When required, what information must be provided to the data subject in a HIPAA disclosure accounting?
A HIPAA accounting of disclosures must cover disclosures from the six years before the request and, for each one, list the date of disclosure, the recipient's name and address, a brief description of the PHI disclosed, and the purpose of the disclosure.
The answer
Under the HIPAA Privacy Rule (45 CFR 164.528), an individual has the right to receive an accounting of disclosures of their protected health information (PHI). When a covered entity provides this accounting, each disclosure entry must include four core elements:
- The date the disclosure was made.
- The name of the recipient (the person or entity that received the PHI) and, if known, that recipient's address.
- A brief description of the PHI that was disclosed.
- A brief statement of the purpose of the disclosure (or a copy of the written request that prompted it).
The accounting must cover disclosures made during the six years prior to the date of the request (or a shorter period if the individual asks for one). If the same recipient received multiple disclosures for a single purpose, the entity may summarize them: list the first disclosure fully, then note the frequency or number of disclosures and the date of the last one.
Why the other options are wrong
Quiz versions of this question usually offer distractors that confuse what an accounting captures:
- "Only disclosures the patient authorized." Wrong — authorized disclosures (those the patient signed off on) are actually exempt from the accounting. The accounting exists mainly to reveal disclosures the patient may not know about, such as those required by law or for public health.
- "Every disclosure the covered entity ever made." Wrong — the right is limited to the six-year lookback window, and several categories are excluded (see below).
- "Just the date and recipient." Incomplete — the description of the PHI and the purpose are equally required; without them the accounting would not tell the patient what was actually shared or why.
- "Disclosures for treatment, payment, and operations." Wrong — these routine TPO disclosures are specifically excluded from the accounting requirement.
The bigger picture: what is excluded and the timeline
HIPAA deliberately carves out disclosures the patient either authorized or would reasonably expect. Excluded from the accounting are disclosures:
- For treatment, payment, and health care operations (TPO).
- Made to the individual themselves.
- Made pursuant to a valid authorization.
- For a facility directory or to persons involved in the individual's care.
- Incidental disclosures, and certain national-security or law-enforcement custody situations.
- Part of a limited data set.
On timing, the covered entity must act on the request within 60 days, with one permitted 30-day extension if it gives the individual a written reason. The first accounting in any 12-month period is free; the entity may charge a reasonable, cost-based fee for additional requests within that year, but only after warning the individual so they can withdraw or narrow the request. A practical sample log entry looks like: Date: 03/14/2026 | Recipient: State Dept. of Public Health, 100 Main St. | PHI disclosed: positive lab result | Purpose: mandatory communicable-disease reporting.
| Date | When the disclosure occurred | 03/14/2026 |
| Recipient | Name and address of who received the PHI | State Dept. of Public Health, 100 Main St. |
| Description of PHI | What information was shared | Positive lab test result |
| Purpose | Why it was disclosed | Mandatory communicable-disease reporting |
Frequently asked
What must a HIPAA accounting of disclosures include?
For each disclosure it must state the date, the recipient's name and address, a brief description of the PHI disclosed, and the purpose of the disclosure. Repeated disclosures to the same recipient for one purpose may be summarized rather than listed individually.
How far back does a HIPAA disclosure accounting go?
The accounting covers disclosures made in the six years immediately before the date of the request. An individual may ask for a shorter period, but six years is the maximum lookback a covered entity is required to provide.
Which disclosures are exempt from the accounting requirement?
Disclosures for treatment, payment, and health care operations, those made to the individual, those made under a signed authorization, facility-directory disclosures, incidental disclosures, and disclosures as part of a limited data set are all excluded from the accounting.
How long does a covered entity have to respond to an accounting request?
It must provide the accounting within 60 days of the request. One 30-day extension is allowed if the covered entity gives the individual a written statement of the reason for the delay and the date by which it will comply.
Can a covered entity charge a fee for an accounting of disclosures?
The first accounting requested within any 12-month period must be free. For additional requests in that same period, the entity may charge a reasonable, cost-based fee, but only after informing the individual so they can withdraw or modify the request.