The U.S. Department of Health and Human Services ("HHS") has announced a Notice of Proposed Rulemaking concerning the disclosure requirements under the HIPAA Privacy Rule. The proposed rule would give individuals the right to obtain a report on persons who have electronically accessed the individual’s protected health information ("PHI"). HHS issued the proposed rule pursuant to the Health Information Technology for Economic and Clinical Health ("HITECH") Act.
Under the proposed rule, individuals would be able to request an access report, which would document the particular persons who electronically accessed and viewed their PHI. Currently, covered entities are only required to track access to electronic PHI. However, they are not required to share this information with individuals. The proposed rule also requires covered entities to modify their privacy notices in order to inform individuals that they have the right to obtain an access report from such covered entity.