Under HIPAA, a 'disclosure accounting' is required:

Under HIPAA, a 'disclosure accounting' is required:

• A. For all PHI uses, even with authorization.
• B. For limited data sets only.
• C. For all PHI uses without authorization, except for limited data sets.
• D. Only for disclosures to researchers.

Answer: (C)

Under HIPAA, individuals have a right to an accounting of disclosures of their PHI. This means covered entities must tell the person about disclosures of their information that occur outside the allowed, authorized uses, so they can know who has seen their data and for what purpose. The important nuance is that most disclosures made without a valid authorization must be documented and disclosed in the accounting, but there is an important exception: disclosures that involve a limited data set are not required to be included in the accounting. A limited data set has identifiers removed to reduce privacy risk and can be used for things like research under a data use agreement, so it isn’t covered by the accounting requirement. So the best choice reflects that the accounting is required for disclosures of PHI without authorization, with the exception of limited data sets. The other options aren’t correct because disclosures with authorization aren’t subject to the accounting, and the requirement isn’t limited only to disclosures to researchers.

Under HIPAA, individuals have a right to an accounting of disclosures of their PHI. This means covered entities must tell the person about disclosures of their information that occur outside the allowed, authorized uses, so they can know who has seen their data and for what purpose. The important nuance is that most disclosures made without a valid authorization must be documented and disclosed in the accounting, but there is an important exception: disclosures that involve a limited data set are not required to be included in the accounting. A limited data set has identifiers removed to reduce privacy risk and can be used for things like research under a data use agreement, so it isn’t covered by the accounting requirement.

So the best choice reflects that the accounting is required for disclosures of PHI without authorization, with the exception of limited data sets. The other options aren’t correct because disclosures with authorization aren’t subject to the accounting, and the requirement isn’t limited only to disclosures to researchers.