The accounting of disclosures: the log you must be able to print

What the accounting of disclosures is — and what it is not

The accounting of disclosures is a HIPAA individual right, separate from the right to a copy of the chart. A patient can ask for a list of the disclosures of their protected health information you made in the six years before the request, and you must respond 1Ref 1HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.The accounting of disclosures is one of the individual rights the Privacy Rule grants patients over their protected health information.2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The mechanics of the accounting — the six-year lookback, the 60-day response window with a 30-day extension, and the required content of each log entry — under the Privacy Rule in 45 CFR Part 164.. It is not the record itself, and it is not a log of everyone who ever looked at the file.

Keep it distinct from the right of access, which is the patient's separate right to inspect and get copies of their own record within thirty days 3Ref 3HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.The separate right of access, under which patients get copies of their record within 30 days, distinguished here from the accounting right.. The accounting answers a different question — not what is in my chart, but who did you give my information to, and why. A solo practice owes both rights, and confusing them is a common way to answer the wrong question and blow a deadline.

What you must log, and what you never do

The rule inverts ordinary intuition: the disclosures you make all day are exactly the ones you never log. Treatment, payment, and health-care operations — sending a claim, faxing a referral, coordinating with another treater — are excluded, along with disclosures the patient authorized, disclosures to the patient, and incidental disclosures that happen despite reasonable safeguards. What remains is the accountable set: the disclosures you make required or permitted without authorization.

Those accountable disclosures include: - Disclosures required by law — a mandated abuse or neglect report, a communicable-disease report to public health. - Disclosures for public-health activities and to health-oversight agencies. - Disclosures for judicial and administrative proceedings — a response to a subpoena or a court order 4Ref 4HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That disclosures for judicial and administrative proceedings, such as subpoena and court-order responses, are the non-routine disclosures captured in the accounting.. - Disclosures to law enforcement, to coroners and medical examiners, and for certain research.

A disclosure made in an emergency without the patient's authorization — a break-glass disclosure to public health or law enforcement — can also be accountable 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The mechanics of the accounting — the six-year lookback, the 60-day response window with a 30-day extension, and the required content of each log entry — under the Privacy Rule in 45 CFR Part 164.. But incidental disclosures — the front-desk conversation a waiting patient overhears — are not accountable when you have reasonable safeguards in place, so they do not belong in the log.

What each entry has to contain

When you do log an accountable disclosure, HIPAA specifies exactly what each entry must capture, and a bare name is not enough. Each entry records the date, who received the information, what was disclosed, and why 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The mechanics of the accounting — the six-year lookback, the 60-day response window with a 30-day extension, and the required content of each log entry — under the Privacy Rule in 45 CFR Part 164.. Build the entry at the moment of disclosure, not months later when a request forces you to reconstruct it from memory — reconstruction is where small practices get the purpose wrong.

For repeated disclosures to the same recipient for the same purpose, the rule lets you summarize rather than list every instance — record the first, the frequency, and the date of the last 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The mechanics of the accounting — the six-year lookback, the 60-day response window with a 30-day extension, and the required content of each log entry — under the Privacy Rule in 45 CFR Part 164..

The clock, the lookback, and the fee

You have sixty days from the request to provide the accounting, with one thirty-day extension if you give the patient a written reason and a date. The accounting reaches back six years from the date of the request — not for the life of the record 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The mechanics of the accounting — the six-year lookback, the 60-day response window with a 30-day extension, and the required content of each log entry — under the Privacy Rule in 45 CFR Part 164.. The first accounting in any twelve-month period is free; for a second request inside that window you may charge a reasonable, cost-based fee, but only if you tell the patient the fee in advance and give them a chance to withdraw or narrow the request.

Note the clocks differ: the accounting runs on sixty days, while the right of access to copies runs on thirty 2Ref 2Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The mechanics of the accounting — the six-year lookback, the 60-day response window with a 30-day extension, and the required content of each log entry — under the Privacy Rule in 45 CFR Part 164.3Ref 3HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.The separate right of access, under which patients get copies of their record within 30 days, distinguished here from the accounting right.. Calendar the deadline the day the request arrives, in writing, so a slow month does not turn into a missed obligation.

Building the log before anyone asks

You can only produce an accounting if you have been keeping one, so the log is a build-now task, not a respond-later one. Keep a single running disclosure log — a spreadsheet or an EHR field — and add a line every time you make a non-routine disclosure. The discipline is recognizing the accountable disclosure in the moment, which is exactly what training a workforce of one is for.

Your accounting must also include disclosures made by your business associates on your behalf. A business associate is a vendor that creates, receives, maintains, or transmits protected health information for you, and your business associate agreement should require it to track and hand over its accountable disclosures on request 5Ref 5HHS Office for Civil Rights (2026).Business Associates.That business associates making disclosures on the practice's behalf must be under a BAA that requires them to track and provide their accountable disclosures.. If your billing service responds to a payer audit or a subpoena with your patients' information, that disclosure is yours to account for too.

When the request lands: verify, then produce

When a request arrives, verify who is asking before you produce anything. The patient can request their own accounting; a personal representative — a parent for most minor records, a legal guardian, a healthcare agent under a valid power — can request it on the patient's behalf, and you treat that representative as the patient 6Ref 6HHS Office for Civil Rights (2026).Personal Representatives.That a personal representative may request the accounting on the individual's behalf and is treated as the individual.. Confirm identity and authority first, then start the sixty-day clock.

Then work the accountable disclosures out of your log, assemble the entries, and deliver the accounting in the form requested where you can produce it. Producing an incomplete accounting — or none — is the kind of gap OCR has penalized in very small practices, not just hospital systems 7Ref 7HHS Office for Civil Rights (2026).HIPAA Compliance and Enforcement.That OCR enforces HIPAA obligations, including against very small practices, for failures such as an incomplete individual-rights response.. The covered-entity test is what puts you inside these rules in the first place, and your notice of privacy practices — the NPP — already tells patients this right exists, so treat a request as routine, documented work rather than an emergency.