--- title: "45 CFR 164.528 HIPAA: Accounting of disclosures of protected health information" canonical: "https://dposchool.com/hipaa/section/164.528" source: "https://www.ecfr.gov/current/title-45/section-164.528" source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 45 CFR 164.528 HIPAA · Part 164: SECURITY AND PRIVACY · Subpart E: Privacy of Individually Identifiable Health Information # 45 CFR 164.528 HIPAA: Accounting of disclosures of protected health information eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text ### 45 CFR 164.528(a) **(a)** Standard: Right to an accounting of disclosures of protected health information. (1) An individual has a right to receive an accounting of disclosures of protected health information made by a covered entity in the six years prior to the date on which the accounting is requested, except for disclosures: ##### 45 CFR 164.528(a)(i) **(i)** To carry out treatment, payment and health care operations as provided in § 164.506; ##### 45 CFR 164.528(a)(ii) **(ii)** To individuals of protected health information about them as provided in § 164.502; ##### 45 CFR 164.528(a)(iii) **(iii)** Incident to a use or disclosure otherwise permitted or required by this subpart, as provided in § 164.502; ##### 45 CFR 164.528(a)(iv) **(iv)** Pursuant to an authorization as provided in § 164.508; ##### 45 CFR 164.528(a)(v) **(v)** For the facility's directory or to persons involved in the individual's care or other notification purposes as provided in § 164.510; ##### 45 CFR 164.528(a)(vi) **(vi)** For national security or intelligence purposes as provided in § 164.512(k)(2); ##### 45 CFR 164.528(a)(vii) **(vii)** To correctional institutions or law enforcement officials as provided in § 164.512(k)(5); ##### 45 CFR 164.528(a)(viii) **(viii)** As part of a limited data set in accordance with § 164.514(e); or ##### 45 CFR 164.528(a)(ix) **(ix)** That occurred prior to the compliance date for the covered entity. **(2)(i)** The covered entity must temporarily suspend an individual's right to receive an accounting of disclosures to a health oversight agency or law enforcement official, as provided in § 164.512(d) or (f), respectively, for the time specified by such agency or official, if such agency or official provides the covered entity with a written statement that such an accounting to the individual would be reasonably likely to impede the agency's activities and specifying the time for which such a suspension is required. ##### 45 CFR 164.528(a)(ii) **(ii)** If the agency or official statement in paragraph (a)(2)(i) of this section is made orally, the covered entity must: ###### 45 CFR 164.528(a)(ii)(A) **(A)** Document the statement, including the identity of the agency or official making the statement; ###### 45 CFR 164.528(a)(ii)(B) **(B)** Temporarily suspend the individual's right to an accounting of disclosures subject to the statement; and ###### 45 CFR 164.528(a)(ii)(C) **(C)** Limit the temporary suspension to no longer than 30 days from the date of the oral statement, unless a written statement pursuant to paragraph (a)(2)(i) of this section is submitted during that time. #### 45 CFR 164.528(a)(3) **(3)** An individual may request an accounting of disclosures for a period of time less than six years from the date of the request. ### 45 CFR 164.528(b) **(b)** Implementation specifications: Content of the accounting. The covered entity must provide the individual with a written accounting that meets the following requirements. #### 45 CFR 164.528(b)(1) **(1)** Except as otherwise provided by paragraph (a) of this section, the accounting must include disclosures of protected health information that occurred during the six years (or such shorter time period at the request of the individual as provided in paragraph (a)(3) of this section) prior to the date of the request for an accounting, including disclosures to or by business associates of the covered entity. #### 45 CFR 164.528(b)(2) **(2)** Except as otherwise provided by paragraphs (b)(3) or (b)(4) of this section, the accounting must include for each disclosure: ##### 45 CFR 164.528(b)(2)(i) **(i)** The date of the disclosure; ##### 45 CFR 164.528(b)(2)(ii) **(ii)** The name of the entity or person who received the protected health information and, if known, the address of such entity or person; ##### 45 CFR 164.528(b)(2)(iii) **(iii)** A brief description of the protected health information disclosed; and ##### 45 CFR 164.528(b)(2)(iv) **(iv)** A brief statement of the purpose of the disclosure that reasonably informs the individual of the basis for the disclosure or, in lieu of such statement, a copy of a written request for a disclosure under § 164.502(a)(2)(ii) or § 164.512, if any. #### 45 CFR 164.528(b)(3) **(3)** If, during the period covered by the accounting, the covered entity has made multiple disclosures of protected health information to the same person or entity for a single purpose under § 164.502(a)(2)(ii) or § 164.512, the accounting may, with respect to such