On May 27, 2011, the Secretary of Health and Human Services posted a Notice of Proposed Rulemaking (“NPRM”) nominally implementing the HITECH Act’s requirement that covered entities and business associates provide individuals with an accounting of disclosures of their protected health information (“PHI”) for treatment, payment and health care operations through an electronic health record for the prior three (3) year period (“TPO Accounting”). In point of fact, the NPRM proposes a number of fundamental revisions to the HIPAA accounting requirements.

The NPRM divides the HIPAA accounting rights of individuals into two separate rights: the right to receive an “access report,” providing details regarding individuals and entities who have accessed an individual’s electronic health records (even where they are permitted to do so under HIPAA) and the right to receive a scaled back version of the current HIPAA accounting of disclosures. As described in the NPRM...