Accounting of Disclosures
The HIPAA right of an individual to receive a list of disclosures of their PHI made by a covered entity over the prior six years.
1 min read · Last reviewed May 23, 2026
At a glance
- Category
- HIPAA & Privacy
- Primary sources
- 2
- Workspace handoff
- compliance binder →
Where this comes up
Privacy officers and practice managers handle this — patient rights requests, accounting of disclosures, BAA reviews with new vendors, breach risk assessments after an incident, and OCR responses when a complaint lands. The 60-day breach-notification clock starts at discovery, not at investigation close.
Full definition
What it is in practice
45 CFR 164.528 requires an accounting on request, with carve-outs for TPO disclosures, disclosures to the individual, disclosures authorized by the individual, and several others. The accounting must include the date, recipient, brief description of the PHI, and purpose.
How it shows up in your practice
The exception list does most of the work — most chart-room disclosures do not need to be tracked. But state Medicaid HIE participation, public health reports, and judicial proceedings all do. Build the accounting query into your EHR audit log review.
Sources
- 45 CFR 164.528 — Accounting of disclosureshttps://www.ecfr.gov/current/title-45/section-164.528
- HHS — HIPAA Privacy Rulehttps://www.hhs.gov/hipaa/for-professionals/privacy/index.html
Build the accounting query in the Compliance Binder
Open compliance binder →Related terms
- SecurityAudit LogA record of system activity (logins, record access, configuration changes) that can be reviewed to detect inappropriate access or system compromise.
- HIPAA & PrivacyPatient Right of AccessThe HIPAA right of an individual to inspect and obtain a copy of their PHI in a designated record set.
- HIPAA & PrivacyAmendment of PHIThe HIPAA right of an individual to request that a covered entity amend PHI in a designated record set.
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- GlossaryAmendment of PHIThe HIPAA right of an individual to request that a covered entity amend PHI in a designated record set.
- GlossaryPatient Right of AccessThe HIPAA right of an individual to inspect and obtain a copy of their PHI in a designated record set.
- GlossaryAudit LogA record of system activity (logins, record access, configuration changes) that can be reviewed to detect inappropriate access or system compromise.
- GlossaryAuthorization for DisclosureA written authorization signed by the individual permitting a covered entity to use or disclose PHI for a purpose not otherwise permitted by the Privacy Rule.
- GlossaryCovered EntityA health plan, health care clearinghouse, or health care provider that transmits health information in electronic form in connection with a HIPAA transaction.
- RegulationHIPAA Accounting of Disclosures (45 CFR 164.528)Individuals may request an accounting of disclosures of their PHI made by a covered entity in the prior six years, with a defined list of exclusions.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
- SRAHIPAA Patient Right of Access: A Small-Practice WalkthroughHow 45 CFR 164.524 governs patient access to their records, the 30-day rule and 30-day extension, the limited fees a practice may charge, and the OCR Right of Access Initiative.
This glossary entry is a research aid for billing and compliance staff. It does not provide legal, medical, or financial advice and does not replace counsel. References cited link to primary sources at HHS, OCR, CMS, eCFR, NIST, and the relevant payer or industry body.