HIPAA (45 CFR Part 164) 164.528(a) — Right to an Accounting of Disclosures of PHI

What this control requires

Right to an accounting of disclosures of protected health information. (1) An individual has a right to receive an accounting of disclosures of protected health information made by a covered entity in the six years to the date on which the accounting is requested, except for disclosures: (i) To carry out treatment, payment and health care operations as provided in 164.506; (ii) To individuals of protected health information about them as provided in 164.502; (iii) Incident to a use or disclosure otherwise permitted or required by this subpart, as provided in 164.502; (iv) Pursuant to an authorization as provided in 164.508; (v) For the facility's directory or to persons involved in the individual's care or other notification purposes as provided in 164.510; (vi) For national security or intelligence purposes as provided in 164.512(k)(2); (vii) To correctional institutions or law enforcement officials as provided in 164.512(k)(5); (viii) As part of a limited data set in accordance with 164.514(e); or (ix) That occurred prior to the compliance data for the covered entity. (2)(i) The covered entity must temporarily suspend an individual's right to receive an accounting of disclosures to a health oversight agency or law enforcement official, as provided in 164.512(d) or (f), respectively, for the time specified by such agency or official, if such agency or official provides the covered entity with a written statement that such an accounting to the individual would be reasonably likely to impede the agency's activities and specifying the time for which such a suspension is required. (ii) If the agency or official statement in paragraph (a)(2)(i) of this section is made orally, the covered entity must: (A) Document the statement, including the identity of the agency or official making the statement; (B) Temporarily suspend the individual's right to an accounting of disclosures subject to the statement; and (C) Limit the temporary suspension to no longer than 30 days from the date of the oral statement, unless a written statement pursuant to paragraph (a)(2)(i) of this section is submitted during that time. (3) An individual may request an accounting of disclosures for a period of time less than six years from the date of the request.

In plain English

Right to an accounting of disclosures of protected health information. In practice, this means you can prove you security security-level controls on a defined cadence.

Why it matters

HIPAA non-compliance is a strict-liability matter: OCR civil monetary penalties are assessed per-record per-violation (up to USD 1.9 million per identical-violation calendar year as of 2024), and willful neglect can trigger criminal referral.

What an auditor looks for

HHS OCR investigators and SOC-2+HIPAA auditors look for the specific 45 CFR § citation, whether the safeguard is required vs addressable (and if addressable, the documented decision), the implementation specification, the workforce member responsible, and the records that show it runs.

Within Privacy Rule, the assessor will trace your implementation back to the catalogue reference (§ 164.528(a)) and look for objective evidence on the latest two assessment cycles.

How to implement

Policy Management

Docs. Keep each policy in version-controlled Markdown alongside the code that implements it; ship a signed PDF snapshot at each annual review and link the SHA into the SoA.

Operational checklist

• Security. Document the trigger, the owner and the cadence.
• Information. Document the trigger, the owner and the cadence.
• Facility. Document the trigger, the owner and the cadence.
• Other. Document the trigger, the owner and the cadence.
• Policy. Document the trigger, the owner and the cadence.
• Scope: security, management, individuals, notification, policy, i, accordance, e.

Evidence to collect

• Policy Document. A signed and version-controlled policy / standard / procedure document.

Signed policy or standard documents the safeguard. Focus: Right to an Accounting of Disclosures of PHI.

Common pitfalls

• Policies that no engineer has read; the version in Confluence drifts from the version that's actually being enforced.

How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

• NIST SP 800-53 Rev. 5 PL-2(1) — Concept Of Operations
• BSI C5:2020 SP-01 — Documentation, communication and provision of policies and instructions
• NIST SP 800-171 Rev. 3 3.14.3 — Security Alerts, Advisories, and Directives

Related controls in HIPAA (45 CFR Part 164)

• § 164.520(d) — Joint Notice by Separate Covered Entities
• § 164.522(a)(1) — Right of an Individual to Request Restriction of Uses and Disclosures
• § 164.506(b) — Consent for uses and disclosures
• § 164.506(b)(1) — Permitted uses and disclosures
• § 164.506(b)(2) — Required provisions
• § 164.508(a)(1) — Authorization requirements - general rule

References

• U.S. HHS Office for Civil Rights — HIPAA (45 CFR Part 164)
• Catalogue identifier: § 164.528(a)

Topics: governance riskpolicy management