NRPM: Standards for Privacy of Individually Identifiable Health Information. §164.515 Accounting for uses and disclosures of protected health information.


Given that the burden associated with maintaining records to facilitate the recreation of disclosures will differ significantly, be the type and size of plan or provider, we are explicitly soliciting comment on the burden associated with the following proposed record keeping requirement:

  • A covered entity that is a plan or provider would need to be able to give individuals an accurate accounting of all uses and disclosures that are for purposes other than treatment, payment, and health care operations; except that such procedures would provide for the exclusion from such accounting of protected health information which is disclosed to a health oversight or law enforcement agency, if the health oversight or law enforcement agency provides a written request stating that the exclusion is necessary because disclosure would be reasonably likely to impede the agency’s activities and specifies the time for which such exclusion is required.