Research · 11 min read
What a List of Who Received Your Records Leaves Out
There is a federal right to be given a record of where your health information went. Nine categories are carved out of it, and between them they cover most of the reasons information moves at all.
Key takeaways
- The accounting covers disclosures in the six years before the request, and you may ask for a shorter period.
- Nine categories are excluded, including treatment, payment and health care operations, and anything made under an authorization.
- Each entry carries a date, a named recipient with an address if known, a description of the information, and a purpose or a copy of the request.
- Repeat disclosures for one purpose may be summarized, and research disclosures covering fifty or more people may be described by protocol.
- A health oversight agency or law enforcement official may have the accounting suspended by a written statement that it would impede its activities.
- Sixty days to respond, one thirty-day extension with written reasons, and one free accounting in any twelve-month period.
Answer first: the log records the exceptions
The privacy rule gives an individual a right to receive an accounting of disclosures. It reads like a complete audit trail and it is not one.
The right is stated in one sentence, then followed immediately by nine exceptions.
Those exceptions remove treatment, payment and health care operations, anything done under an authorization, disclosures to you, incidental disclosures, and several more.
What is left is real and useful. It is also, by construction, the unusual traffic rather than the ordinary kind.
The right, and the window it covers
An individual has a right to receive an accounting of disclosures made by a covered entity in the six years before the date the accounting is requested.
Six years is a ceiling rather than a fixed period. The rule expressly allows a request for a shorter span.
The accounting has to include disclosures to or by business associates of the entity, which is the clause that reaches companies you have never dealt with directly.
It also excludes anything that happened before the entity's own compliance date, which is a boundary rather than a live limit at this distance.
The nine carve-outs, and why they matter more than the right
The list is worth reading in order, because each item removes a route that carries traffic.
Disclosures to carry out treatment, payment and health care operations. That is the largest category in the rule, and the one that needs no permission from you.
Disclosures to you about yourself. Disclosures incident to another permitted or required use or disclosure.
Anything made pursuant to an authorization, which removes exactly the disclosures you signed for.
Disclosures for a facility's directory, or to persons involved in your care, or for notification purposes.
Disclosures for national security or intelligence purposes, and disclosures to correctional institutions or law enforcement officials under one specific paragraph.
Anything forming part of a limited data set. And anything predating the entity's compliance date.
Set the first item beside the fourth and the shape is clear. The two routes that move most information, the standing permission and the signature, are both outside the log.
What each entry has to say
For the disclosures that do count, the rule fixes the contents of the written accounting.
The date of the disclosure. The name of the entity or person who received the information, and their address if known.
A brief description of the information disclosed.
And a brief statement of the purpose that reasonably informs you of the basis for the disclosure. In place of that statement, the entity may supply a copy of the written request for the disclosure.
Four fields, one of which can be satisfied by handing over the request itself. That last option is the more informative of the two where it is used.
Two ways the accounting may be compressed
The rule allows two kinds of summary, and both trade detail for practicality.
Where an entity has made multiple disclosures to the same recipient for a single purpose under the required-by-law route or the no-authorization section, it may give full detail for the first disclosure only.
It then adds the frequency, periodicity or number of the disclosures during the period, and the date of the last one.
The second allowance is for research. Where information was disclosed for a particular research purpose for fifty or more individuals, the accounting may describe the activity rather than the disclosure.
It names the protocol and describes it in plain language, including the purpose and the record-selection criteria. It describes the type of information disclosed, gives the dates, and names the sponsor and the researcher with an address and telephone number.
And it says something unusual. It states that your information may or may not have been disclosed for that protocol.
Where the entity uses that route and it is reasonably likely your information was included, it has to help you contact the sponsor and the researcher if you ask.
The pause a government official can ask for
One paragraph lets the right be suspended, and it is narrow in scope and specific in procedure.
The entity must temporarily suspend your right to an accounting of disclosures to a health oversight agency or a law enforcement official, for the time the agency or official specifies.
That requires a written statement from the agency or official saying an accounting would be reasonably likely to impede its activities, and specifying the period.
An oral statement can trigger it too, with conditions. The entity documents the statement and the identity of the official, suspends the right, and limits the suspension to no more than thirty days unless a written statement arrives inside that window.
The suspension reaches the accounting rather than the disclosure. It changes what you can be told about, not what may be given.
The clock, and the one free copy
The entity has to act on a request no later than sixty days after receiving it, by providing the accounting.
One extension of no more than thirty further days is available, and only on written notice within the original period stating the reasons for the delay and the date the accounting will arrive.
The rule says there may be only one such extension, which is the same structure the access and amendment rights use.
The first accounting in any twelve-month period is free. A reasonable, cost-based fee may be charged for each later request by the same person in that period.
Charging one comes with a condition. The entity has to tell you about the fee in advance, and give you a chance to withdraw or modify the request to avoid or reduce it.
Reading it beside the other two rights
Three rights in this subpart sit next to each other and answer different questions.
