Under HIPAA, a “disclosure accounting” is required:

Under HIPAA, a “disclosure accounting” is required:

A. For all research where the data crosses state lines, otherwise state law applies.

B. For all human subjects research that uses PHI without an authorization from the data subject, except for limited data sets.

C. Solely at the principal investigator’s discretion.

D. For all human subjects research that uses PHI.

Answer: B. For all human subjects research that uses PHI without an authorization from the data subject, except for limited data sets.

According to the HIPAA, a ‘disclosure accounting’ is a report of disclosures of the PHI by a covered entity. The following accounting is done whenever the PHI discloses the individual’s information for research purposes and without the individual’s approval aside from in the case of a limited data set. This requirement is aimed at increasing the amount of accountability and enabling people to find out how their health information has been used.

For instance, a hospital that enrolls in a study to assess the effectiveness of a new therapy for heart disease and utilizes patients’ records without obtaining further consent from the subjects would be required to provide a disclosure accounting record. This would entail information such as the date of disclosure, the description of the disclosed PHI, the use for which the PHI was disclosed and to whom.

However, if the same study utilized a restricted data set for example wherein data consisting of name, address, date of birth, and social security number among other characteristics is kept off, a disclosure accounting would not be necessary. This exception is made in a way that allows the conduct of the research but still provides for some measure of protection of the individual’s privacy.

Nonetheless, as it will be remembered disclosure accounting does not apply where there is individual authorization. For example, if the patients in a clinical trial are also asked to complete an authorization form that permits the use of the PHI for the clinical trial study, there would be no need to generate a disclosure accounting for those patients.

This rule pleads the research interests with the individual’s fair interest in how their PHI is utilized, giving an admissible basis to cases where PHI is used without consent.