Policy Statement: An Individual has the right to request an accounting of disclosures as required by the HIPAA Rules.
Participant Requirements
Each Participant shall comply with the HIPAA Rules and is responsible to meet its obligations to provide Individuals with an accounting of disclosures and uses of individual health information through an electronic health record.
NDHIN Requirements
North Dakota Health Information Network (NDHIN) must maintain an audit log documenting which Participants and Authorized Users accessed or disclosed health information about an Individual through the NDHIN that are not excluded from the requirements for an accounting for disclosure under 45 C.F.R § 164.528.
If a request for an accounting for disclosure is delivered directly to NDHIN, the NDHIN will transmit the request to the Participant-Covered Entity, i.e., the hospital, clinic, or individual health care provider, that has provided health care services to the individual requesting the accounting within five (5) calendar days as required by Section 2(h) of the NDHIN Business Associate Agreement. If requested by a Participant, make available to the Participant as required by Section 2(h) of the NDHIN Business Associate Agreement, the information the NDHIN is required to provide to the Covered Entity (Participant) as necessary to satisfy Covered Entity's obligations for an accounting for disclosure under 45 C.F.R. § 164.528.
NDHIN will not charge a fee for the first request by a Participant for records needed for an accounting regarding an individual within a calendar year but may charge a reasonable and cost-based fee for providing an additional records for an accounting regarding the same individual within the same calendar year. If a fee will be required, NDHIN must inform the Participant, or the Individual, if the accounting is sent directly to the Individual, at the time of the request.