Q: We are required to report information, including patient account numbers and diagnosis codes, to our state tumor registry. Must we enter each patient’s name into a database to track these as accountable disclosures?
A: Account numbers reported to the state are considered patient-identifiable information. Therefore, you must include them in an accounting of disclosures in response to patient requests. Entering each disclosure into a database is probably not worth the effort. Most healthcare organizations receive very few requests for accounting, so researching individual cases takes less time than entering every case into a database for tracking.
When patients request an accounting, simply review their records to determine whether diagnoses include those that would have been reported to the state tumor registry.
Editor’s note: Mary D. Brandt, MBA, RHIA, CHE, CHPS, answered this question for the HIPAA Update  blog. Advice given is general. Readers should consult professional counsel for specific legal, ethical, or clinical questions.