The form should be retained on the medical record and serve as a "log" of disclosures to enable provision of a summary if an "Accounting of Disclosures" is requested. The form will be retained for six (6) years beyond the latest entry on the form.

Disclosures and uses to be tracked for "Accounting":

  1. required by law (e.g. mandated reporting under state law).
  2. for public health activities and reporting.
  3. about victims of abuse, neglect or domestic violence.
  4. for health oversight activities (e.g. licensure actions).
  5. in response to a court order.
  6. in response to a subpoena or discovery request.
  7. for law enforcement purposes.
  8. to a medical examiner, funeral director or for cadaveric organ donation.
  9. for certain specialized government functions (e.g. regarding armed forces personnel).
  10. as authorized by and to the extent required to comply with worker's compensation laws.
  11. to business associates (if not in an excluded category).
  12. made subsequently by business associates (if not in an excluded category).
  13. not permitted by HIPAA.
  14. to researchers under the following circumstances:
    • based on a waiver or alteration of the individual authorization requirement.
    • for reviews preparatory for research.
    • under the procedure for access to decedent records.
  15. to the Secretary of the federal Department of Health and Human services.
  16. any other disclosure of PHI that is not specifically excluded.
  17. Disclosures for treatment, payment and health care operations, if made through an Electronic Health Record.

 Back to Top