Accounting of Disclosures

Under 45 CFR §164.528 an individual may ask for an accounting of the disclosures of their protected health information you made in the six years before the request. This register is where those disclosures are logged as they happen, and where the accounting is assembled — and handed over — when someone asks.

Logging a disclosure

Log a disclosure when PHI leaves your organization for a purpose that is not treatment, payment or health-care operations, and was not authorized by the individual. The form asks for the §164.528(b)(2) elements: the date, who received it, a brief description of what was disclosed, and the purpose.

• Record identifier is your own identifier for the individual (an MRN, a chart number). It is not a name field — the accounting is assembled by identifier so the ledger does not become a second copy of your patient list.
• Basis records the permission the disclosure rested on (required by law, public health, health oversight, …). Some bases are excluded from the accounting by §164.528(a)(1); the ledger keeps them anyway and marks them Excluded with the reason, so the individual who knows a disclosure happened is owed the reason, not a silent omission.

Assembling an accounting

Enter the record identifier and the date the individual asked. The register computes the six-year window back from the request date — not from today, so an accounting assembled a month later still covers the oldest month the individual is entitled to — and lists every accountable disclosure in it.

Export CSV / Excel produces the accounting as a file for the individual. It contains exactly the rows on screen for the same identifier and request date; excluded disclosures are counted, not listed.

Who can see this register

Org administrators only. Every row is about a specific individual, so the register takes the same gate as Individual Rights Requests, and its export takes the same gate as the page.