HIPAA Accounting of Disclosures: What Counts, and the 60-Day Clock

A patient in the middle of a custody dispute calls the front desk and asks for "a list of everyone you have sent my records to in the last few years." The front desk has never heard the request before. The office manager is fairly sure the answer lives somewhere in the EHR. The physician assumes it is the same thing as a records request. Nobody is right, and the clock started when the phone rang.

The request has a name in the regulation: an accounting of disclosures. It is one of the individual rights in the Privacy Rule, it sits at 45 CFR 164.528, and it comes with a six-year lookback, a specific list of what must be in each entry, and a 60-day deadline. This article walks through which disclosures are excluded (most of them), which are not (the ones that matter), what each log entry must contain, how the clock runs, and what to write into the policy so the next call is routine.

HIPAA Accounting of Disclosures: The Rule in Plain English

The standard opens like this: "An individual has a right to receive an accounting of disclosures of protected health information made by a covered entity in the six years prior to the date on which the accounting is requested, except for disclosures:" and then lists nine exceptions. The right belongs to the patient. The lookback is six years from the date of the request, or a shorter period if the patient asks for one under 164.528(a)(3). And under 164.502(a)(2)(i), providing the accounting is not optional: a covered entity "is required to disclose protected health information" to an individual "when requested under, and required by § 164.524 or § 164.528."

Translation: when a patient asks, you owe them a written list. What goes on the list is governed by the exceptions, so start there.

What Is Excluded From the Accounting

The nine exceptions in 164.528(a)(1) remove nearly all of a practice's routine disclosures. Every one of them is a disclosure the Privacy Rule already permits somewhere else, and the accounting right was written to cover the rest.

Notice what is on the list: disclosures the patient either drove (authorization, their own request), already expects (treatment, payment, operations), or could not reasonably be told about (national security). If a disclosure fits one of these nine categories, it does not go in the accounting.

What Is Left: The Disclosures That Count

Everything not on that list is accountable. In a small practice, that is mostly the 164.512 disclosures, the ones made without the patient's authorization because a law or a public purpose permits them:

• Disclosures required by law, including responses to a subpoena, court order, or discovery request under 164.512(e).
• Public health reporting: communicable disease reports, immunization registry submissions, adverse event reports.
• Reports of abuse, neglect, or domestic violence to a government authority.
• Disclosures to a health oversight agency (a state licensing board audit, for example).
• Disclosures to law enforcement under 164.512(f).
• Disclosures to coroners, medical examiners, and funeral directors.
• Disclosures for research without an authorization, and disclosures to avert a serious threat.
• Workers' compensation disclosures under 164.512(l).

Two more categories deserve their own sentence. First, 164.528(b)(1) says the accounting must include disclosures "to or by business associates of the covered entity." If your billing company answers a subpoena about one of your patients, that disclosure belongs in your accounting, which means your business associate agreement needs to require the vendor to tell you about it. Second, an impermissible disclosure, the misdirected fax or the record sent to the wrong patient, appears nowhere on the exclusion list. Read literally, that makes it an accountable disclosure, and it belongs in the log alongside the breach paperwork.

What Each Entry Must Contain

164.528(b)(2) requires four items "for each disclosure":

• "The date of the disclosure;"
• "The name of the entity or person who received the protected health information and, if known, the address of such entity or person;"
• "A brief description of the protected health information disclosed; and"
• "A brief statement of the purpose of the disclosure that reasonably informs the individual of the basis for the disclosure or, in lieu of such statement, a copy of a written request for a disclosure under § 164.502(a)(2)(ii) or § 164.512, if any."

That fourth item is a gift. If the disclosure was made in response to a written request (a subpoena, a health department demand, an OCR data request), a copy of that request satisfies the purpose element. File the request with the log entry and the entry writes itself.

There is also a shortcut for repeat disclosures. Under 164.528(b)(3), when the practice makes "multiple disclosures of protected health information to the same person or entity for a single purpose" under 164.512, the accounting may give the full details for the first disclosure, then "the frequency, periodicity, or number of the disclosures," and the date of the last one. Monthly immunization registry uploads become one entry, not twelve.

The Clock: 60 Days, One Extension

164.528(c)(1) is direct: "The covered entity must act on the individual's request for an accounting, no later than 60 days after receipt of such a request." If the practice cannot finish in time, it "may extend the time to provide the accounting by no more than 30 days," but only if, inside the original 60 days, it gives the patient "a written statement of the reasons for the delay and the date by which the covered entity will provide the accounting." One extension. The rule says so in (c)(1)(ii)(B).

Note the difference from the right of access, where the clock is 30 days. Accounting gets 60 because the practice may have to go collect information from business associates. That extra time is not a reason to wait; it is a reason to start the same day.

Fees are limited too. Under 164.528(c)(2), "the first accounting to an individual in any 12 month period" is provided "without charge." A reasonable, cost-based fee may be charged for a second request in the same 12 months, but only if the patient is told the fee in advance and given a chance to withdraw or narrow the request.

