Executive summary. An accounting request asks an organization to identify certain disclosures of protected health information, within HIPAA’s scope and exceptions.
Definition
An accounting of disclosures is a record of certain disclosures of protected health information that an individual may have a right to receive under HIPAA.
Identify the request correctly
A request for copies of records and a request for an accounting of disclosures are different rights, with different questions and exceptions. Sort them at intake.
Capture the requested time period and route the request to staff who can evaluate the applicable scope.
Prepare a supported answer
Gather the relevant disclosure information and check it against the organization’s records. Where a disclosure is excluded, record the basis for that conclusion in the request file.
Explain the response in plain language. The individual should be able to see who received information and why, where the rule requires an accounting.
Frequently asked questions
Does every use of information create an accounting entry?
No. HIPAA distinguishes uses from disclosures and includes exceptions. Evaluate the request under the applicable regulation.
Referenced standards and further reading
- HHS OCR: Accounting of Disclosures ↗U.S. Department of Health and Human Services
Related articles
HIPAA Security Rule risk analysis: scope, evidence, decisions →
The minimum necessary standard in operational design →
Business associate relationships: map the work, not the logo →