Organizational Policy on Tracking, and Right for an Accounting of, Disclosures from Research Records (Policy No. HIPAA 164.4)
Version 2 - Approved by DEF 1/19/07

Definitions

Disclosure means the release, transfer, provision of, access to, or the divulging in any manner of PHI to persons or entities outside of the Johns Hopkins Covered Entities and Related OHCA Participants.

HIPAA means the Health Insurance Portability and Accountability Act of 1996.

Individual means the person who is the subject of PHI.

Johns Hopkins Covered Entities and Related OHCA Participants -- see Johns Hopkins HIPAA website for HIPAA Forms/Policies Templates or http://www.insidehopkinsmedicine.org/hipaa/ohcan.cfm. 

Johns Hopkins means the Johns Hopkins University School of Medicine (JHU SOM).

Permitted General Disclosures For Which Tracking Is Required are any of the following:

1. Disclosures Required by Law
2. Disclosures for Public Health Activities
3. Disclosures About the Abuse or Neglect of Children or Vulnerable Adults
4. Disclosures for Health Oversight Activities
5. Disclosures for Judicial and Administrative Proceedings (subpoenas, court orders, etc.)
6. Disclosures for Law Enforcement Purposes
7. Disclosures About Decedents to Medical Examiners and Funeral Directors
8. Disclosures for Organ and Transplant Donation Purposes
9. Disclosures to Avert a Serious Threat to Health or Safety
10. Disclosures for Specialized Government Functions
11. Disclosures to the Secretary pursuant to HIPAA.

Permitted Research Disclosures For Which Tracking Is Required are any of the following:

1. Disclosures of Research PHI pursuant to an IRB/PB waiver of the authorization requirement
2. Disclosures of Research PHI on a decedent where no authorization on behalf of the individual has been obtained

PHI means protected health information, i.e., individually identifiable health information.

Privacy Regulations means the regulations promulgated by the Secretary of the Department of Health and Human Services to implement portions of HIPAA that concerns the confidentiality of health information, as amended from time to time; these regulations currently include 45 CFR §§ 160 and 164, subparts A and E.

Research PHI means PHI held as part of any research record of any of the Johns Hopkins Covered Entities and Related OHCA Participants.

Secretary means the Secretary of the federal Department of Health and Human Services.

It is the policy of Johns Hopkins to protect the privacy rights of all patients, health plan members, employees, students and donors; to maintain the confidentiality of patient information, health plan information, medical records, research information and business operations; and to comply with all applicable laws and regulations, including the Privacy Regulations under HIPAA.

Individuals have a right to receive an accounting of disclosures of their health information made by or through Johns Hopkins Covered Entities and Related OHCA Participants in the six years prior to the date on which the accounting is requested, except for the following (the “Tracking Exceptions”):

1. Disclosures for treatment, payment and health care operations;
2. Disclosures to the individual who is the subject of the health information or to their duly constituted patient representative;
3. Disclosures incident to an otherwise permitted or required use or disclosure;
4. Disclosures to parties the individual or their duly authorized patient representative authorized to receive health information (i.e., disclosures pursuant to an authorization);
5. Disclosures made to family members, other relatives or friends who are involved in the individual’s care, or who otherwise need to be notified of the individual’s location, general condition or death;
6. Disclosures for the facility’s directory;
7. Disclosures for national security or intelligence purposes;
8. Disclosures to correctional institutions or law enforcement custodial officials;
9. Disclosures as part of a limited data set;
10. Disclosures that occurred prior to the April 14, 2003.

Tracking Disclosures:

1. General

a. Certain disclosures of Research PHI must be “tracked.”  Therefore, except for disclosures that fall within the Tracking Exceptions (which include disclosures pursuant to HIPAA compliant authorizations), information on disclosures of Research PHI must be maintained.  The time period for maintaining such information is for the prior seven years, but no earlier than April 14, 2003.

b. There are two types of permitted disclosures of Research PHI that must be tracked.  They are “Permitted General Disclosures For Which Tracking Is Required” and “Permitted Research Disclosures For Which Tracking Is Required” (see definitions above). Different forms are available to track disclosures of Research PHI in these different situations.  Further, disclosures of Research PHI that are made by mistake or to the wrong person also must be tracked.  In those circumstances, the Johns Hopkins HIPAA Privacy Officer must be contacted immediately on discovery of such mistake.

c. Subject to the Tracking Exceptions (which include disclosures pursuant to HIPAA compliant authorizations), if Research PHI is disclosed to an entity which is NOT one of the Johns Hopkins Covered Entities and Related OHCA Participants, or a workforce member of one of the Johns Hopkins Covered Entities and Related OHCA Participants, as part of the research process (for example, when it is shared with a co-researcher at another study center or with the sponsor of the study), then such disclosure must be tracked for accounting of disclosures purposes.

d. Research PHI that has been obtained by a researcher from one of the  Johns Hopkins Covered Entities and Related OHCA Participants through a review preparatory to research is not to be removed from the covered entity (i.e., disclosed) by the researcher in the course of the review.  Therefore, the matter of tracking should not arise in a review preparatory to research.

e. The tracking of disclosures must be noted in the appropriate IRB databases.  [Currently, there are no such databases.  Therefore, until one or more is established, the tracking should be maintained in each protocol’s database.]  

f.   

