[Code of Federal Regulations]
[Title 45, Volume 1]
[Revised as of October 1, 2001]
From the U.S. Government Printing Office via GPO Access
[CITE: 45CFR164.528]

[Page 724-725]
 
                        TITLE 45--PUBLIC WELFARE
 
                    SUBTITLE A--DEPARTMENT OF HEALTH
                           AND HUMAN SERVICES
 
PART 164--SECURITY AND PRIVACY--Table of Contents
 
   Subpart E--Privacy of Individually Identifiable Health Information
 
Sec. 164.528  Accounting of disclosures of protected health information.

    (a) Standard: Right to an accounting of disclosures of protected 
health information. (1) An individual has a right to receive an 
accounting of disclosures of protected health information made by a 
covered entity in the six years prior to the date on which the 
accounting is requested, except for disclosures:
    (i) To carry out treatment, payment and health care operations as 
provided in Sec. 164.502;
    (ii) To individuals of protected health information about them as 
provided in Sec. 164.502;
    (iii) For the facility's directory or to persons involved in the 
individual's care or other notification purposes as provided in 
Sec. 164.510;
    (iv) For national security or intelligence purposes as provided in 
Sec. 164.512(k)(2);
    (v) To correctional institutions or law enforcement officials as 
provided in Sec. 164.512(k)(5); or
    (vi) That occurred prior to the compliance date for the covered 
entity.
    (2)(i) The covered entity must temporarily suspend an individual's 
right to receive an accounting of disclosures to a health oversight 
agency or law enforcement official, as provided in Sec. 164.512(d) or 
(f), respectively, for the time specified by such agency or official, if 
such agency or official provides the covered entity with a written 
statement that such an accounting to the individual would be reasonably 
likely to impede the agency's activities and specifying the time for 
which such a suspension is required.
    (ii) If the agency or official statement in paragraph (a)(2)(i) of 
this section is made orally, the covered entity must:
    (A) Document the statement, including the identity of the agency or 
official making the statement;
    (B) Temporarily suspend the individual's right to an accounting of 
disclosures subject to the statement; and
    (C) Limit the temporary suspension to no longer than 30 days from 
the date of the oral statement, unless a written statement pursuant to 
paragraph (a)(2)(i) of this section is submitted during that time.
    (3) An individual may request an accounting of disclosures for a 
period of time less than six years from the date of the request.

[[Page 725]]

    (b) Implementation specifications: Content of the accounting. The 
covered entity must provide the individual with a written accounting 
that meets the following requirements.
    (1) Except as otherwise provided by paragraph (a) of this section, 
the accounting must include disclosures of protected health information 
that occurred during the six years (or such shorter time period at the 
request of the individual as provided in paragraph (a)(3) of this 
section) prior to the date of the request for an accounting, including 
disclosures to or by business associates of the covered entity.
    (2) The accounting must include for each disclosure:
    (i) The date of the disclosure;
    (ii) The name of the entity or person who received the protected 
health information and, if known, the address of such entity or person;
    (iii) A brief description of the protected health information 
disclosed; and
    (iv) A brief statement of the purpose of the disclosure that 
reasonably informs the individual of the basis for the disclosure; or, 
in lieu of such statement:
    (A) A copy of the individual's written authorization pursuant to 
Sec. 164.508; or
    (B) A copy of a written request for a disclosure under 
Secs. 164.502(a)(2)(ii) or 164.512, if any.
    (3) If, during the period covered by the accounting, the covered 
entity has made multiple disclosures of protected health information to 
the same person or entity for a single purpose under 
Secs. 164.502(a)(2)(ii) or 164.512, or pursuant to a single 
authorization under Sec. 164.508, the accounting may, with respect to 
such multiple disclosures, provide:
    (i) The information required by paragraph (b)(2) of this section for 
the first disclosure during the accounting period;
    (ii) The frequency, periodicity, or number of the disclosures made 
during the accounting period; and
    (iii) The date of the last such disclosure during the accounting 
period.
    (c) Implementation specifications: Provision of the accounting. (1) 
The covered entity must act on the individual's request for an 
accounting, no later than 60 days after receipt of such a request, as 
follows.
    (i) The covered entity must provide the individual with the 
accounting requested; or
    (ii) If the covered entity is unable to provide the accounting 
within the time required by paragraph (c)(1) of this section, the 
covered entity may extend the time to provide the accounting by no more 
than 30 days, provided that:
    (A) The covered entity, within the time limit set by paragraph 
(c)(1) of this section, provides the individual with a written statement 
of the reasons for the delay and the date by which the covered entity 
will provide the accounting; and
    (B) The covered entity may have only one such extension of time for 
action on a request for an accounting.
    (2) The covered entity must provide the first accounting to an 
individual in any 12 month period without charge. The covered entity may 
impose a reasonable, cost-based fee for each subsequent request for an 
accounting by the same individual within the 12 month period, provided 
that the covered entity informs the individual in advance of the fee and 
provides the individual with an opportunity to withdraw or modify the 
request for a subsequent accounting in order to avoid or reduce the fee.
    (d) Implementation specification: Documentation. A covered entity 
must document the following and retain the documentation as required by 
Sec. 164.530(j):
    (1) The information required to be included in an accounting under 
paragraph (b) of this section for disclosures of protected health 
information that are subject to an accounting under paragraph (a) of 
this section;
    (2) The written accounting that is provided to the individual under 
this section; and
    (3) The titles of the persons or offices responsible for receiving 
and processing requests for an accounting by individuals.