Skip to main content
University of Florida

Accounting for Disclosures

The HIPAA Privacy Rule gives individuals the right to receive a written report (an accounting) when a covered entity has made certain disclosures of an individual’s protected health information (PHI). 

A “disclosure” usually occurs when PHI is shared with a person or organization outside of UF/ UF Health. There are many types of disclosures that do not have to be tracked, and the training module further below describes this in greater detail. 

General Information 

  • If your unit uses EPIC as its electronic health record (EHR), the accounting of the disclosure of PHI should be documented in Epic. Below are instructions about how to record or track an Accounting.
    • Open the Quick Disclosure activity by opening a patient’s chart from Patient Lists or from the Schedule, clicking More Activities, and selecting Quick Disclosure from the menu. Once completed, the Quick Disclosure window shown below will open.
    • To record a disclosure in Epic:
      • In the Purpose field, select the reason for the release.
      • In the Info released field, select the type of information that was
      • Indicate who the information was released to, and fill in the Name and Address
      • Indicate whether you received an For example, if a patient requests her immunization records and provides a medical record release form, you would click Yes.
      • If necessary, add a comment to provide further
      • Click Accept.
  • Areas that do not use Epic may use UF’s web-based Disclosure Tracking System (DTS) to record or “account” for certain disclosures.
  • Each UF patient care area should designate least two people as DTS users.
  • Clinic manages should review the training guide with staff to ensure disclosures are accounted for. 

How to Become a DTS User 

  1. View the Disclosure Tracking & Accounting (PPTX 6.8MB) module.
  2. Complete a brief Application for Access (DOCX 31.7KB) form and email it to either IAM-SHANDS-IDM-L@LISTS.UFL.EDU (for UF Health employees) or your Information Security Manager (you can locate your ISM with the help of this site).
  3. Approval should occur quickly, and approved DTS Users can access the system using their GatorLink credentials.