When Required the Information Provided to the Data Subject in a HIPAA Disclosure Accounting Must Include Specific Elements

When the information provided to the data subject in a HIPAA disclosure accounting is required, it must include the date of each disclosure, the name and address of the recipient, a description of the protected health information disclosed, and the purpose or basis for the disclosure. An accounting covers up to six years before the request, with a 30-day response deadline and one 30-day extension.

The accounting of disclosures is the patient-facing ledger of where a covered entity sent their protected health information (PHI). It is distinct from a privacy notice and distinct from an access request. The mechanism is simple in principle but surprisingly layered in execution, and most of the thin explainers floating around gloss over the parts that trip up compliance officers.

How the accounting mechanism actually works

The HIPAA Privacy Rule, at 45 CFR 164.528, obligates a covered entity to give an individual a written accounting of disclosures of their PHI. The accounting is triggered by a request. It is not a document that must be generated proactively and handed out. This distinction matters because many patients assume an accounting should arrive automatically, and many small practices assume no obligation exists until someone asks.

Once a request arrives, the clock starts. Covered entities have 30 days to respond. They may take a single 30-day extension if they notify the individual in writing before the original deadline elapses. That written notice must state the reason for the delay and the date by which the accounting will be provided. No further extensions are permitted, so the outer boundary is 60 calendar days.

The lookback window is six years from the date of the request, not from the date of the last treatment. That means a former patient can request an accounting years after leaving a practice and still reach disclosures going back six years. Records older than six years fall outside the required accounting unless the entity maintains them and chooses to include them.

The accounting is delivered in writing, and the covered entity may provide it electronically if the individual agrees. Fees may be charged for copying, but not for the first accounting in any 12-month period. The HHS Office for Civil Rights caps reasonable cost-based fees, and labor for compiling the accounting is generally not a chargeable cost.

The core purpose is transparency about the secondary flow of information. Treatment disclosures are largely outside the accounting, which is why a patient's chart is not the same as an accounting. The accounting tracks the outbound pipes, not the internal record.

What a required accounting must contain, quantified

The regulation enumerates specific content elements, and each has practical nuance. When the information provided to the data subject in a HIPAA disclosure accounting is required, the following must appear for each disclosure.

The description of PHI must be specific enough that the individual understands what was shared. "Records" is not sufficient. "Operative report dated March 3 and discharge summary dated March 6" is closer to what regulators expect. The purpose statement ties the disclosure to a category, such as required by law, public health, law enforcement, or judicial proceeding.

Two standardized formats exist that simplify compliance. If a covered entity makes a disclosure that requires an accounting and the entity has a payment for a treatment or operations purpose, certain exceptions apply. More importantly, HIPAA authorizes an abbreviated accounting for repeated disclosures and for certain treatment-related disclosures where additional detail is impractical, but only under defined conditions. The full accounting remains the default.

The accounting must include disclosures made directly by the entity and by its business associates, because the entity is responsible for disclosures made on its behalf. That responsibility is often delegated contractually but never outsourced legally.

Why treatment, payment, and operations drop out of the count

The biggest source of confusion is what does not belong in the accounting. Disclosures for treatment, payment, and health care operations are excluded, and they represent the overwhelming majority of information flow in a functioning health system. A hospital may transmit hundreds of data elements for claims processing and care coordination; almost none of that appears in an accounting.

The reasoning is proportionality. Congress and HHS concluded that logging every treatment disclosure would create an unmanageable administrative burden while yielding little transparency value, because patients already receive explanations of benefits and are present for most care. The accounting targets the less visible transfers: public health reporting, subpoenas, research, and oversight activities.

This is a counterintuitive detail worth stating plainly. A patient may assume an accounting will reveal everything that happened to their data, and it will not. It will reveal only the defined subset outside treatment, payment, and operations. Explaining that gap is an ethical communication task, not just a compliance one.

The categories that do require accounting include disclosures to public health authorities, to the FDA, to law enforcement, to courts and administrative agencies, and for research when identifiable information is involved. Disclosures to business associates for treatment or operations also drop out, while disclosures to a business associate for a non-exempt purpose must be logged.

A second counterintuitive point: the entity is not required to log the disclosure contemporaneously. It must maintain the information needed to produce the accounting, but the documentation format is flexible, and audits are often reconstructed from audit trails after the fact. Reconstruction at request time is a predictable source of missing elements.

