1. Are covered entities required to document incidental disclosures permitted by the HIPAA Privacy Rule, in an accounting of disclosures provided to an individual?
2. Does the HIPAA Privacy Rule require a business associate to provide individuals with access to their protected health information or an accounting of disclosures, or an opportunity to amend protected health information?
3. Does the HIPAA Privacy Rule require that covered entities document all oral communications?
4. What are the obligations of a health care provider if a patient asks for an accounting of how his health information has been used or disclosed?
5. What information must a health care provider include in an accounting?
6. In the accounting, are health care providers required to include disclosures made to law enforcement and/or health oversight agencies?
7. In an accounting, must health care providers give details of every disclosure when there are multiple disclosures of the same entity for a single purpose?
8. Are health care providers responsible for including in the accounting disclosures made by those outside our organization?
9. Are there any requirements for how quickly health care providers must act on a request for an accounting?
10. Can health care providers charge the patient for preparing an accounting?
11. What documentation is required to be prepared and retained regarding the right to an accounting?
12. Must health care providers always provide an accounting for all disclosures for six years?
13. Are health care providers required to maintain some type of registry of all disclosures that would be included in an accounting?
14. Does the accounting need to include disclosures relating to computer upgrades when protected health information is disclosed to another entity solely for the purpose of establishing or checking a computer system?
15. Can health care providers ask patients to waive their right to an accounting of the disclosures of their information?