45 CFR 164.528 — HIPAA Privacy Rule: Accounting of disclosures of protected health information

What this rule requires your agency to do

• 1A covered entity may use the abbreviated multiple-disclosure format for repeated disclosures to the same recipient for a single purpose, as specified (§ 164.528(b)(3)).(45 CFR 164.528 — HIPAA Privacy Rule: Accounting of disclosures of protected health information)
• 2For each disclosure, the accounting must include the date, the recipient's name/address, a brief description of the PHI disclosed, and a brief statement of the purpose (or a copy of the written request) (§ 164.528(b)(2)).(45 CFR 164.528 — HIPAA Privacy Rule: Accounting of disclosures of protected health information)
• 3A covered entity may use the abbreviated research-disclosure format when PHI was disclosed for research for 50 or more individuals, and must assist the individual in contacting the researcher when reasonably likely applicable (§ 164.528(b)(4)).(45 CFR 164.528 — HIPAA Privacy Rule: Accounting of disclosures of protected health information)
• 4A covered entity must provide the first accounting in any 12-month period without charge and may impose a reasonable, cost-based fee for subsequent requests only after informing the individual and offering an opportunity to withdraw or modify; and must document the accounting information, the written accounting provided, and responsible persons/offices (§ 164.528(c)(2), (d)).(45 CFR 164.528 — HIPAA Privacy Rule: Accounting of disclosures of protected health information)
• 5A covered entity must temporarily suspend the accounting right for disclosures to a health oversight agency or law enforcement official when that agency/official provides a qualifying written statement, and must document and limit oral requests to 30 days (§ 164.528(a)(2)).(45 CFR 164.528 — HIPAA Privacy Rule: Accounting of disclosures of protected health information)
• 6A covered entity must, on request, provide an individual an accounting of disclosures of their PHI made in the six years prior to the request, except for the nine enumerated categories of exempt disclosures (§ 164.528(a)(1)).(45 CFR 164.528 — HIPAA Privacy Rule: Accounting of disclosures of protected health information)
• 7A covered entity must provide a written accounting covering the applicable period and including disclosures by its business associates (§ 164.528(b)(1)).(45 CFR 164.528 — HIPAA Privacy Rule: Accounting of disclosures of protected health information)
• 8A covered entity must act on an accounting request within 60 days, with a single permitted 30-day extension supported by written notice of the reasons and provision date (§ 164.528(c)(1)).(45 CFR 164.528 — HIPAA Privacy Rule: Accounting of disclosures of protected health information)