11.
ADMINISTRATIVE REQUIREMENTS:
164.514(h)    
11.1.
Verification Requirements:
164.514(h)(1)    
11.1.1.
Prior to any disclosure permitted under the regulations, CE must:
11.1.1.1.
Except with respect to disclosures under ¶ 6., verify the identity of a person requesting PHI and the authority of such person to access the PHI if not known to the CE; and
11.1.1.2.
Obtain any documentation, statements, or representations, whether oral or written, from the person requesting the PHI when it is a condition of the disclosure under the regulations.
164.514(h)(2)    
11.1.2.
Implementation requirements:
11.1.2.1.
Conditions on disclosure: If a disclosure is conditioned under the regulations on particular documentation, statements, or representations from the person requesting the PHI, CE may rely, if reasonable under the circumstances, on documentation, statements or representations that, on their face, meet the applicable requirements.
11.1.2.1.1.
The conditions in 164.512(f)(1)(ii)(C) [¶ 9.6.1.2.3.] may be satisfied by the administrative subpoena or similar process or by a separate written statement that, on its face, demonstrates that the applicable requirements have been met.
11.1.2.1.2.
The documentation required by 164.512(i)(2) [¶ 9.8.2.] may be satisfied by one or more written statements, provided that each is appropriately dated and signed in accordance with the provisions 164.512(i)(2)(i)(v)[¶ 9.8.2.1 and [¶ 9.8.2.5].
11.1.2.2.
Identity of public officials: CE may rely, if reasonable under the circumstances, on any of the following to verify identity when the disclosure of PHI is to a public official or a person acting on behalf of a public official:
11.1.2.2.1.
If the request is made in person, presentation of agency identification badge, other official credentials, or other proof of government status;
11.1.2.2.2.
If the request is in writing, on appropriate government letterhead;
11.1.2.2.3.
If the disclosure is to a person acting on behalf of a public official, a written statement on appropriate government letterhead that the person is acting with authority, or other evidence of agency, such as a contract for services, MOU, purchase order, that establishes that the person is acting on behalf of the public official;
11.1.2.3.
Authority of public officials: CE may rely, if reasonable under the circumstances, on any of the following to verify authority when the disclosure of PHI is to a public official or a person acting on behalf of the public official:
11.1.2.3.1.
A written statement of legal authority under which the information is requested, or, if a written statement would be impractical, an oral statement of such authority;
11.1.2.3.2.
A request made by legal process, warrant, subpoena, order, or other legal process issued by a grand jury or a judicial or administrative tribunal is presumed to constitute legal authority.
11.1.2.4.
Exercise of professional judgment: Verification requirements of ¶ 11.1 are met if CE relies on the exercise of professional judgment in making a use or disclosure in accordance with 164.510 [¶ 6.] or acts on a good faith belief in making a disclosure under 164.512(j) [¶ 9.7.].

164.528		    
11.2.
Accounting of Disclosures of PHI:
164.528(a)(1)    
11.2.1.
Right to an accounting of disclosures of PHI:
11.2.1.1.
An individual has a right to receive an accounting of disclosures of PHI made by a covered entity in the six years prior to the date on which the accounting is requested, except for disclosures:
11.2.1.1.1.
To carry out TPO as provided in ¶ 3.1.2;
11.2.1.1.2.
To individuals of PHI about them as provided in ¶ 3.1.1;
11.2.1.1.3.
Incident to a use or disclosure otherwise permitted or required ¶ 11.2;
11.2.1.1.4.
Pursuant to an authorization as provided in ¶ 7;
11.2.1.1.5.
For the facility's directory or to persons involved in the individual's care or other notification purposes as provided in ¶ 6.;
11.2.1.1.6.
For national security or intelligence purposes as provided in ¶ 9.11.2.;
11.2.1.1.7.
To correctional institutions or law enforcement officials as provided in ¶ 9.6.7.; or
11.2.1.1.8.
As part of a limited data set in accordance with ¶ 3.10; or
11.2.1.1.9.
That occurred prior to the compliance date for the CE.
164.528(a)(2)    
11.2.1.2.
Suspension of right to accounting:
11.2.1.2.1
CE must temporarily suspend an individual's right to receive an accounting of disclosures to a health oversight agency or law enforcement official, as provided for in ¶ 11.2.1.1., for the time specified by such agency or official, if such agency or official provides the covered entity with a written statement that such an accounting to the individual would be reasonably likely to impede the agency's activities and specifying the time for which such a suspension is required.
11.2.1.2.2.
If the agency or official statement is made orally, the covered entity must: (i) document the statement, including the identity of the agency or official making the statement; (ii) temporarily suspend the individual's right to an accounting of disclosures subject to the statement; and (iii) limit the temporary suspension to no longer than 30 days from the date of the oral statement, unless a written statement pursuant to ¶ 11.2.1.2.1. is submitted during that time.
   
11.2.1.3.
An individual may request an accounting of disclosures for a period of time less than six years from the date of the request.
     
     

Table of Contents | Index | HIPAA Statewide Project