What Is an Accounting of Disclosures Under HIPAA?
Meta description: Learn what an accounting of disclosures is under HIPAA, which disclosures it covers, how to request one, and what covered entities must provide.
An accounting of disclosures is a record of certain times a health care provider, health plan, or other HIPAA-covered organization shared a person’s protected health information (PHI). It helps patients see when information was disclosed, to whom, and for what purpose. The right is not a complete history of every use or sharing of medical information: HIPAA excludes several common categories, including many disclosures for treatment, payment, and health care operations. Knowing what the accounting includes—and how to request it—can help people make a more informed privacy inquiry.
What an Accounting of Disclosures Means
Under the Health Insurance Portability and Accountability Act (HIPAA), an accounting of disclosures is a list of certain disclosures of an individual’s PHI made by a covered entity or, in some circumstances, its business associates. PHI generally means individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium.
The accounting right is set out in the HIPAA Privacy Rule at 45 C.F.R. § 164.528. It is designed to give individuals information about specified disclosures—not to provide a complete audit log of every person who viewed a medical record or every internal use of information.
For example, a disclosure to a public health agency that is required by law may generally be included. A doctor’s use of information to treat a patient, by contrast, is generally excluded from the accounting requirement. Whether a particular event is reportable depends on the nature and purpose of the disclosure and whether an exception applies.
Who Can Request an Accounting
An individual has the right to request an accounting from a HIPAA-covered health plan or health care provider, and from certain other covered entities. A person’s legally authorized personal representative may generally exercise the individual’s HIPAA rights, subject to applicable law and the covered entity’s verification procedures.
A covered entity may need information from a business associate to prepare the accounting. Business associates are organizations that perform certain functions or services involving PHI on behalf of a covered entity. Their contracts are generally required to address support for the covered entity’s obligations, including providing information needed for an accounting when applicable.
A request is different from asking for a copy of medical records. Individuals generally have a separate HIPAA right to inspect or obtain copies of PHI in a designated record set. An accounting instead reports certain disclosures covered by the Privacy Rule. A person may choose to request both, but one request does not automatically provide the other.
Which Disclosures Are Generally Included
An accounting generally covers disclosures of PHI made during the six years before the request, unless the individual asks for a shorter period. The six-year period is a maximum under the federal rule, not a requirement to list every disclosure during that entire time. Only disclosures within the rule’s scope need to be reported.
Examples of disclosures that may be included, depending on the circumstances, include:
- Disclosures required by law, such as certain legally mandated public health reports.
- Disclosures for public health activities, including certain reports to authorized public health authorities.
- Disclosures related to judicial or administrative proceedings, when made under the conditions permitted by HIPAA.
- Disclosures to law enforcement that meet the Privacy Rule’s requirements.
- Disclosures for certain research when PHI is used or disclosed without the individual’s authorization under applicable HIPAA provisions.
- Disclosures about decedents to coroners, medical examiners, or funeral directors when permitted by the rule.
- Disclosures for certain government functions, such as specified military, national security, or correctional institution purposes.
- Other disclosures that are not excluded and are not made pursuant to the individual’s written authorization.
These are examples, not a guarantee that every disclosure in a category will appear. HIPAA’s conditions and exceptions apply, and other federal or state laws may impose different requirements.
Which Disclosures Are Usually Excluded
HIPAA expressly excludes several categories from the accounting right. This is why an accounting should not be treated as a full history of all activity involving a person’s health information.
| Disclosure category | Typical example | Why it is generally excluded |
|---|---|---|
| Treatment, payment, and health care operations | A provider shares relevant records with another provider involved in treatment, or a plan uses information for payment. | The Privacy Rule generally excludes these routine purposes from an accounting. |
| Disclosure to the individual | A provider sends a person their own test results. | Sharing information with the person who is its subject is not included. |
| Disclosure made under a valid authorization | A patient signs a HIPAA authorization for information to be sent to a third party. | Authorized disclosures are generally excluded from the accounting requirement. |
| Incidental disclosure | A limited, unintended exposure occurs despite reasonable safeguards. | Qualifying incidental disclosures are excluded under the rule. |
| Facility directory disclosure | Permitted directory information is shared with a caller who asks for a patient by name. | Qualifying disclosures for facility directories are excluded. |
| Limited data set disclosure | Information is shared for research or health care operations under a data use agreement. | Disclosures of a limited data set are excluded. |
Other exceptions include certain disclosures for national security or intelligence purposes, to correctional institutions or law enforcement officials having lawful custody of an individual, and disclosures made as part of a restricted data set under HIPAA’s specified conditions. The details matter: a disclosure is not exempt simply because it involves a government agency, a researcher, or a law enforcement request.
Many ordinary clinical exchanges fall under treatment, payment, or health care operations. Consequently, an accounting may not show routine referrals, claims processing, care coordination, or internal operational uses. Separate access logs or other records may exist, but HIPAA’s accounting provision does not require them to be listed when the relevant exclusion applies.
