Disclosure accounting period

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Lookback and response clocks differ

45 CFR 164.528 uses a six-year maximum lookback for included disclosures and a 60-day response clock. Store the request date, requested start and end dates, compliance-date boundary, included events, due date, extension notice, and delivery separately.

Calculate the requested period before searching. The end point is tied to the request, and the individual may choose a shorter interval than six years. Apply the covered entity's Privacy Rule compliance-date boundary where relevant. Record the inclusive start and end dates in the case so each system owner runs the same window. Disclosure-event dates, rather than the date a log was entered or corrected, determine whether an event falls within that period.

The fulfillment deadline is a second calculation. Date-stamp receipt, set the 60-day due date, and monitor collection work from internal systems and business associates. The entity may use one extension of no more than 30 days if it gives the individual a written statement within the original period explaining the reason and the date it will complete the accounting. The extension controls timing; it does not change the requested lookback.

Build the event population before applying exclusions

Start with a broad inventory of disclosure sources: manual privacy logs, health-information exchanges, payer or government transmissions, public-health workflows, vendors, research operations, incident records, and business-associate logs. Normalize event date, recipient, PHI scope, purpose, source, and person. Then apply the current rule's accounting inclusions, exclusions, research alternatives, and temporary suspensions through documented classifications.

This order reduces blind spots. A system configured to log only events presumed includable can miss disclosures whose classification later changes. Keep excluded events in the internal reconciliation with their reason, even though the individual-facing accounting contains only required entries. Duplicate detection should compare underlying events, not merely recipient names.

The fee cycle uses twelve months

The HHS Audit Protocol restates that the first accounting in any 12-month period is free. A reasonable cost-based fee may apply to another request in that period only after advance notice and an opportunity to withdraw or modify the request to avoid or reduce the fee.

Search prior requests for the same individual using a rolling 12-month period. Record which request is free, the cost basis for any later request, when notice was given, and whether the individual withdrew or narrowed the request. Keep this fee-cycle analysis separate from the six-year disclosure lookback. A long accounting can be the free first request, while a short later accounting may be the one eligible for a fee.

Example with mature requests

Nine accounting requests reach their due date. Seven are delivered, one has a timely extension, and one is overdue. Timely action is 8 of 9 requests. The extension counts as action while remaining open for delivery.

For a request received June 15, 2026, the individual asks for disclosures from January 1, 2024 through June 14, 2026. The search window is that requested interval, not the full six years. If the practice sends a valid extension notice before the original due date, the case is timely at that checkpoint but remains incomplete until the accounting is delivered by the stated extended date. Report those two statuses separately.

Period and deadline checklist

• Verify identity, authority, requested start and end dates, and delivery method.
• Apply the six-year maximum and any relevant compliance-date boundary.
• Set the 60-day response due date independently from the lookback.
• Inventory internal, vendor, and business-associate disclosure sources.
• Reconcile event dates and classify included, excluded, duplicate, and suspended events.
• Check the rolling 12-month fee history and give advance notice when applicable.
• Use at most one qualifying extension and state a firm completion date.
• Validate entries, deliver securely, and retain the source-to-accounting reconciliation.

Owner controls

Build a disclosure-event inventory that includes business-associate events, preserve exception classifications, lock the requested period, and validate the accounting content. Measure request timeliness, event completeness, delivery, and fee accuracy as separate outcomes.

Audit date-boundary cases, business-associate handoffs, and periods crossing system migrations. Monitor late source responses, unmatched events, excluded-event reasons, extension use, and final delivery. A clean deadline dashboard cannot compensate for an incomplete event population, so completeness testing should trace samples from source systems into the accounting and from the accounting back to source evidence.