Edge cases that complicate the six-year ledger

Several scenarios break the simple model. Minors are the first. An individual who is a minor's personal representative can request an accounting covering the minor's PHI, but the six-year window and the parent's authority can diverge when a state grants the minor the right to consent to certain treatment. In those cases the parent may lack authority for some portions of the record, and the accounting obligation follows the personal representative at the time of the disclosure.

Organ donation, research, and decedent records introduce their own rules. Disclosures to organ procurement organizations are subject to accounting. Research uses require attention to the distinction between identifiable and de-identified data; once data are properly de-identified, HIPAA no longer governs them and no accounting is owed. For decedents, the personal representative of the estate generally holds the accounting rights, but the authority ends at death unless an executor is appointed.

The operational challenge is log coverage. Covered entities must count disclosures by business associates, many of which are separate companies with separate systems. A health system with 200 business associates faces a very real risk that a subset keeps inadequate logs. The entity remains the accountable party even when the associate's records are the only record of the event.

Red-flag warnings worth watching:

A blank or generic purpose field in an EHR export can invalidate an entire accounting. Disclosures made during a breach investigation may require accounting if the breach itself was a use or disclosure outside permitted categories, though breach notification rules can overlap with the accounting analysis. Secure messaging and health information exchanges can move PHI without a clean audit trail if the exchange role is unclear. Vendor-generated accounting templates often omit the individual rights statement. State law may require more detail than HIPAA minimums; the stricter standard controls.

Timeline of a disclosure accounting request

Two gates matter most: the extension gate at day 30 and the hard stop at day 60. Entities that miss the 30-day notice lose the extension entirely, and that converts a manageable delay into an apparent denial of rights.

Misconceptions versus the actual standard

The most persistent misconception is that an accounting equals a complete data map. It does not. It is a disclosure-specific log, and deliberately excludes the biggest disclosure categories. A patient who wants to understand day-to-day sharing of their chart needs other tools, including access rights under 45 CFR 164.524, which is a separate and frequently more informative pathway.

A second misconception is that patients can be charged for the accounting. The first accounting within 12 months must be free, and later ones may carry only reasonable cost-based charges.

A third misconception is that verbal disclosures do not count. Verbal disclosures of PHI can require accounting when they fall outside the exempt categories, and a phone call to an attorney or a public health worker may need to be logged. Logging verbal disclosures is one of the least mature parts of most compliance programs.

A fourth misconception is that EHR vendors produce compliant accountings automatically. Many vendor tools produce disclosure logs, not accountings, and the difference is the presence of recipient, description, purpose, and rights statement for each entry. Covered entities are accountable for the output regardless of the tool.

A fifth misconception concerns timing. Some entities believe the six-year window runs from the patient's last visit. It runs from the request date.

Practical actions for covered entities and patients

For covered entities, the highest-leverage steps are operational. Centralize disclosure logging in one system that business associates can feed. Require a purpose code and a specific PHI description at the point of disclosure, not later. Train staff that verbal and electronic disclosures both generate log obligations. Test an accounting request end-to-end at least annually to catch missing fields.

For patients, the practical steps are equally concrete. Submit the request in writing and keep proof of delivery. Specify the six-year period you want covered. Ask for the accounting in electronic form if that is your preference. If the response is vague, request a corrected accounting, because a description reading only "records" is not a meaningful description.

Thresholds to hold in memory:

30 days is the ordinary response deadline. One 30-day extension is available only with written notice sent before the deadline. Six years is the standard lookback from the request date. The first accounting in any 12-month period is free. Written delivery is the default, electronic delivery requires individual agreement. Business associate disclosures count against the covered entity's obligation.

For readers who want to locate the authoritative text, the relevant section is 45 CFR 164.528 in the HIPAA Privacy Rule, and guidance is available from the Department of Health and Human Services Office for Civil Rights.

Limitations and professional caveat

This explainer simplifies a rule that interacts with state law, breach notification requirements, and role-based distinctions. State privacy statutes in California, Texas, and elsewhere can impose additional content requirements, and the stricter law controls. Role designation matters too: a health information exchange may be a business associate, a covered entity, or neither depending on its structure, and that determination changes the accounting analysis.

The regulation has remained stable in its core terms, but enforcement priorities and interpretive guidance evolve. Organizations should confirm obligations against current HHS guidance and organizational counsel rather than treat any summary as final. Predictions about enforcement outcomes or litigation risk should not be relied upon.

This article provides general educational information about compliance mechanics. It is not legal advice, not a compliance certification, and not a substitute for review by a qualified health care attorney or privacy officer in your jurisdiction. Consult a local professional before applying these requirements to a specific organization or patient request.