(i) An individual’s right to receive an accounting of disclosures to a health oversight agency or law enforcement official will be temporarily suspended, for the time specified by such agency or official, if such agency or official provides Johns Hopkins with a written statement that such an accounting to the individual would be reasonably likely to impede the agency’s activities and specifying the time for which such a suspension is required.

(ii)  If the agency or official statement is made orally, Johns Hopkins will:

(a)  Document the statement, including the identity of the agency or official making the statement;

(b)  Temporarily suspend the individual’s right to an accounting of disclosures subject to the statement; and

(c)  Limit the temporary suspension to no longer than 30 days from the date of the oral statement, unless a written statement is submitted during that time.

2. Tracking Permitted General Disclosures For Which Tracking Is Required

a. The information to be maintained must include the following for each individual for each disclosure:

(i)  The date of the disclosure;

(ii) The external entity or person who received the PHI and their address (if known);

(iii) A brief description of the Research PHI disclosed; and

(iv) A brief statement of the purpose of the disclosure that reasonably identifies the basis for the disclosure or, in lieu of such statement, a copy of a written request for a disclosure  for Permitted General Disclosures For Which Tracking Is Required, if any.

b. HIPAA IRB Form 8.4  is to be used for the tracking of Permitted General Disclosures For Which Tracking Is Required.

3. Tracking Permitted Research Disclosures For Which Tracking Is Required

a. General Rule

(i)  Unless Subsection 3b or 3c applies, the information to be maintained must include the following for each individual for each disclosure:

(a) The date of the disclosure;

(b) The external entity or person who received the PHI and their address (if known);

(c) A brief description of the Research PHI disclosed; and

(d) A brief statement of the purpose of the disclosure that reasonably identifies the basis for the disclosure or, in lieu of such statement, a copy of a written request for a disclosure  for Permitted Research Disclosures For Which Tracking Is Required, if any.

(ii) HIPAA IRB Form 8.1  is to be used for the tracking of Permitted Research Disclosures For Which Tracking Is Required that come under this Subsection 3.a.

b.   Multiple Disclosures to the Same Person

(i)  Tracking for multiple disclosures of Research PHI to the same person or entity for a single purpose may be made by including the following:

(a)  The information described in subsection 3(a)(i) for the first disclosure during the tracking period;

(b) The frequency, periodicity or number of disclosures made during the tracking period; and

(c) The date of the last such disclosure during the tracking period.

(ii)  HIPAA IRB Form 8.2  is to be used for the Tracking of Permitted Research Disclosures For Which Tracking Is Required that come under this Subsection 3.b.

c. Disclosures About 50 or More Individuals

(i) Tracking for disclosures of Research PHI that is about 50 or more individuals and is made for a particular research purpose may be made by including the following:

(a) The name of the protocol or other research activity;

(b)  A description, in plain language, of the research protocol or other research activity,including the purpose of the research and the criteria for selecting particular records;

(c) A brief description of the type of Research PHI that was disclosed;

(d) The date or period of time during which such disclosures occurred, or may have occurred, including the date of the last such disclosure during the accounting period;

(e) The name, address, and telephone number of the entity that sponsored the research and of the researcher to whom the information was disclosed; and

(f)   A statement that the protected health information of the individual may or may not have been disclosed for a particular protocol or other research activity.

(ii)  HIPAA IRB Form 8.3 is to be used for the Tracking of Permitted Research Disclosures For Which Tracking Is Required that come under this Subsection 3.c.

(iii) If Johns Hopkins provides an accounting for research disclosures consistent with this Subsection 3.c, and if it is reasonably likely that the PHI of the individual was disclosed for such research protocol or activity, Johns Hopkins shall, at the request of the individual, assist in contacting the entity that sponsored the research and the researcher.

Requests for Accounting of Disclosures:

1. An individual may request an accounting of disclosures by completing a “Request for An Accounting of Disclosures of My Protected Health Information” form.
   
2. All requests for an accounting of disclosures received by a researcher must be forwarded promptly to the Johns Hopkins Privacy Officer who shall be responsible for coordinating and overseeing the response to the request.Requests for an accounting of disclosures shall be processed in accordance with Johns Hopkins HIPAA Policy A.6.4.