Accounting of Disclosures (45 CFR § 164.528): Tracker + Procedure

A HIPAA accounting of disclosures is the patient's right under 45 CFR § 164.528 to receive a list of disclosures of their PHI made by the practice during the six years preceding the request — excluding disclosures for treatment, payment, operations, or made under an authorization. The response window is 60 days, extendable once by 30 days.

What HHS actually requires

§ 164.528(a)(1) entitles the patient to an accounting of disclosures of PHI made by the covered entity in the six years prior to the date of the request. § 164.528(b)(2) sets out the required content per accounted disclosure: the date, the recipient's name and address (if known), a brief description of the PHI disclosed, and a brief statement of the purpose of the disclosure or a copy of the underlying request.

§ 164.528(a)(2) allows a temporary suspension of accounting where a health-oversight agency or law-enforcement official provides a written statement that the accounting would impede their work — the suspension period must be specified. (Multiple disclosures to the same recipient for the same purpose are handled separately at § 164.528(b)(3).)

§ 164.528(c)(2) provides for one free accounting per twelve months and allows a cost-based fee for subsequent requests with advance notice.

§ 164.528(c)(1) sets the 60-day response window, with a single 30-day extension on written notice under § 164.528(c)(1)(ii).

Retention of the accounting log itself runs six years from the date of creation under § 164.530(j)(2).

In our analysis of 400+ d3rx client binders, the accounting tracker is the single most often missing artifact. Practices that have a Notice of Privacy Practices and a sanction policy frequently have no central disclosure log. When the patient or OCR investigator asks for it, the practice reconstructs from primary sources — which is acceptable for the response but documents the absence of the standing tracker as a finding.

The four entities every credible accounting procedure references: the HHS Office for Civil Rights (OCR), the HHS Privacy Rule summary on accounting, the 21st Century Cures Act Information Blocking Rule, and state-specific public-health reporting authorities (CDPH, TDSHS, FDOH, NYSDOH) that drive much of the accounting volume.

