Page, Wolfberg & Wirth is a law firm that represents more than 1,000 ambulance services and emergency medical services agencies. "HHS believes that covered entities are already tracking every instance when electronic PHI is accessed under the HIPAA security rule. The rule does not mandate constant access tracking not does it provide specific details on the technology or methods that must be used to monitor access to ePHIs. Current systems are geared to track only a limited number of disclosures to comply with the current accounting standard. The proposed rule would require upgrading and/or reconfiguration of most current software systems."
IMS Health provides information services for the healthcare industry. In its comment letter IMS expressed concerns about the access report concept. "While the access report may satisfy patient curiosity regarding who might have touched his or her medical records, it's certainly not the best means for a patient to determine if someone inappropriately accessed his or her records. Many covered entities put alerts on patient files when there is some suspicion of inappropriate access, and this would seem to satisfy any requisite investigational needs and remediation efforts. Further, regulations that specifically address the particular issue of suspected inappropriate access would be more appropriate than what is proposed."
Brigham and Women's Hospital in Boston is a major medical research facility. In its comment letter the hospital voiced support for excluding research from the required access disclosures citing the difficulty of collecting that information because "unlike other types of institutional records, research records often are not maintained in a central, electronic system. Typically they are maintained by individual investigators in a manner specific to the nature and requirements of the protocol."