[Code of Federal Regulations]
[Title 45, Volume 1]
[Revised as of October 1, 2004]
From the U.S. Government Printing Office via GPO Access
[CITE: 45CFR164.528]

[Page 777-779]
 
                        TITLE 45--PUBLIC WELFARE
 
                    SUBTITLE A--DEPARTMENT OF HEALTH
                         AND HUMAN SERVICES
 
PART 164_SECURITY AND PRIVACY--Table of Contents
 
    Subpart E_Privacy of Individually Identifiable Health Information
 
Sec. 164.528  Accounting of disclosures of protected health information.

    (a) Standard: Right to an accounting of disclosures of protected 
health information. (1) An individual has a right to receive an 
accounting of disclosures of protected health information made by a 
covered entity in the six years prior to the date on which the 
accounting is requested, except for disclosures:
    (i) To carry out treatment, payment and health care operations as 
provided in Sec. 164.506;
    (ii) To individuals of protected health information about them as 
provided in Sec. 164.502;
    (iii) Incident to a use or disclosure otherwise permitted or 
required by this subpart, as provided in Sec. 164.502;
    (iv) Pursuant to an authorization as provided in Sec. 164.508;
    (v) For the facility's directory or to persons involved in the 
individual's care or other notification purposes as provided in Sec. 
164.510;
    (vi) For national security or intelligence purposes as provided in 
Sec. 164.512(k)(2);
    (vii) To correctional institutions or law enforcement officials as 
provided in Sec. 164.512(k)(5);
    (viii) As part of a limited data set in accordance with Sec. 
164.514(e); or
    (ix) That occurred prior to the compliance date for the covered 
entity.
    (2)(i) The covered entity must temporarily suspend an individual's 
right to receive an accounting of disclosures to a health oversight 
agency or law enforcement official, as provided in Sec. 164.512(d) or 
(f), respectively, for the

[[Page 778]]

time specified by such agency or official, if such agency or official 
provides the covered entity with a written statement that such an 
accounting to the individual would be reasonably likely to impede the 
agency's activities and specifying the time for which such a suspension 
is required.
    (ii) If the agency or official statement in paragraph (a)(2)(i) of 
this section is made orally, the covered entity must:
    (A) Document the statement, including the identity of the agency or 
official making the statement;
    (B) Temporarily suspend the individual's right to an accounting of 
disclosures subject to the statement; and
    (C) Limit the temporary suspension to no longer than 30 days from 
the date of the oral statement, unless a written statement pursuant to 
paragraph (a)(2)(i) of this section is submitted during that time.
    (3) An individual may request an accounting of disclosures for a 
period of time less than six years from the date of the request.
    (b) Implementation specifications: Content of the accounting. The 
covered entity must provide the individual with a written accounting 
that meets the following requirements.
    (1) Except as otherwise provided by paragraph (a) of this section, 
the accounting must include disclosures of protected health information 
that occurred during the six years (or such shorter time period at the 
request of the individual as provided in paragraph (a)(3) of this 
section) prior to the date of the request for an accounting, including 
disclosures to or by business associates of the covered entity.
    (2) Except as otherwise provided by paragraphs (b)(3) or (b)(4) of 
this section, the accounting must include for each disclosure:
    (i) The date of the disclosure;
    (ii) The name of the entity or person who received the protected 
health information and, if known, the address of such entity or person;
    (iii) A brief description of the protected health information 
disclosed; and
    (iv) A brief statement of the purpose of the disclosure that 
reasonably informs the individual of the basis for the disclosure or, in 
lieu of such statement, a copy of a written request for a disclosure 
under Sec. Sec. 164.502(a)(2)(ii) or 164.512, if any.
    (3) If, during the period covered by the accounting, the covered 
entity has made multiple disclosures of protected health information to 
the same person or entity for a single purpose under Sec. Sec. 
164.502(a)(2)(ii) or 164.512, the accounting may, with respect to such 
multiple disclosures, provide:
    (i) The information required by paragraph (b)(2) of this section for 
the first disclosure during the accounting period;
    (ii) The frequency, periodicity, or number of the disclosures made 
during the accounting period; and
    (iii) The date of the last such disclosure during the accounting 
period.
    (4)(i) If, during the period covered by the accounting, the covered 
entity has made disclosures of protected health information for a 
particular research purpose in accordance with Sec. 164.512(i) for 50 
or more individuals, the accounting may, with respect to such 
disclosures for which the protected health information about the 
individual may have been included, provide:
    (A) The name of the protocol or other research activity;
    (B) A description, in plain language, of the research protocol or 
other research activity, including the purpose of the research and the 
criteria for selecting particular records;
    (C) A brief description of the type of protected health information 
that was disclosed;
    (D) The date or period of time during which such disclosures 
occurred, or may have occurred, including the date of the last such 
disclosure during the accounting period;
    (E) The name, address, and telephone number of the entity that 
sponsored the research and of the researcher to whom the information was 
disclosed; and
    (F) A statement that the protected health information of the 
individual may or may not have been disclosed for a particular protocol 
or other research activity.
    (ii) If the covered entity provides an accounting for research 
disclosures, in accordance with paragraph (b)(4) of

[[Page 779]]

this section, and if it is reasonably likely that the protected health 
information of the individual was disclosed for such research protocol 
or activity, the covered entity shall, at the request of the individual, 
assist in contacting the entity that sponsored the research and the 
researcher.
    (c) Implementation specifications: Provision of the accounting. (1) 
The covered entity must act on the individual's request for an 
accounting, no later than 60 days after receipt of such a request, as 
follows.
    (i) The covered entity must provide the individual with the 
accounting requested; or
    (ii) If the covered entity is unable to provide the accounting 
within the time required by paragraph (c)(1) of this section, the 
covered entity may extend the time to provide the accounting by no more 
than 30 days, provided that:
    (A) The covered entity, within the time limit set by paragraph 
(c)(1) of this section, provides the individual with a written statement 
of the reasons for the delay and the date by which the covered entity 
will provide the accounting; and
    (B) The covered entity may have only one such extension of time for 
action on a request for an accounting.
    (2) The covered entity must provide the first accounting to an 
individual in any 12 month period without charge. The covered entity may 
impose a reasonable, cost-based fee for each subsequent request for an 
accounting by the same individual within the 12 month period, provided 
that the covered entity informs the individual in advance of the fee and 
provides the individual with an opportunity to withdraw or modify the 
request for a subsequent accounting in order to avoid or reduce the fee.
    (d) Implementation specification: Documentation. A covered entity 
must document the following and retain the documentation as required by 
Sec. 164.530(j):
    (1) The information required to be included in an accounting under 
paragraph (b) of this section for disclosures of protected health 
information that are subject to an accounting under paragraph (a) of 
this section;
    (2) The written accounting that is provided to the individual under 
this section; and
    (3) The titles of the persons or offices responsible for receiving 
and processing requests for an accounting by individuals.

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53271, Aug. 14, 2002]