(a) Standard: right to an accounting of disclosures of protected health information. An individual has a right to receive an accounting of all disclosures of protected health information made by a covered entity as long as such information is maintained by the entity, except for disclosures:
(1) For treatment, payment and health care operations; and
(2) To health oversight or law enforcement agencies, if the health oversight or law enforcement agency has provided a written request stating that the exclusion is necessary because disclosure would be reasonably likely to impede the agency’s activities and specifying the time for which such exclusion is required.
(b) Standard: procedures for accounting. A covered entity must have procedures to give individuals an accurate accounting of disclosures for which an accounting is required by paragraph (a) of this section.
(c) Implementation specifications: accounting procedures. The procedures required by paragraph (b) of this section must:
(1) Provide for an accounting of the following:
(i) The date of each disclosure;
(ii) The name and address of the organization or person who received the protected health information;
(iii) A brief description of the information disclosed;
(iv) For disclosures other than those made at the request of the individual, the purpose for which the information was disclosed; and
(v) Provision of copies of all requests for disclosure.
(2) Provide the accounting to the individual as soon as possible, but no later than 30 days of receipt of the request therefor.
(3) Provide for a means of accounting for as long as the entity maintains the protected health information.
(4) Provide for a means of requiring business partners to provide such an accounting upon request of the covered entity.