One is access, which produces a copy of what a company holds about you. Another is amendment, which appends a correction to it.
This one produces a list of where some of it went. None of the three does the work of the others.
The clocks are also close enough to be confused. Access runs on thirty days, amendment and accounting on sixty, and each allows exactly one extension of thirty.
What this does not decide
It does not say whether any company owes this duty. The right runs against a covered entity, and that is a legal question about a specific business.
It does not say what any accounting would contain, or that anything is missing from one. The carve-outs are written into the regulation, and describing them says nothing about anyone's conduct.
It does not describe the right to obtain a copy of your record, or the right to have an entry corrected, both of which are separate sections.
And it is not legal advice. It reports what one federal section says.
Sources
- 45 CFR 164.528, "Accounting of disclosures of protected health information"Paragraph (a)(1), the right to receive an accounting of disclosures made in the six years prior to the date of the request, and the nine excepted categories: disclosures to carry out treatment, payment and health care operations under 164.506; disclosures to individuals about themselves under 164.502; disclosures incident to a use or disclosure otherwise permitted or required; disclosures pursuant to an authorization under 164.508; disclosures for a facility's directory or to persons involved in care or for notification purposes under 164.510; disclosures for national security or intelligence purposes under 164.512(k)(2); disclosures to correctional institutions or law enforcement officials under 164.512(k)(5); disclosures as part of a limited data set under 164.514(e); and disclosures occurring before the covered entity's compliance date. Paragraph (a)(2), the temporary suspension of the right for disclosures to a health oversight agency or law enforcement official on a written statement that an accounting would be reasonably likely to impede the agency's activities, and the oral-statement route with its documentation duty and thirty-day limit. Paragraph (a)(3), that an individual may request a period shorter than six years. Paragraph (b)(1), that the accounting includes disclosures to or by business associates. Paragraph (b)(2), the four content elements of each entry. Paragraph (b)(3), the summary permitted for multiple disclosures to the same recipient for a single purpose. Paragraph (b)(4), the research summary available where disclosures were made for a particular research purpose for 50 or more individuals, its seven contents including the statement that the individual's information may or may not have been disclosed, and the duty to assist in contacting the sponsor and researcher on request. Paragraph (c)(1), the sixty-day period to act and the single thirty-day extension conditioned on a written statement of reasons and a completion date. Paragraph (c)(2), the first accounting in any twelve-month period without charge, the reasonable cost-based fee for later requests, and the conditions of advance notice and an opportunity to withdraw or modify the request. Paragraph (d), the documentation duties.
Frequently asked questions
What is an accounting of disclosures?
A written list a covered entity has to provide on request, covering disclosures of your protected health information made in the six years before the request. It includes disclosures to or by the entity's business associates. You may ask for a shorter period than six years. Each entry carries the date, the name of the recipient and their address if known, and a brief description of the information disclosed. It also carries a brief statement of the purpose, or in place of that statement a copy of the written request for the disclosure.
Why would a list of disclosures not include most of them?
Because the section removes nine categories, and several of them carry the bulk of the traffic. Disclosures for treatment, payment and health care operations are out. So are disclosures made under an authorization, disclosures to you about yourself, and disclosures incident to another permitted use. So are facility directory and care-involvement disclosures, national security disclosures, one law enforcement and correctional route, anything in a limited data set, and anything before the entity's compliance date.
How long does a company have, and does it cost anything?
Sixty days from receipt of the request. One extension of no more than thirty further days is allowed, and it is conditional. Within the original sixty the entity has to give you a written statement of the reasons for the delay and the date the accounting will be provided. The rule states there may be only one such extension. The first accounting in any twelve-month period is free. A reasonable, cost-based fee may be charged for later requests in that period, but only where the entity tells you in advance and lets you withdraw or modify the request.
Can the list be suspended?
For two categories, yes. A covered entity must temporarily suspend the right to an accounting of disclosures to a health oversight agency or a law enforcement official. That takes a written statement that an accounting would be reasonably likely to impede its activities, for the time the agency or official specifies. An oral statement also works if the entity documents it and the identity of the official, and limits the suspension to thirty days unless a written statement arrives in that window.
What happens if my information went to a research project?
Where the entity disclosed information for a particular research purpose covering fifty or more individuals, it may describe the activity instead of the individual disclosure. That description names the protocol and explains it in plain language, including its purpose and the criteria for selecting records. It describes the type of information disclosed, gives the dates, and names the sponsor and the researcher with an address and telephone number. It also states that your information may or may not have been included. If it is reasonably likely yours was, the entity must assist you in contacting the sponsor and the researcher on request.
How is this different from asking for a copy of my record?
They are separate sections answering separate questions. The access right produces a copy of what an entity holds about you in a designated record set, on a thirty-day clock. The amendment right appends a correction, on a sixty-day clock. This right produces a list of certain disclosures, also on a sixty-day clock. Each of the three allows exactly one thirty-day extension, and none of them substitutes for the other two.