§164.528(a) Right to an accounting of disclosures of protected health information.
(1) An individual has a right to receive an accounting of disclosures of protected health information made by a covered entity in the six years to the date on which the accounting is requested, except for disclosures: (i) To carry out treatment, payment and health care operations as provided in §164.506; (ii) To individuals of protected health information about them as provided in §164.502; (iii) Incident to a use or disclosure otherwise permitted or required by this subpart, as provided in §164.502; (iv) Pursuant to an authorization as provided in §164.508; (v) For the facility’s directory or to persons involved in the individual’s care or other notification purposes as provided in §164.510; (vi) For national security or intelligence purposes as provided in §164.512(k)(2); (vii) To correctional institutions or law enforcement officials as provided in §164.512(k)(5); (viii) As part of a limited data set in accordance with §164.514(e); or (ix) That occurred prior to the compliance data for the covered entity.
(2)(i) The covered entity must temporarily suspend an individual’s right to receive an accounting of disclosures to a health oversight agency or law enforcement official, as provided in § 164.512(d) or (f), respectively, for the time specified by such agency or official, if such agency or official provides the covered entity with a written statement that such an accounting to the individual would be reasonably likely to impede the agency’s activities and specifying the time for which such a suspension is required. (ii) If the agency or official statement in paragraph (a)(2)(i) of this section is made orally, the covered entity must: (A) Document the statement, including the identity of the agency or official making the statement; (B) Temporarily suspend the individual’s right to an accounting of disclosures subject to the statement; and (C) Limit the temporary suspension to no longer than 30 days from the date of the oral statement, unless a written statement pursuant to paragraph (a)(2)(i) of this section is submitted during that time.
(3) An individual may request an accounting of disclosures for a period of time less than six years from the date of the request.
Audit Inquiry
Does the covered entity have policies and procedures consistent with the established performance criterion for implementing an individual’s right to an accounting of disclosures of PHI?
Obtain and review policies and procedures in place to document and respond to a request for an accounting. Consider whether such documentation limits grounds for denials to the ones listed in the established performance criterion.