On May 27, 2011, the U.S. Department of Health and Human Services (“HHS”) issued a notice of proposed rulemaking (the “NPRM”) to modify the accounting of disclosures provision of the Health Information Portability and Accountability Act’s (“HIPAA”) Privacy Rule (the “Privacy Rule”).

In addition to amending the Privacy Rule’s existing accounting requirement, the NPRM implements and expands a provision of the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”) that requires HIPAA-covered entities (“CEs”) and their business associates (“BAs”) to account for disclosures of protected health information (“PHI”) to carry out treatment, payment, and health care operations (“TPO”) if such disclosures are made through an electronic health record (“EHR”).