The Department of Health and Human Services (HHS), despite a health industry outcry, has forwarded to the Office of Management and Budget (OMB) a proposed rule allowing patients to request information about the disclosure of their protected health information (PHI).

An OMB review can take anywhere from one to 90 days to complete. After that, the rule generally takes effect in 30 to 60 days.

The rule will require those maintaining electronic health records (EHRs) to make available an accounting of the entities with which it has shared individuals' PHI when the individuals so request the information.

The rule thus implements a change contained in the HITECH (Health Information Technology for Economic and Clinical Health) Act. Prior to HITECH, the prevailing law—HIPAA, or Health Insurance Portability and Accountability Act—did not require such disclosure. HITECH amends and expands HIPAA.