Template — section by section

``` HIPAA ACCOUNTING OF DISCLOSURES PROCEDURE [Practice Name] Effective: [DATE] Owner: Privacy Officer

1. PURPOSE

This procedure operationalizes 45 CFR § 164.528 — the patient's right to receive an accounting of certain disclosures of their PHI in the six years preceding the request.

1. SCOPE

Every disclosure of PHI by the practice except those excluded by § 164.528(a)(1):

• Disclosures for treatment, payment, or health care operations
• Disclosures to the individual
• Disclosures made under a § 164.508 authorization
• Incidental disclosures permitted under § 164.502
• Facility directory and family/care-involved disclosures under

§ 164.510

• National-security disclosures under § 164.512(k)(2)
• Correctional-institution disclosures under § 164.512(k)(5)
• Limited data set disclosures under § 164.514(e)
• Disclosures made before the practice's HIPAA compliance date

1. ACCOUNTABLE DISCLOSURE CATEGORIES (log every one)

• Required by law disclosures under § 164.512(a)
• Public-health reporting (reportable diseases, immunization

registries, cancer registries, vital records) under § 164.512(b)

• Child-abuse or neglect reports under § 164.512(b)(1)(ii)
• Adult abuse, neglect, or domestic-violence reports under

§ 164.512(c)

• Health-oversight activity (audits, inspections, licensure)

under § 164.512(d) — except disclosures made to OCR itself during a HIPAA investigation are accountable

• Judicial/administrative proceedings (subpoenas, court orders)

under § 164.512(e)

• Law-enforcement purposes (other than § 164.512(k)(5)

correctional) under § 164.512(f)

• Decedent disclosures to coroners, medical examiners, funeral

directors under § 164.512(g)

• Organ/tissue donation disclosures under § 164.512(h)
• Research without authorization under § 164.512(i) (special

simplified entry available for repeated same-recipient disclosures)

• Serious threat to health or safety under § 164.512(j)
• Workers' compensation disclosures under § 164.512(l)
• PDMP queries that produce a covered-entity disclosure
• Reports to FDA of adverse events under § 164.512(b)(1)(iii)
• Breach notifications to affected individuals under § 164.404

(the disclosure to the individual is to the individual and not accountable; the disclosure to HHS under § 164.408 is accountable as a health-oversight disclosure)

1. LOG ENTRY REQUIREMENTS

Each accountable disclosure is logged at the time of disclosure with:

• Disclosure date
• Patient name and MRN
• Recipient name and address (if known)
• Brief description of PHI disclosed
• Brief statement of purpose (or attached underlying request)
• Authority for disclosure (CFR citation + state law if any)
• Staff member making the disclosure

1. PATIENT REQUEST FOR ACCOUNTING

5.1 Intake using the Accounting Request Form (Appendix A) 5.2 Time-stamp on Day 0 5.3 Pull all accountable disclosures for the requested patient from the tracker for the requested period (default 6 years) 5.4 Generate the Accounting Response Packet (Appendix C) with every required content element per § 164.528(b)(2) 5.5 Deliver within 60 days of receipt 5.6 If extension required, issue Extension Notice (Appendix D) inside Day 60

1. SUSPENSION

If a law-enforcement or health-oversight agency provides a written statement under § 164.528(a)(2) that the accounting would impede their work, the Privacy Officer documents the suspension period and omits the suspended disclosures from the response. The suspension record is retained for six years.

1. FEE

First request in any twelve-month period: free. Subsequent requests within twelve months: reasonable cost-based fee with advance notice and opportunity to withdraw or modify.

1. RETENTION

The disclosure tracker and every Accounting Response Packet is retained for six years per § 164.530(j)(2).

Reviewed and approved: ___________________________ Privacy Officer Date: ________ ___________________________ Security Officer Date: ________ ___________________________ Practice Owner Date: ________ ```

Disclosure Tracker (Appendix B — copy-ready)

The core artifact. Every accountable disclosure goes in this log within one business day of the disclosure.

| Disclosure date | Patient name | MRN | Recipient (name + address) | PHI disclosed (brief) | Purpose | Authority (CFR + state) | Disclosed by | |---|---|---|---|---|---|---|---| | 2026-05-04 | <name> | <MRN> | County Health Dept, 123 Main St | Reportable disease case report | Public-health reporting | § 164.512(b); CA HSC § 120130 | <staff> | | 2026-05-07 | <name> | <MRN> | County DCFS, 200 Park Ave | Child abuse report; minor patient | Mandated reporting | § 164.512(b)(1)(ii); CA Penal § 11166 | <provider> | | 2026-05-09 | <name> | <MRN> | Sheriff's office; subpoena 26-CV-1234 | Visit notes 2024-2025 + medication list | Subpoena response | § 164.512(e); state civil procedure | <Privacy Officer> | | 2026-05-11 | <name> | <MRN> | State Cancer Registry | Cancer dx + staging | Mandatory cancer registry | § 164.512(b); state cancer reg law | <provider> | | 2026-05-13 | <name> | <MRN> | Workers' comp carrier <name> | IME notes + treatment plan | WC claim | § 164.512(l); state WC law | <billing> | | 2026-05-14 | <name> | <MRN> | FDA MedWatch | Adverse drug event | FDA AER | § 164.512(b)(1)(iii) | <provider> | | 2026-05-17 | <name> | <MRN> | County Coroner | Decedent records | Coroner inquiry | § 164.512(g) | <Privacy Officer> | | 2026-05-20 | <name> | <MRN> | State PDMP | Rx history query | PDMP query | § 164.512(a); state PDMP law | <provider> | | 2026-05-21 | <name> | <MRN> | OCR investigator | Records per OCR request | Health oversight | § 164.512(d) | <Privacy Officer> | | 2026-05-22 | <name> | <MRN> | <research IRB protocol #> | de-identified except dates | Research w/ IRB waiver | § 164.512(i); simplified entry | <Privacy Officer> |

Accounting Request Form (Appendix A)

``` ACCOUNTING OF DISCLOSURES REQUEST Date and time received: ____________________ Intake # ________ Channel: □ phone □ paper □ email □ portal □ in-person

Requester: □ Patient □ Personal rep □ Authorized recipient Requester name: ____________________________ Patient name (if different): ____________________ Patient DOB / MRN: ____________________ Requester ID verified by: ____________________ Date: ________

Period requested: □ Default 6 years preceding this date □ Specified period: ___________ to ___________

Format requested: □ Paper □ PDF □ Portal □ Email Free request this 12 months? □ Yes □ No (fee schedule provided)

Day-0 stamp: ____________________ Day-60 deadline: __________ Day-90 deadline (if extended): __________