multiple disclosures, provide: ##### 45 CFR 164.528(b)(3)(i) **(i)** The information required by paragraph (b)(2) of this section for the first disclosure during the accounting period; ##### 45 CFR 164.528(b)(3)(ii) **(ii)** The frequency, periodicity, or number of the disclosures made during the accounting period; and ##### 45 CFR 164.528(b)(3)(iii) **(iii)** The date of the last such disclosure during the accounting period. **(4)(i)** If, during the period covered by the accounting, the covered entity has made disclosures of protected health information for a particular research purpose in accordance with § 164.512(i) for 50 or more individuals, the accounting may, with respect to such disclosures for which the protected health information about the individual may have been included, provide: **(A)** The name of the protocol or other research activity; **(B)** A description, in plain language, of the research protocol or other research activity, including the purpose of the research and the criteria for selecting particular records; **(C)** A brief description of the type of protected health information that was disclosed; **(D)** The date or period of time during which such disclosures occurred, or may have occurred, including the date of the last such disclosure during the accounting period; **(E)** The name, address, and telephone number of the entity that sponsored the research and of the researcher to whom the information was disclosed; and **(F)** A statement that the protected health information of the individual may or may not have been disclosed for a particular protocol or other research activity. ##### 45 CFR 164.528(b)(3)(ii) **(ii)** If the covered entity provides an accounting for research disclosures, in accordance with paragraph (b)(4) of this section, and if it is reasonably likely that the protected health information of the individual was disclosed for such research protocol or activity, the covered entity shall, at the request of the individual, assist in contacting the entity that sponsored the research and the researcher. ### 45 CFR 164.528(c) **(c)** Implementation specifications: Provision of the accounting. (1) The covered entity must act on the individual's request for an accounting, no later than 60 days after receipt of such a request, as follows. ##### 45 CFR 164.528(c)(i) **(i)** The covered entity must provide the individual with the accounting requested; or ##### 45 CFR 164.528(c)(ii) **(ii)** If the covered entity is unable to provide the accounting within the time required by paragraph (c)(1) of this section, the covered entity may extend the time to provide the accounting by no more than 30 days, provided that: ###### 45 CFR 164.528(c)(ii)(A) **(A)** The covered entity, within the time limit set by paragraph (c)(1) of this section, provides the individual with a written statement of the reasons for the delay and the date by which the covered entity will provide the accounting; and ###### 45 CFR 164.528(c)(ii)(B) **(B)** The covered entity may have only one such extension of time for action on a request for an accounting. #### 45 CFR 164.528(c)(2) **(2)** The covered entity must provide the first accounting to an individual in any 12 month period without charge. The covered entity may impose a reasonable, cost-based fee for each subsequent request for an accounting by the same individual within the 12 month period, provided that the covered entity informs the individual in advance of the fee and provides the individual with an opportunity to withdraw or modify the request for a subsequent accounting in order to avoid or reduce the fee. ### 45 CFR 164.528(d) **(d)** Implementation specification: Documentation. A covered entity must document the following and retain the documentation as required by § 164.530(j): #### 45 CFR 164.528(d)(1) **(1)** The information required to be included in an accounting under paragraph (b) of this section for disclosures of protected health information that are subject to an accounting under paragraph (a) of this section; #### 45 CFR 164.528(d)(2) **(2)** The written accounting that is provided to the individual under this section; and #### 45 CFR 164.528(d)(3) **(3)** The titles of the persons or offices responsible for receiving and processing requests for an accounting by individuals. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source credit: \[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53271, Aug. 14, 2002\] [45 CFR 164.528 on eCFR](https://www.ecfr.gov/current/title-45/section-164.528) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [HIPAA Navigator](https://dposchool.com/hipaa) / 45 CFR 164.528 Previous: [45 CFR 164.526 HIPAA: Amendment of protected health information](https://dposchool.com/hipaa/section/164.526) Next: [45 CFR 164.530 HIPAA: Administrative requirements](https://dposchool.com/hipaa/section/164.530) ## For AI agents - Machine-readable index: https://dposchool.com/hipaa/llms.txt - JSON API: https://dposchool.com/hipaa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents