NCHICA: Access Report Big Problem in Accounting of Disclosures Rule

A new patient right to an access report in the proposed rule making changes to accounting of disclosures "goes well beyond HIPAA's intent and does not materially add to HIPAA's already strong protections for protected health information," according to the North Carolina Healthcare Information and Communications Alliance Inc.

The stakeholder group, in a comment letter to the HHS Office for Civil Rights, contends the office does not have the statutory authority to establish the right to an access report, but offers a number of recommendations if the right is affirmed in a final rule.

For instance, data for certain procedures, such as a colonoscopy or an echocardiogram come from "feeder sources" and are not maintained in entirety for more than two or three weeks. Consequently, NCHICA recommends clarifying the definition of a "designated record set" to exclude records that are "not persistent."

Further, more guidance is needed on what OCR considers "access" for purposes of an access report, the group notes. "Many times, information that is 'viewed' in an EHR is not in fact viewed but, rather, returned in response to a query of appointments, for example," according to the comment letter. "We are concerned that all records returned in response to such a query could be construed as having been accessed and therefore would need to be logged in all such individuals' records. For instance, entering 'John Doe' into the search box of an EMR might return several hundred entries but would only display the demographics necessary to more positively identify the particular 'John Doe' being sought. These entries would seem to be of no value to an individual requesting an access report and are currently not logged in many EMRs."

The complete comment letter is available at nchica.