In May, just before Memorial Day weekend, OCR released a Notice of Proposed Rulemaking (NPRM), or preliminary rule, expanding the Accounting of Disclosures (AOD) rule. This preliminary rule, originally due out in 2010, adds a new “Access Report” to the existing AOD requirement (of presenting patients, upon request, with a list of those who have requested the patient’s medical records for the last seven years).

The Access Report, if finalized, will require a covered entity to provide the patient, upon request, with a list of every individual, including workforce members and those outside the covered entity, who has accessed the patient’s electronic PHI from a designated record set for the past three years. Comments about the rule were accepted until August 1.

In the worst case, the Access Report would list hundreds of people who could have access to the records. With an in-patient stay, depending on the controls each covered entity uses within the facility, this could mean everyone from the admissions office to every department in the facility - names of nurses, doctors, respiratory therapists, physical therapists, records clerks, employees within the business office, legal department, risk management department, and all others with access for the previous three years would have to be provided in that scenario if the patient requests an Access Report. 

OCR states that the Access Report is intended to “provide individuals with information about disclosures through an EHR for treatment, payment and health care operations”¹ which previously were exempted from the AOD. In addition, patients would be informed of the opportunity to obtain an Access Report through a revised Notice of Privacy Practices from each healthcare provider. 

The American Health Information Management Association (AHIMA), among other trade associations, submitted comments expressing their displeasure with the preliminary rule as written.  They generally disagreed with the NPRM’s supposition that, “these changes to the accounting requirements will provide information of value to individuals while placing a reasonable burden on covered entities and business associates.”  

After a comment review period, OCR will issue its responses to comments in the Commentary to the final rule, and will publish an effective date. You can expect to have the final rule effective sometime in the spring of 2012, so stay tuned.

You may access the NPRM by clicking here.