 |  |  |  |  |  |  |  |  |  |  |  |  |
| • | Patients have the right to request an | |
| accounting of disclosures of their PHI for past |
| six years. | |
|
| • | Applies to disclosure of PHI pursuant to a | |
| waiver of authorization, disclosures required | |
| by law, and for public health purposes. | |
|
| • | Does not apply to disclosures pursuant to an | |
| authorization or to limited data set. | |
|
| • | The Privacy Office, not the IRB, will maintain | |
| a centralized database to track disclosures. | |
| This tracking requirement is the responsibility | |
| of the PI in conjunction with the Privacy | |
| Office. | |