Purpose: Provide a single source of truth for all PHI disclosures that fall outside Treatment, Payment, and Operations (TPO). Captures the who/what/when/why/how for each disclosure, links supporting artifacts, and generates patient-ready and regulator-ready reports on demand.
When It Applies
- Legal requests (subpoenas, court orders) and law enforcement.
- Public health, research with waiver/authorization, and special authorizations.
- Any non-TPO disclosure requiring accounting under HIPAA.
Workflow
- Intake: Log requester (person/org), authority (authorization, subpoena, etc.), dates, and requested PHI categories.
- Review & Approval: Validate legal basis and scope (Minimum Necessary); route to Privacy/Legal as needed.
- Fulfillment: Record released artifacts (documents, extracts), delivery channel, and recipient confirmation.
- Accounting Entry: Persist structured entry with identifiers, purpose, scope, and proof-of-release.
- Close & Retain: Attach evidence bundle; apply retention and legal hold policies.
Patient & Regulator Reporting
- Patient Accounting Report: Time-bounded, plain-language summary of disclosures with date, recipient, description, and purpose.
- Regulator/OCR Packet: Exportable ledger with supporting artifacts, policy references, and approvals.
- Configurable exclusions/notes as permitted by law (e.g., research suspensions, law-enforcement limitations).
Governance & Compliance
- Maps to HIPAA Accounting of Disclosures requirements; enforces Minimum Necessary and consent checks.
- Immutable audit trail (who created, reviewed, fulfilled, and amended each entry).
- Timers/SLAs for response windows and reporting requests; exception handling with approvals.
Integration
- Integrates with ROI Request Manager for fulfillment and document packaging.
- Checks Consent & TPO Governor and Minimum Necessary Policy Enforcer before release.
- Ingests events from Audit Event Hub to validate date ranges and record provenance.
- Publishes patient reports to portal delivery or secure mail; supports e-sign and certified mail proofs.
Dashboards & Analytics
- Disclosure volumes by purpose, recipient type, department, and PHI category.
- Aging/overdue requests and bottlenecks (awaiting approval, awaiting artifacts, ready to send).
- Trend analysis for recurring recipients and high-risk categories.
Value
- Defensibility: Clear evidence chain for every non-TPO disclosure.
- Transparency: Patient-ready accounting report with minimal manual effort.
- Operational Control: Fewer ad-hoc processes; consistent approvals and artifacts.