The Office for Civil Rights (OCR) recently announced that the proposed rule on accounting for disclosures, required by the HITECH Act, will not be finalized soon but will be delayed until 2015. On May 31, 2011, OCR issued a proposed rule granting a new right for individuals to obtain a listing of who has accessed the individual’s protected health information (PHI). The right to access would apply to any PHI in an electronic designated record set, even if the electronic designated record set is not considered part of an electronic medical record. Under the current regulation on accounting of disclosures, covered entities must account for (keep track of ) disclosures of PHI made outside of the covered entity holding the PHI; however no accounting is required for disclosures for treatment, payment or health care operations purposes. In addition to the current regulation, the proposed rule would require covered entities to keep track of all electronic access to PHI by members of the workforce within the covered entity, even if the access was for purposes of treatment, payment, or health care operations. Business associates would also be required to comply with the new rule through business associate agreements.

OCR recently announced that instead of finalizing the proposed rule on accounting of disclosures, it will seek a second round of public comments on this proposed rule. Under HITECH this new rule was supposed to be in effect by Jan. 1, 2014. OCR’s announcement indicates that it will likely be 2015 before any new rule on accounting of disclosures will be finalized.