A covered entity or its business partners must account to individuals for any disclosures of their protected health information.
However, the Privacy Rule does not require accounting for the following disclosures:
- For a treatment, payment, or healthcare operations
- For public interest and benefit activities
- To the individual subject to the information
- To the individual’s representative
- Where opportunity is given to the individual to agree or object
- To institutions of punishment or law enforcement officers for specific objectives relating to detainees or anyone lawfully held in custody
- Incidental use and disclosure
- Where there is limited data for operations in research, public health, or healthcare.