When a Law Enforcement or Oversight Agency Asks You to Wait

One wrinkle protects investigations. Under 164.528(a)(2), if a health oversight agency or law enforcement official gives the practice a written statement that an accounting "would be reasonably likely to impede the agency's activities," the practice "must temporarily suspend" the patient's right to an accounting of those specific disclosures for the time the statement specifies. If the request comes orally, the practice must document it, including who made it, and the suspension may last "no longer than 30 days from the date of the oral statement" unless a written statement arrives in that window.

In practice: write down the officer's name, agency, date, and what was said, calendar the 30 days, and keep the rest of the accounting moving.

The Documentation You Must Keep

164.528(d) requires the practice to document, and retain under 164.530(j), three things: the information required for each accountable disclosure, "the written accounting that is provided to the individual," and "the titles of the persons or offices responsible for receiving and processing requests." 164.530(j)(2) sets the retention at six years "from the date of its creation or the date when it last was in effect, whichever is later."

Put plainly, the log itself is required documentation whether or not anyone ever requests an accounting. A practice that has never been asked still has to be able to produce the six-year list on the day it is asked. That is the real compliance gap: the request is rare, but the log has to exist continuously. The broader retention picture is in HIPAA documentation requirements.

Why OCR Cares About a Right Nobody Uses

Accounting requests are uncommon. Complaints about individual rights are not. The individual-rights sections of the Privacy Rule share one complaint path, and OCR has shown with its Right of Access enforcement that it will pursue small providers over a single patient's request: a $70,000 civil money penalty against a dental practice for failure to provide timely access to patient records (October 17, 2024), and a $100,000 penalty against a mental health center on the same ground (November 19, 2024). The accounting right sits in the same subpart, with the same 164.530(d) complaint process and the same route to OCR described in the provider guide to patient rights. A practice that cannot produce an accounting when asked is a complaint waiting to be filed.

What to Write Into the Policy

The whole obligation fits on two pages plus a spreadsheet. The policy should state:

• The log. One disclosure log for the practice, with columns for date, recipient name and address, description of the P.H.I. (Protected Health Information), purpose or attached written request, and the workforce member who made the disclosure. Every 164.512 disclosure, every subpoena response, and every impermissible disclosure gets a row the day it happens.
• The owner. The title responsible for receiving and processing accounting requests, as 164.528(d)(3) requires. In a small practice this is usually the privacy officer.
• Intake. Requests may be required in writing if patients are told so in advance; the date of receipt is logged and the 60-day date is calendared at intake.
• Business associates. Each B.A.A. (Business Associate Agreement) requires the vendor to report accountable disclosures to the practice promptly, and the policy names who collects them when a request arrives.
• The response. A written accounting on letterhead, the first in any 12 months at no charge, using the 164.528(b)(3) summary format for repeat disclosures.
• Suspensions. How an oral or written agency request to suspend is documented and calendared.
• Retention. The log, every accounting provided, and the policy itself, kept six years.

The Notice of Privacy Practices already tells patients they have this right. The policy and the log are how the practice keeps the promise, and the policy template library has both pre-structured. Build the log this week, backfill what you can from subpoena files and public health reports, and the next custody-dispute phone call becomes a 20-minute task instead of a 60-day scramble.

---

FAQ

How far back does a HIPAA accounting of disclosures go?

Six years before the date of the request, under 45 CFR 164.528(a)(1). The patient may ask for a shorter period. Disclosures made before the practice's HIPAA compliance date are excluded.

Do treatment, payment, and billing disclosures have to be in the accounting?

No. Disclosures for treatment, payment, and health care operations are excluded by 164.528(a)(1)(i), along with disclosures to the patient, disclosures under a signed authorization, and several others.

How long does a practice have to provide an accounting of disclosures?

60 days from receipt of the request. One extension of up to 30 days is allowed if the patient receives a written statement of the reason for the delay and the completion date within the original 60 days.

Can a practice charge for an accounting of disclosures?

The first accounting in any 12-month period must be free. A reasonable, cost-based fee may be charged for additional requests in the same 12 months, provided the patient is told the fee in advance and may withdraw or narrow the request.

Do disclosures made by our business associates count?

Yes. 164.528(b)(1) requires the accounting to include disclosures to or by business associates. The business associate agreement should require the vendor to report accountable disclosures so the practice can include them.

Conclusion

The accounting of disclosures is the individual right most practices have never been asked about, which is exactly why the log tends not to exist. One Guy Consulting's Full-Scope plan includes the accounting policy, the disclosure log template, and the response letters, plus consulting time for the first real request. Start with a free 30-minute compliance review. No obligation, no pressure.

Sources

• 45 CFR 164.528 (accounting of disclosures)
• 45 CFR 164.512 (uses and disclosures not requiring authorization)
• 45 CFR 164.502 (general rules, required disclosures)
• 45 CFR 164.530 (administrative requirements, documentation retention)

---

Related Reading

• HIPAA right of access: deadlines, fees, and denials
• Patient rights under HIPAA: a provider guide
• HIPAA documentation requirements: what to keep
• The HIPAA release form: core elements and a template