HIPAA and Accounting of disclosures of PHI

According to HIPPA (§164.528 - Accounting of disclosures of protected health information; source: http://www.hipaasurvivalguide.com/hipaa-regulations/164-528.php), “An individual has a right to receive an accounting of disclosures of protected health information made by a covered entity in the six years prior to the date on which the accounting is requested.” In other words, a patient can request information about when, and why, and to whom their PHI has been released. According to the legislation, the information that must be tracked and made available includes: 

(1) The date of the disclosure

(2) The person or organization who received the information

(3) A description of what was released

(4) The purpose for the disclosure. 

The information must be made available to the patient no later than 60 days after their request is received.

How can you ensure that your practice is tracking medical record disclosures? Well, that’s where the ChartRequest platform comes into play. Our platform automatically creates an Account of Disclosure for every request entered into the system. Click the “Account of Disclosure” tab on your ChartRequest account to view a list of every request entered onto the ChartRequest platform in one convenient location.


From this list, the provider’s office can click on the request number to see all of the details regarding any given request.

Fax-based medical record release systems complicate this step for medical practices around the country. Medical records staff use work intensive, manual excel spreadsheets and paper files to keep track of outgoing records.  ChartRequest’s “Walk-In Request” function solves this problem even for fax-only requests, such as government ROI requests. A provider’s office can use the walk-in function when they receive a request from someone who cannot or will not submit the request via the platform on their own.  This can be from a patient who walks into the office, or a covered entity, who is not able to submit their request via the internet. When the request comes in, the office staff enters it into the platform in the same manner that any requestor does. Once the request has been entered, an Account of Disclosure will be created automatically. (Watch a ChartRequest Account Manager describe the walk-in process here)

There are many things that go into being HIPAA compliant. This is just another step that we’ve taken to help you manage your risk. If you have any questions regarding our “Account of Disclosure” or “Walk-in Request” features, feel free to reach out to us for more information.