Accounting of Disclosures Matrix
Disclosure means the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information. CFR 164.501
Covered entities must disclose Protected Health Information (PHI)
Accounting not required
- To the individual 164.502 (a)(2)(i)
Accounting required
- To the Secretary of HHS for compliance investigation purposes 164.502 (a)(2)(ii)
Covered entities may disclose PHI
Accounting not required
- For treatment, payment, and healthcare operations (TPO) purposes 164.502 (a)(1)(iii)
- With authorization of the individual 164.502 (a)(1)(iv) and 164.508 (a)
- Pursuant to a verbal agreement after individual has been given the opportunity to agree or object (e.g. facility directory, next of kin, close personal friend, person involved in individual’s care) or for notification or emergency circumstance. 164.510
Disclosures not permitted by law without consent or authorization
Accounting required
- Required by law 164.512 (a)(1) if: related to child abuse, neglect, or domestic violence 164.512 (c); in the course of judicial and administrative proceedings164.512 (e)(1); or for law enforcement purposes 164.512 (f)
- For certain public health activities including disclosures for the purpose of preventing or controlling disease and disclosures related to victims of child abuse or neglect 164.512 (b)(1)
- Health oversight 164.512 (d)(1)
- About decedents 164.512 (g)(1)
- For purposes of cadaveric organ donation 164.512 (h)
- For certain research purposes 164.512 (i)(1)
- To avert a serious threat to health or safety 164.512 (j)(1)
- For specialized government functions 164.512 (k)(1)
- To correctional institutions 164.512 (k)(5)
- For worker’s compensation 164.512 (l)
- For certain marketing or fundraising, exceptions 164.501 and 164.514 (f)(1)
Accounting not required
- Incident to a permitted use or disclosure 164.502 (a)(1)(iii)
- For national security or intelligence purposes 164.512 (k)(2)
- As part of a limited data set 164.514 (e)