Accounting-of-disclosures exception

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

The accounting right has exclusions

45 CFR 164.528 excludes specified categories, including disclosures for treatment, payment, and health care operations; to the individual; incident to a permitted use or disclosure; under an authorization; for a facility directory or certain involvement-in-care purposes; for national-security or intelligence purposes; to correctional institutions or law enforcement in specified circumstances; as part of a limited data set; and before the rule's stated date. Apply the current text to the facts.

Exclusion and legality are separate

First ask whether the disclosure had a valid pathway. Then ask whether it belongs in the accounting. A disclosure can be excluded from accounting and still require other approval, minimum-necessary analysis, authorization evidence, contract controls, or audit logging. HHS's Privacy Rule overview supplies the wider federal framework. A system label should never turn “excluded from accounting” into “automatically allowed.”

Preserve the underlying event

Store the date, recipient, purpose, information scope, authority, requester, system, responsible role, and accounting classification. Keep security logs and release records according to their own retention and access rules. If a disclosure is included in an accounting, the rule specifies the information the accounting must contain and timing requirements.

Measure classification quality

A fictional audit samples twelve disclosure events. Nine have a verified pathway and accounting classification, two lack purpose evidence, and one was mistakenly excluded. Classification completeness is 9 of 12 events. The three unresolved events stay visible until the source and outcome are documented.

Classify the purpose at the time of disclosure

Recipient identity alone rarely proves an exception. A health plan can receive information for payment, health-care operations, an authorization-based purpose, oversight, or another route. A family member can receive information through involvement in care, individual direction, personal-representative authority, or an impermissible disclosure. Record the purpose and authority when the event occurs.

Store the individual, date, recipient, known address, PHI description, purpose, legal pathway, accounting category, source system, workforce or vendor actor, supporting document, and reviewer. Keep any authorization, limited-data-set agreement, request, law-enforcement process, or facility-directory choice linked to the event.

When purpose is missing or conflicting, classify the event as unresolved. Do not assign treatment, payment, or operations from a recipient name merely to complete the accounting request.

Apply exceptions narrowly

Treatment, payment, and health-care operations are defined functions, not a universal business-purpose label. Incidental disclosure requires an otherwise permitted or required use or disclosure plus appropriate safeguards. Authorization-based exclusion depends on a valid authorization covering the actual disclosure.

Disclosures to the individual, specified care-involvement or notification disclosures, limited-data-set disclosures, and specified correctional, law-enforcement, national-security, or intelligence categories each follow their current rule conditions. Document the exact category rather than storing one generic “excluded” state.

An exception for the federal accounting does not erase a state-law accounting right, Part 2 record, contractual report, security audit trail, incident record, or business-associate obligation. Maintain a separate applicability field for each regime.

Reconcile business associates and systems

List every vendor that can disclose PHI on behalf of the covered entity. Require event fields and timely retrieval through the business associate agreement, then test with historical dates. Reconcile vendor reports with interface logs, release records, claim files, and incident systems.

Avoid double-counting one disclosure recorded by both the source EHR and delivery platform. Use a stable event or reconciliation key while retaining both technical logs. A retry that reaches the same recipient may be a technical duplicate or a separate disclosure event depending on facts; qualified reviewers should decide.

Audit both pathway and accounting result

Use two independent questions for every event:

1. Was the use or disclosure permitted or required through a supported pathway?
2. Must it appear in the individual's accounting under the current rule?

An event can pass one and fail the other. Report unsupported disclosures to the privacy and incident workflows even when they fall within an accounting exclusion. Likewise, include a permitted event when the accounting rule requires it.

Classification checklist

• verify entity, individual, recipient, date, PHI, and purpose
• identify the supported disclosure pathway and evidence
• select the exact accounting inclusion or exclusion category
• check state law, Part 2, contract, and other applicable regimes
• reconcile covered-entity and business-associate records
• preserve unresolved events in the request denominator
• document repeated-disclosure or temporary-suspension treatment separately
• review corrections without deleting the original event

Useful measures include events with a supported pathway, events with a complete accounting classification, business-associate sources returned by target, and misclassifications corrected. Sample excluded events regularly because that category can hide missing purpose evidence.