What Information the Accounting Must Provide
For each reportable disclosure, the accounting generally includes the disclosure date, the name of the person or organization that received the PHI and, if known, that recipient’s address, a brief description of the information disclosed, and a brief statement of the purpose of the disclosure. The purpose may refer to the relevant legal basis or to a written request from the recipient when applicable.
If the individual asks, the covered entity must provide a copy of the written request for disclosure, subject to the rule’s requirements. The accounting is meant to identify the disclosure and its context; it does not necessarily include a copy of all records sent or every related communication.
When multiple disclosures are made to the same recipient for the same purpose under a particular provision of the Privacy Rule, the covered entity may be able to provide a summary rather than a separate entry for each disclosure. The summary must give the required information, including the frequency or number of disclosures and the dates of the disclosures, as applicable under the rule.
How to Request an Accounting of Disclosures
A person can contact the covered entity’s privacy office, medical records department, or health plan member services department and ask for its process. HIPAA does not require every covered entity to use the same form. Some organizations provide a request form, while others accept a written request that identifies the person and the period sought.
- Identify the organization. Direct the request to the provider or health plan that may have made the disclosures.
- State the date range. Specify a period of up to six years before the request date. A shorter period may make the response more focused.
- Describe the requested accounting. Ask for an accounting of disclosures of the individual’s PHI under HIPAA’s Privacy Rule.
- Complete identity verification. The organization may use reasonable procedures to confirm the requester’s identity and authority.
- Keep a copy. Retain the request and any confirmation or response for personal records.
A request can be limited to a particular provider, facility, or plan. If the person wants information from several organizations, separate requests may be needed because each covered entity is responsible for its own response.
Response Deadlines and Fees
A covered entity generally must act on an accounting request within 60 days. If it cannot meet that deadline, it may take one extension of up to 30 additional days. The organization must give the individual a written statement explaining the reason for the delay and the date by which it expects to respond.
The first accounting provided to an individual during any 12-month period must be free. A covered entity may charge a reasonable, cost-based fee for additional accountings requested by the same person within that period, but it must tell the individual the fee in advance. The person must then have an opportunity to withdraw or modify the request to avoid or reduce the charge.
HIPAA permits a covered entity to establish reasonable procedures for handling requests, but those procedures cannot create an unreasonable barrier to exercising the right. For example, an organization should not treat a request as denied simply because an individual did not use a particular form if the request otherwise meets applicable requirements.
Limits, Special Rules, and Electronic Health Records
The accounting usually reaches back no more than six years from the date of the request. It does not include disclosures made before the HIPAA compliance date applicable to the covered entity. The rule also permits certain temporary suspensions of an individual’s right to receive information about specific disclosures when a law enforcement or health oversight agency requests the suspension under applicable conditions. The individual must receive notice when the suspension ends, as required by the rule.
Federal law has addressed accounting for some disclosures made through electronic health records (EHRs). The HITECH Act provided for a broader accounting approach for certain EHR disclosures, including disclosures related to treatment, payment, and health care operations. However, implementation has depended on regulatory requirements. The HIPAA Privacy Rule’s current accounting provision continues to exclude those routine categories. Because rules and implementation details can change, individuals and organizations should check current guidance from the U.S. Department of Health and Human Services (HHS).
What to Do If a Request Is Delayed or Denied
If an organization does not respond within the required time, or the response appears incomplete, the individual can first contact its privacy officer and ask for an explanation. It may help to confirm the date the request was received, the period requested, and whether the organization believes a specific exception applies.
For concerns about a possible HIPAA violation, an individual may file a complaint with the covered entity or business associate, or with the HHS Office for Civil Rights (OCR). OCR explains how to submit a complaint and the applicable time limits. State privacy laws may provide additional rights or remedies, so requirements can vary by location.
Why the Accounting Matters—and What It Cannot Show
An accounting can offer useful visibility into certain external disclosures, particularly those made for purposes such as public health, law enforcement, or legal proceedings. It can help a person ask informed follow-up questions about who received information and why. It may also help organizations identify gaps in disclosure documentation and strengthen privacy practices.
At the same time, an accounting is not a complete medical-record access log. It generally will not list routine treatment, payment, and health care operations disclosures, disclosures made under the person’s authorization, or other excluded categories. Anyone seeking a complete copy of their medical information should consider making a separate records-access request, while recognizing that HIPAA access rights have their own scope, deadlines, and exceptions.
Key Takeaways
- An accounting of disclosures is a HIPAA-required list of certain disclosures of an individual’s PHI.
- It generally covers up to six years before the request, subject to applicable limits and exceptions.
- Routine treatment, payment, and health care operations disclosures are generally excluded.
- A covered entity usually has 60 days to respond and may take one properly explained 30-day extension.
- The first accounting in a 12-month period is free; a reasonable cost-based fee may apply to additional requests.
- An accounting is different from a request for copies of medical records and does not show every use or access.
Authoritative references: HIPAA Privacy Rule, 45 C.F.R. § 164.528; HHS guidance on individuals’ access to health information; and the HHS Office for Civil Rights complaint process.