Do investigators need to keep a list or log of all disclosures of PHI?
The Privacy Rule gives individuals the right to request a list of disclosures of their PHI made over the last 6 years (starting April 14, 2003). This right does not apply to disclosures of PHI made with the individual’s authorization. However, it does apply to disclosures of PHI made pursuant to a waiver of the authorization requirement. That means that researchers who have been granted a waiver after 4/14/03 will need to keep track of any disclosures of PHI made pursuant to that waiver, during the research project. Remember that disclosure refers to sharing of information outside of the covered entity.
