HIPAA Policy for Accounting of Disclosures: Request Handling Procedures

Individual's Right to Accounting of Disclosures

You must provide an accounting of disclosures of a person’s Protected Health Information upon request. The right generally covers disclosures made in the six years prior to the request date and supports overall Privacy Rule Compliance.

Timeframe and scope

• Time window: Up to six years prior to the date you receive the request (no accounting is required for disclosures before your HIPAA compliance date).
• Scope: Include only disclosures, not internal uses or routine access events in Electronic Health Records.
• Requester: The individual or an authorized personal representative with verified identity/authority.

Required content of the accounting

• Date of each disclosure.
• Name of the recipient and, if known, address.
• Brief description of the PHI disclosed.
• Purpose of the disclosure or a copy of the written request that prompted it.

Form, format, and timing

• Provide the accounting in writing and, if requested and readily producible, in an electronic format.
• Deadline: Fulfill the request within 60 days. If needed, one 30‑day extension is allowed with a written notice explaining the delay and the expected completion date.

Temporary suspension

At the written request of a health oversight or law enforcement official, you must temporarily suspend providing an accounting if it would impede their activities. An oral suspension request may be honored for up to 30 days if you document the request and the requester’s identity.

Disclosures Included in Accounting

Record and report disclosures that are not excluded by the Privacy Rule. The following categories are commonly included in an Accounting of Disclosures.

Common categories to include

• Public health reporting (e.g., disease reporting, adverse events).
• Health Oversight Activities (audits, inspections, investigations, licensure actions).
• Judicial and administrative proceedings (court orders, subpoenas, when permitted).
• Law Enforcement Disclosures (e.g., locating a suspect, reporting certain injuries, or disclosures required by law).
• Disclosures about decedents to coroners, medical examiners, and funeral directors.
• Organ and tissue donation to procurement organizations.
• Research without authorization approved by an IRB or privacy board (not limited data sets).
• To avert a serious threat to health or safety, consistent with the rule.
• Workers’ compensation and similar programs as permitted by law.

What each entry must show

For each included disclosure, capture the required elements (date, recipient, PHI description, and purpose/request). For multiple recurring disclosures to the same recipient for a single purpose, you may summarize using the period, frequency, and the last disclosure date.

Disclosures Excluded from Accounting

Do not include the following, as they are excluded from the accounting requirement under the Privacy Rule.

Exclusion list

• Disclosures for treatment, payment, and health care operations.
• Disclosures to the individual about their own PHI.
• Incidental disclosures that occur as a byproduct of an otherwise permitted disclosure.
• Disclosures made pursuant to a valid authorization.
• Facility directory disclosures and disclosures to persons involved in the individual’s care or for notification purposes.
• National security and intelligence disclosures.
• Disclosures to correctional institutions or law enforcement regarding inmates, as permitted by the rule.
• Disclosures as part of a limited data set.
• Disclosures that occurred prior to your HIPAA compliance date.

Remember: Access events or user activity within Electronic Health Records are not disclosures and therefore are not part of the accounting.

Processing Requests for Accounting

Step‑by‑step workflow

1. Intake and verify: Record the request date; verify the requester’s identity and authority (including any personal representative status).
2. Clarify scope: Confirm the desired timeframe (up to six years) and any specific recipients or events the individual wants included.
3. Choose format: Ask whether the individual prefers paper or an electronic copy and provide it in the requested form if readily producible.
4. Search sources: Review disclosure logs, release‑of‑information systems, EHR outbound interfaces (eFax, HIE gateways), paper records, and any manual logs maintained by departments.
5. Coordinate with partners: Notify relevant departments and Business Associates to gather disclosures they made on your behalf.
6. Apply exclusions: Filter out disclosures that are excluded from accounting; confirm ambiguous cases with the privacy officer or legal counsel as needed.
7. Compile entries: For each included disclosure, capture the required elements; summarize recurring disclosures appropriately.
8. Check for suspensions: Determine whether any health oversight or law enforcement suspension is in effect and document the suspension parameters.
9. Quality review: Validate completeness and accuracy; ensure dates, recipients, and purposes are clear and consistent.
10. Deliver and explain: Provide the accounting within 60 days (or with a documented 30‑day extension). Include a plain‑language cover note explaining what is and is not included.
11. Document the outcome: Log the request, response date, content provided, and any fees charged. Retain this documentation per your retention rules.

