On May 31, the U.S. Department of Health and Human Services (HHS) released a notice of proposed rulemaking (Proposed Rule) creating a new requirement that covered entities produce an “access report” informing individuals of all persons who have viewed their records, while also modifying existing accounting of disclosures rules under the Health Insurance and Portability and Accountability Act of 1996 (HIPAA). 76 Fed. Reg. 31426 (May 31, 2011). The Proposed Rule would impose significant new obligations on all healthcare provider and health plan covered entities, including employer group health plans.

Right to an Access Report

Under the Proposed Rule, covered entities would be required to provide individuals with an “access report,” identifying all persons who have accessed an individual’s electronic “designated record set” information. The designated record set is the group of records maintained by or for a covered entity that is either (1) used, in whole or part, to make decisions about individuals; (2) a provider’s medical and billing records; or (3) enrollment, payment, claims, adjudication, and case or medical management record systems maintained by or for a health plan. This new access right does not extend to paper records.

The new access right is based in part on a requirement established by the Health Information Technology for Economic and Clinical Health Act (HITECH) providing individuals with information about disclosures through an electronic health record (EHR) for treatment, payment, and healthcare operations. The Proposed Rule modifies the HITECH provision in two significant ways:

- First, the Proposed Rule provides an individual with the right to be informed of all persons who have accessed their record, regardless of whether the information was actually disclosed to someone outside of the covered entity’s workforce.