Preemption Analysis of Texas Laws Relating to the Privacy of Health ...

65 Fed. Reg. at 82744.
OCR also indicated that the accounting requirement is designed to provide a mechanism
to provide individuals a red flag that there may be a problem with their records that
justifies the filing of a complaint:
Id. at 82462.
The provision serves multiple purposes. It provides a means of
informing the individual as to which information has been sent to
which recipients. This information, in turn, enables individuals to
exercise certain other rights under the rule, such as the rights to
inspection and amendment, with greater precision and ease. The
accounting also allows individuals to monitor how covered entities
are complying with the rule. Though covered entities who
deliberately make disclosures in violation of the rule may be
unlikely to note such a breach in the accounting, other covered
entities may document inappropriate disclosures that they make out
of ignorance and not malfeasance. The accounting will enable the
individual to address such concerns with the covered entity.
The absence of an explicit records retention period in the Privacy Rule is exceedingly
difficult to reconcile with the enforcement rights of HHS and individual rights to a
meaningful accounting. In declining to adopt a retention period for the documents
underlying an accounting, HHS took note of variation in state retention laws, as well as
the cost to some entities of increasing the retention period. 65 Fed. Reg. 82743, 82749-
50. HHS declined to balance the financial burden of a records retention period against
the interests of enforcement and, more importantly, the interests of individual citizens in a
meaningful accounting of the disclosures of their protected health information. This
exercise was properly left to state legislatures. In sum, HIPAA’s six-year records
retention requirements expressly apply to certain records described in the Privacy Rule,
not to PHI generally. But a shorter state law retention period applied to a record or
documents containing PHI that has been disclosed, arguably would stand as an obstacle to
the right to an accounting of disclosures under HIPAA. Because the Task Force wishes to
alert the Legislature to instances in which a state law document retention or destruction
timetable may conflict with the ability of individuals to obtain a full accounting of
disclosures, it has classified such laws as “possibly contrary” under the second prong of
the definition.
5. Authorized Representatives
HIPAA 45 C.F.R. § 164.502(g) defines personal representatives as persons who have the
authority under applicable law to make health care decisions on behalf of adults or
emancipated minors, as well as parents, guardians or other persons acting in loco
parentis, who have the authority under applicable law to make health care decisions on
-14-