Good practices

• Use standardized templates to ensure each disclosure entry contains all required elements.
• Train staff to distinguish routine EHR access from actual disclosures leaving the organization.
• Maintain a single enterprise disclosure log to streamline reporting and support Privacy Rule Compliance.

Fees for Accounting Requests

The first accounting provided to an individual in any 12‑month period is free. For additional requests within the same 12‑month window, you may charge a reasonable, Cost-Based Fee after giving advance notice and the option to modify or withdraw the request.

Determining a Cost‑Based Fee

• Labor: Time spent locating, compiling, reviewing, and preparing the accounting.
• Supplies: Paper, media (e.g., encrypted USB), and copying costs if a physical copy is requested.
• Postage: Actual mailing or secure delivery expenses.

Before charging, provide an estimate and allow the individual to narrow the timeframe, recipients, or format to reduce costs. Consider waiving fees for hardship or minimal‑effort requests.

Documentation Retention

Maintain policies, procedures, and all documentation related to Accounting of Disclosures for six years from the later of creation or last effective date. This supports audit readiness and consistent Privacy Rule Compliance.

Records to retain

• Requests for accounting and responses provided, including dates and formats.
• Disclosure logs and supporting source records.
• Notices of fee estimates and any fees charged or waived.
• Written or documented oral suspension requests from health oversight or law enforcement officials.
• Business Associate reports contributing to the accounting.

Use secure repositories and role‑based access controls. Periodically reconcile logs across departments and Electronic Health Records to ensure completeness.

Business Associate Responsibilities

Business Associates must help you fulfill accounting requests for disclosures they make on your behalf. Your Business Associate Agreement should clearly require cooperation and timely data sharing to meet regulatory deadlines.

Contractual expectations

• Maintain a log of all qualifying disclosures of PHI made on your behalf, with the required data elements.
• Flow down the same obligations to subcontractors handling PHI.
• Retain disclosure records for at least six years.
• Provide information promptly in the format you specify so you can meet the 60‑day deadline (or documented 30‑day extension).

Operational support

• Designate contacts for privacy inquiries and escalation.
• Use secure transmission methods when returning disclosure details.
• Flag any potential suspension requests from law enforcement or oversight agencies and relay them immediately.
• Coordinate on system mappings so that outbound interfaces from Electronic Health Records are properly logged.

FAQs

What is the time frame covered for accounting disclosures?

The accounting covers disclosures made in the six years prior to the date you receive the request, excluding disclosures that are not subject to accounting. An individual may ask for a shorter period, and you should honor that narrower scope.

How are fees determined for multiple requests?

The first accounting you provide to an individual in any 12‑month period is free. For additional requests in the same 12 months, you may charge a reasonable, Cost-Based Fee reflecting labor, supplies, and postage, after giving advance notice and a chance to modify or withdraw the request.

What disclosures can be excluded from accounting?

Exclude disclosures for treatment, payment, and health care operations; to the individual; incidental disclosures; those made under an authorization; facility directory and persons involved in care; national security and intelligence disclosures; certain correctional/inmate disclosures to law enforcement; limited data sets; and disclosures before your HIPAA compliance date.

How should business associates assist with accounting requests?

Business associates must maintain logs of qualifying disclosures of PHI they make for you and promptly provide the required details so you can meet deadlines. They must flow down these duties to subcontractors, retain records for six years, and use secure methods when transmitting information back to you.