Most covered entities receive few requests for an accounting of disclosures. That is exactly why the first one is hard: the disclosures it must list left through reports, exports, portals and business associates over six years, and nobody was keeping one list.
This article summarizes what the HIPAA Privacy Rule requires under 45 CFR 164.528, as the regulation reads today, and describes where organizations typically struggle to answer. It is general information, not legal advice; the regulation itself is the authority [1].
The right in brief
An individual has a right to receive an accounting of disclosures of their protected health information made by a covered entity in the six years before the date of the request [1, (a)(1)]. The individual may ask for a shorter period [1, (a)(3)]. The accounting covers disclosures made by the covered entity’s business associates as well as its own: the rule speaks of disclosures “to or by business associates” [1, (b)(1)].
The accounting is a list of disclosures, meaning information released outside the entity, not internal uses. Most routine disclosures are excluded, which is why the remaining list tends to consist of the unusual ones: the very disclosures an individual is most likely to ask about.
What is excluded
Nine categories of disclosure do not have to be included [1, (a)(1)(i)–(ix)]:
| Excluded disclosure | In practice |
|---|---|
| To carry out treatment, payment and health care operations | Most day-to-day sharing with other providers, payers and for internal operations |
| To the individual about themselves | Copies and portal access given to the patient |
| Incident to a permitted use or disclosure | Incidental exposure, such as being overheard |
| Under the individual’s authorization | Anything the individual signed off on |
| For the facility directory, to people involved in care, or for notification | Family members and the directory |
| For national security or intelligence purposes | As defined in the rule |
| To correctional institutions or law enforcement with custody | Under 164.512(k)(5) |
| As part of a limited data set | Under a data use agreement |
| Before the compliance date | Historic disclosures |
Table 1. Disclosures excluded from the accounting, 45 CFR 164.528(a)(1).
What remains typically includes disclosures to public health authorities, health oversight agencies, courts and administrative proceedings, law enforcement outside the custody exception, coroners and medical examiners, research under a waiver of authorization, and to avert a serious threat. Because the exclusions cover disclosures that were permitted, a disclosure that was not permitted, such as one made in error, is not covered by them and belongs in the accounting too.
What each entry must contain
For each disclosure, the accounting must give four things [1, (b)(2)]:
- the date of the disclosure;
- the name of the entity or person who received it and, if known, their address;
- a brief description of the protected health information disclosed; and
- a brief statement of the purpose that reasonably informs the individual of the basis for the disclosure, or a copy of the written request for it.
Two simplifications are allowed. Where several disclosures were made to the same person or entity for a single purpose, the entry may give the full details of the first disclosure plus the frequency, periodicity or number of disclosures and the date of the last one [1, (b)(3)]. For research disclosures involving 50 or more individuals, the entity may instead list the protocols the individual’s information may have been disclosed for, with a description, the type of information, the date range, the sponsor and the researcher, and a statement that the information “may or may not have been disclosed” [1, (b)(4)].
Deadlines, fees and suspensions
- Response time. The entity must act no later than 60 days after receiving the request. It may extend once, by no more than 30 days, if within the 60 days it gives the individual a written statement of the reasons and the date it will respond [1, (c)(1)].
- Fees. The first accounting in any 12-month period is free. Later requests in that period may carry a reasonable, cost-based fee, provided the individual is told in advance and can withdraw or change the request [1, (c)(2)].
- Suspension. A health oversight agency or law enforcement official may ask the entity to suspend the individual’s right where an accounting would be reasonably likely to impede their activities. A written statement suspends it for the period it specifies; an oral statement must be documented, and the suspension then lasts no longer than 30 days unless a written statement follows [1, (a)(2)].
- Documentation. The entity must keep the information required for each entry, the written accountings it provided, and the titles of the persons or offices responsible for receiving and processing requests [1, (d)], for six years from creation or from when they were last in effect [2].
Where accounting breaks down
The regulation is short. The difficulty lies in where disclosures actually happen.
- Disclosures leave through many channels. A report emailed to a regulator, an export sent to a researcher, a file uploaded to a payer’s portal and a business associate’s own release can all be accountable, and each is usually logged, if at all, in a different system.
- Reports name people indirectly. A quality report or an audit extract may list patients by record number inside a table. Knowing that a person appears in a disclosed file requires tracing the file’s rows back to individuals at the time it is sent.
- Purpose is recorded as free text, if at all. Six years later, “per request” does not reasonably inform anyone. A short, controlled list of purposes, chosen at the time of release, makes entries consistent.
- Reconstruction is unreliable. Rebuilding a list from mailboxes and file shares after a request arrives is slow and incomplete. The accounting is only as good as what was recorded at the moment of disclosure.
- The log itself becomes sensitive. A register of who received which patients’ information is protected health information too. It needs the same access control, and ideally should hold identifiers in a form that can be matched to a request without being browsable.
Being ready to answer
- Inventory the channels through which information leaves: reports, exports, portals, email, file transfers and business associates.
- Decide, per channel, which disclosures are accountable, and record those at the moment they happen, with the four required elements.
- Make the purpose a choice from a maintained list rather than free text, with the regulatory basis attached.
- For files that contain many individuals, record which individuals each file concerns, in a form that can be searched by identifier but is not itself a readable list.
- Ask each business associate how it records its own disclosures and how it will report them to you within your 60 days.
- Run a mock request each year: pick an individual, produce the accounting, and time it.
Sources
- 45 CFR 164.528, Accounting of disclosures of protected health information. ecfr.gov
- 45 CFR 164.530(j), Documentation retention. ecfr.gov
- HHS, Request for Information on Modifying HIPAA Rules to Improve Coordinated Care, 83 FR 64302 (December 14, 2018). govinfo.gov