The list of who your health records went to

The short answer

The federal medical privacy rules give an individual a right to receive an accounting of disclosures of protected health information made by a covered entity in the six years prior to the date the accounting is requested.

The rules then list nine categories of disclosure that the accounting does not have to include. Those exclusions define the right more than the right defines itself.

Where a disclosure is inside the right, the accounting has to be written and has to identify, for each disclosure, the date, the name of the entity or person who received the information and, if known, their address, a brief description of the information disclosed, and a brief statement of the purpose that reasonably informs the individual of the basis for the disclosure.

A covered entity must act on a request no later than sixty days after receiving it, and the first accounting in any twelve-month period must be provided without charge.

The nine exclusions, and why they matter more than the right

The accounting does not have to include disclosures made to carry out treatment, payment and health care operations. That is the single largest category of ordinary movement of a medical record, and it is the first exclusion listed.

It also excludes disclosures to the individual themselves; disclosures incident to a use or disclosure otherwise permitted or required; disclosures made pursuant to an authorization; and disclosures for a facility directory, to persons involved in the individual's care, or for other notification purposes.

It excludes disclosures for national security or intelligence purposes, and disclosures to correctional institutions or law enforcement officials under the specific provisions the rules name.

It excludes disclosures made as part of a limited data set, which is a defined category of information stripped of sixteen direct identifiers but still protected. And it excludes disclosures that occurred prior to the compliance date for that covered entity.

Two of those deserve emphasis for a reader deciding whether to make a request. Anything the individual signed an authorization for is outside the accounting, so information handed over on the strength of a consent form does not appear. And routine treatment, payment and operations movement is outside it too.

What is left is largely the category of disclosure that happened without the individual's permission and outside routine operation. That is a narrower and more specific thing than a log of everyone who saw a record.

When the right can be paused

The rules provide for temporary suspension of the right in one situation, and they place conditions on it.

A covered entity must temporarily suspend an individual's right to receive an accounting of disclosures to a health oversight agency or law enforcement official for the time specified by that agency or official, if the agency or official provides a written statement that such an accounting to the individual would be reasonably likely to impede the agency's activities, and specifies the time for which the suspension is required.

If the statement is made orally, the covered entity must document it, including the identity of the agency or official making it, temporarily suspend the right, and limit the suspension to no longer than thirty days from the date of the oral statement, unless a written statement is submitted in that time.

So an oral request has a hard ceiling and a written one carries its own specified period. Both leave a documentation trail inside the covered entity.

What an accounting has to say, and where it may summarise

The default is one entry per disclosure with four elements: date, recipient and address if known, a brief description of the information disclosed, and a brief statement of purpose. In place of the purpose statement, the rules permit a copy of a written request for the disclosure where one exists under the provisions they name.

Two aggregation allowances exist, and both change what a reader sees.

Where the covered entity made multiple disclosures to the same person or entity for a single purpose under the named provisions, the accounting may give the full detail for the first disclosure in the period, then the frequency, periodicity or number of disclosures made during the period, and the date of the last one.

Where the covered entity made disclosures for a particular research purpose for fifty or more individuals, the accounting may substitute a description of the research activity: the name of the protocol or activity; a plain-language description including the purpose of the research and the criteria for selecting particular records; a brief description of the type of information disclosed; the date or period during which the disclosures occurred or may have occurred, including the date of the last one; the name, address and telephone number of the entity that sponsored the research and of the researcher to whom the information was disclosed; and a statement that the individual's information may or may not have been disclosed for that protocol.

That last element is unusual and worth reading twice. Under the research aggregation route, the accounting is permitted to say the individual's information may or may not have been included. The rules add a companion duty: where it is reasonably likely that the individual's information was disclosed for that protocol, the covered entity must, at the individual's request, assist in contacting the sponsor and the researcher.

The clock and the fee

The covered entity must act on a request no later than sixty days after receiving it, either by providing the accounting or by extending the time.

An extension is limited in three ways. It may be no more than thirty days. The entity must, within the original sixty days, give the individual a written statement of the reasons for the delay and the date by which the accounting will be provided. And it may have only one such extension for action on a request.

On cost, the first accounting to an individual in any twelve-month period must be provided without charge. For a subsequent request by the same individual within that period, the entity may impose a reasonable, cost-based fee, provided it informs the individual of the fee in advance and gives them an opportunity to withdraw or modify the request in order to avoid or reduce it.

An individual may also request an accounting for a period shorter than six years, which is a way of narrowing what comes back.

What the entity has to keep

The section ends with a documentation requirement, and it is the part that makes the right auditable rather than merely declared.

A covered entity must document, and retain in accordance with the general documentation retention rule, the information required to be included in an accounting for disclosures subject to the right, the written accounting provided to the individual, and the titles of the persons or offices responsible for receiving and processing requests for an accounting.

That third item is the smallest and the most practical. The rules require a covered entity to have named who handles these requests.

The whole section applies to covered entities as the regulations define that term. A company outside those definitions is not brought inside them here, and this article makes no claim about which sellers in this market are or are not covered entities.

The accounting right is also a different right from the right of access to one's own records, which runs on its own timing and its own exclusions. Confusing the two produces disappointment in both directions: the accounting will not hand over a chart, and an access request will not produce a list of recipients.

Sources

Each document below is named as it names itself, with the date printed on that document rather than the day it was read.

1. Title 45 Code of Federal Regulations Section 164.528, Accounting of disclosures of protected health information, read in full — the six year right and its nine exclusions at (a)(1), the health oversight and law enforcement suspension at (a)(2), the four required content elements and the multiple-disclosure and research aggregation allowances at (b), the sixty day deadline, single thirty day extension and twelve month fee rule at (c), and the documentation requirement at (d); amendment note 65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53271, Aug. 14, 2002 — Electronic Code of Federal Regulations, Office of the Federal Register, September 2026