Most people know they have a right to see their own medical records. Fewer know they also have a right to ask who else has seen them, or more precisely, to whom their provider or health plan has disclosed them. HIPAA calls this an accounting of disclosures. It is a narrower right than it sounds, with significant exceptions, but it is a real tool when you suspect your information went somewhere it should not have, or when you simply want to understand how your records move.
What an accounting of disclosures is
Under the HIPAA Privacy Rule, you can ask a covered entity, meaning a health care provider, health plan, or health care clearinghouse, for a written accounting of disclosures of your protected health information made in the six years before your request. A disclosure is a release of your information to someone outside the covered entity. The accounting lists each qualifying disclosure with the date, who received the information, a brief description of what was disclosed, and the purpose. If the same recipient received information repeatedly for the same purpose, the entity can summarize the series rather than listing every instance.
What it includes
The accounting captures disclosures the law treats as outside the ordinary course of your care and coverage. Common examples:
- Disclosures required by law, such as reports to public health authorities of certain diseases or reports of suspected abuse or neglect.
- Disclosures to law enforcement, courts, or in response to subpoenas.
- Disclosures for health oversight activities, such as to a licensing board or a government auditor.
- Disclosures to coroners, medical examiners, or funeral directors.
- Disclosures for research that did not require your authorization, such as under an institutional review board waiver.
- Disclosures made in error, including breaches, where information went to the wrong recipient.
- Disclosures made by the entity's business associates, which the covered entity must obtain and include.
What it leaves out
The exceptions are where people are most often surprised. The accounting does not have to include:
- Disclosures for treatment, payment, or health care operations. Your provider sending records to a specialist, submitting a claim to your insurer, or sharing with a quality-review contractor will not appear. This is by far the largest category of routine disclosures.
- Disclosures you authorized in writing, since you already know about those.
- Disclosures to you, or to family and friends involved in your care where you had the chance to object.
- Disclosures for a facility directory or for national security and certain correctional-facility purposes.
- Incidental disclosures, such as a name overheard in a waiting room.
- Disclosures made more than six years ago.
Because treatment and payment disclosures are excluded, the accounting will not tell you every clinician who opened your chart inside a hospital. That is internal use, not disclosure. Some organizations will voluntarily provide an internal access log on request, and state law in a few places gives patients broader rights, but HIPAA's accounting right does not reach that far.
How to request one
- Find the right office. Requests go to the covered entity's privacy officer or health information management (medical records) department. The Notice of Privacy Practices you received lists the contact.
- Put it in writing. Many organizations have a form; if not, a short letter or secure message works. State that you are requesting an accounting of disclosures of your protected health information under HIPAA, identify yourself with name, date of birth, and any patient identifier, and specify the period. You may request up to six years; a shorter, targeted window often produces a faster answer.
- Note the timeline. The entity must respond within 60 days, and may extend once by 30 days if it tells you in writing why and when to expect the response.
- Know the cost rule. The first accounting in any twelve-month period must be free. The entity may charge a reasonable, cost-based fee for additional requests within the same year, but must tell you the fee in advance and give you the chance to withdraw or modify the request.
If you are requesting on behalf of someone else, such as a minor child or a person for whom you hold health care power of attorney, include documentation of your authority as a personal representative.
Reading the response
A response with few or no entries is common and usually means nothing unusual happened, given how much routine sharing is excluded. Look closely at any entry you did not expect, particularly disclosures to law enforcement, to attorneys, or to a recipient you do not recognize. An entry described as an erroneous disclosure or misdirected release is significant; the entity should have already notified you if it qualified as a breach, and if it did not, you can ask why. If the response says a disclosure was made pursuant to a court order or subpoena, you can ask for a copy of the order.
If the entity refuses to provide an accounting, misses the deadline without explanation, or charges for a first request, you can file a complaint with the entity's privacy officer and with the HHS Office for Civil Rights. Complaints to OCR must generally be filed within 180 days of when you knew of the issue.
Beyond the accounting
The accounting of disclosures is one of several tools. If you want to know who inside an organization viewed your record, ask directly for an access log or audit report; the organization is not required by HIPAA to give you one, but many will, and some state laws require it. If you want to limit future sharing, you can request restrictions on how your information is used or disclosed, and the entity must honor a restriction on disclosures to your health plan for services you paid for entirely out of pocket. If you find errors in what was disclosed, you can request an amendment to the record. Used together, these rights give you a reasonable picture of how your information travels and a way to change it.
Common questions
What is an accounting of disclosures under HIPAA?
It is a written list a covered entity must provide on request showing certain disclosures of your protected health information made in the prior six years, including the date, the recipient, what was disclosed, and why. It excludes routine disclosures for treatment, payment, and health care operations, and disclosures you authorized.
Will an accounting of disclosures show me every doctor or nurse who looked at my chart?
No. Internal access by an organization's own workforce is a use, not a disclosure, and treatment-related sharing is excluded from the accounting. You can separately ask the organization for an access log, which many will provide voluntarily and some state laws require.
How long does a provider have to respond and what can it charge?
The provider must respond within 60 days, with one possible 30-day extension if it notifies you in writing. The first accounting in a twelve-month period must be free; additional requests in the same year may carry a reasonable cost-based fee disclosed in advance.
What if the provider refuses or ignores my request?
Contact the organization's privacy officer first. If that does not resolve it, you can file a complaint with the HHS Office for Civil Rights, generally within 180 days of when you became aware of the problem.