Quick answer
HIPAA disclosure accounting is a classified history of specified disclosures, not a dump of everyone who opened a chart. Apply the exclusions in 45 CFR 164.528, include relevant business-associate events, and preserve the required date, recipient, information and purpose. Reconcile both included and excluded events before sending the response.
Ask which history the resident requested
A resident requests an accounting for the previous two years. The EHR can export thousands of chart-access events, but most describe internal uses rather than the disclosures the rule addresses. A complete accounting process needs a classification layer and sources beyond the primary EHR.
45 CFR 164.528 provides a right to an accounting for the preceding six years, or a shorter requested period, subject to exclusions. It includes relevant disclosures to or by business associates. Required event details generally include the date, recipient and known address, a description of the information, and a purpose statement or qualifying request copy. A list of usernames cannot substitute for those facts.
Run a classification exercise before choosing a ledger
Use synthetic events with documented assumptions. This original exercise intentionally includes events that need additional facts.
| Event | Initial accounting treatment | Fact to retain |
|---|---|---|
| Nurse opens chart for assigned care | Internal use, not itself a disclosure | Access-log context kept separately |
| Record sent to treating hospital | Generally excluded TPO disclosure | Treatment purpose and recipient |
| Claim sent for payment | Generally excluded TPO disclosure | Payment basis |
| Covered quality contractor processes data for operations | Assess TPO exclusion and actual arrangement | Purpose and business-associate role |
| Resident receives own record | Excluded under the specified individual-access category | Recipient identity |
| Disclosure under valid authorization | Excluded under authorization category | Applicable authorization |
| Appropriate information shared with involved family under 164.510 | Excluded category | Actual basis and scope |
| Permitted facility-directory disclosure | Excluded category | Directory conditions |
| Required public-health report | Generally included unless another exclusion applies | Report purpose, date and recipient |
| Qualifying health-oversight disclosure | Generally included, subject to applicable suspension | Authority and any suspension instruction |
| Misdirected external file | Investigate; do not omit because impermissible | Affected individual, recipient and content |
| Business associate reports an external disclosure | Classify by its actual basis | BA evidence and duplicates |
These classifications assume the described facts and valid legal bases. They do not authorize the underlying disclosures. The privacy reviewer should resolve exceptions and unknowns before the response is issued.
Reconcile the population, then simplify its presentation
Imagine a facility identifies eight monthly reports containing the resident's information, all sent to one recipient for the same qualifying purpose. The rule allows a recurring-disclosure presentation: details of the first disclosure, frequency or number, and date of the last. The ledger should retain all eight source events even if the response presents one grouped line. If the purpose or recipient changes halfway through, reassess the grouping.
Request evidence from applicable business associates early. Match on resident, event, recipient and time so the same transmission reported by the facility and its processor is not counted twice. Keep an unresolved bucket for missing purpose, missing recipient or uncertain inclusion. “No events returned” should be distinguishable from “the supplier did not search this period.”
The final reconciliation can state: 31 candidate events reviewed; 19 excluded with recorded reasons; eight recurring events represented in one permitted grouping; three other included events; one unresolved item escalated before completion. Those are fictional counts illustrating a control, not expected industry proportions.
Make response administration part of acceptance
The HIPAA rule generally allows 60 days to act, with one extension of up to 30 days if the prescribed written notice is supplied in time. The first accounting in a 12-month period is free; a subsequent request can carry a reasonable cost-based fee only with the required advance notice and opportunity to withdraw or modify it. Configure request history and dates accordingly, with any additional applicable law reviewed.
Health-oversight and law-enforcement suspension provisions require careful handling. An oral instruction does not justify an indefinite hidden record: the rule specifies documentation and a limited oral-suspension period. Restrict access to those facts and assign review dates without erasing the underlying event.
Ask the supplier to generate a resident-facing accounting from the exercise, preserve the classifications, ingest a late BA event and regenerate the affected response. Acceptance means a reviewer can explain completeness and exclusions. It does not mean the export contains the largest number of log rows.
Questions & answers
Are treatment disclosures generally included?
The current HIPAA accounting rule excludes disclosures to carry out treatment, payment and health care operations as provided in 164.506. Classify the actual event and its basis.
Can repeated disclosures be grouped?
The rule permits a defined presentation for multiple disclosures to the same recipient for a single qualifying purpose, including first-disclosure details, frequency or number, and last-disclosure date.
Primary sources
Use the cited source and its applicable version when making a facility-specific decision. These guides explain operational evaluation methods; they are not individualized clinical, coding, or legal advice.