Assigned to: ____________________ Privacy Officer signoff: ________ ```

Accounting Response Packet (Appendix C)

``` [Practice Letterhead] [Date]

[Patient Name] [Address]

Re: Your Accounting of Disclosures Request — Intake # ________

Dear [Patient Name],

Pursuant to your request received [DATE] under 45 CFR § 164.528, this is the accounting of disclosures of your protected health information made by [Practice Name] during the period [START] to [END].

Disclosures excluded from this accounting (and from § 164.528):

• Disclosures for treatment, payment, and health care operations
• Disclosures you authorized in writing
• Disclosures to you
• Incidental, facility-directory, and care-coordination disclosures
• Disclosures for national security
• Limited data set disclosures
• Disclosures predating our HIPAA compliance date

Accounted disclosures during the requested period:

Disclosure 1 Date: ____________________ Recipient: ____________________ Recipient address: ____________________ Description of PHI disclosed: ____________________ Purpose / underlying request: ____________________ Authority: ____________________

Disclosure 2 [...]

If you have any questions, please contact our Privacy Officer at [phone] or [email]. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights at https://www.hhs.gov/ocr/complaints/index.html.

Sincerely,

[Privacy Officer Name] Privacy Officer [Practice Name] ```

Extension Notice (Appendix D)

``` [Practice Letterhead] [Date]

[Patient Name] [Address]

Re: Your Accounting of Disclosures Request — Intake # ________ Originally received: [DATE]

Dear [Patient Name],

This letter is to inform you that we are extending the time to respond to your accounting-of-disclosures request by an additional thirty (30) days, as permitted by 45 CFR § 164.528(c)(1)(ii).

Reason for the extension: [specific reason — e.g., "the requested period includes legacy records archived in a prior records system that requires retrieval"]

Expected response date: [DATE — no later than 90 days from original receipt]

If you have any questions, please contact our Privacy Officer at [phone] or [email].

Sincerely,

[Privacy Officer Name] Privacy Officer [Practice Name] ```

How to deploy

The deployment sequence: ratify the procedure with the Privacy Officer, Security Officer, and practice owner; stand up the disclosure tracker as a single spreadsheet or binder tab; back-fill the tracker for the past 24 months from primary sources (subpoena log, public-health reports, child-abuse reports, workers' comp file, PDMP query log, FDA report log, OCR or health-oversight responses); train every workforce member who can make an accountable disclosure on the one-business-day logging rule; assign the Privacy Officer to review the tracker monthly; book the annual cadence.

What practices most often miss in accounting is the public-health bucket. Reportable diseases, cancer registry submissions, vital records, immunization registries, and PDMP queries all happen routinely and are routinely not logged. The fix is procedural: whichever workforce member completes the report adds the row to the tracker before closing the chart.

Common gaps

The five most common defects from binder review:

1. No central tracker. Disclosures happen; nobody logs them; reconstruction is required on every accounting request.
2. Public-health and PDMP disclosures omitted from tracker. Treated as routine clinical workflow; the § 164.512 categorization is forgotten.
3. Subpoenas logged but state-law-required disclosures (abuse, communicable disease) missing. Half a tracker.
4. No suspension record when law enforcement requests one. Disclosure happens to law enforcement; the accountability suspension is unwritten; the accounting response includes the disclosure when it should be suspended (or excludes it when it should be included).
5. 60-day window missed because the tracker took longer to assemble than the window allowed. Standing tracker prevents this; reconstruction-only practices routinely run past 60 days.

Maintenance cadence

• Within one business day of any accountable disclosure: tracker entry.
• Monthly: Privacy Officer reviews the tracker for completeness against the subpoena log, public-health log, PDMP log, and abuse-report log.
• Quarterly: tracker reconciled against EHR audit logs; missing entries back-filled.
• Annually: procedure refresh; staff retraining; sample five completed accountings for completeness; review against any state-law changes.
• On any patient request: 60-day window, written extension if needed inside Day 60, response packet delivered.
• Six-year retention: every tracker entry and every response packet retained per § 164.530(j)(2).

State preemption note: California's CMIA does not contain an accounting analog but the federal § 164.528 procedure governs CA practices via § 160.203. Texas HB 300 imposes its own access timelines that interact with how quickly back-fill is feasible. State public-health reporting laws drive the disclosure volume — California Title 17, Texas Health & Safety Code Chapter 81, Florida Chapter 381, New York Public Health Law Article 21. Logging the disclosure cites both the federal authority (§ 164.512(b)) and the state law that compelled it.

How d3rx fits

The d3rx compliance binder generates the Accounting of Disclosures procedure, the disclosure tracker, the Request Form, the Response Packet, and the Extension Notice with § 164.528 and the relevant § 164.512 sub-citations inline. The Privacy Officer remains responsible for logging accountable disclosures within one business day, reviewing the tracker monthly, and signing every Accounting Response Packet.