Multiple-disclosure accounting summary

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Recipient and purpose define the group

The grouping option in 45 CFR 164.528 applies when disclosures went to the same recipient for one purpose under the cited rule pathways. Changes in recipient, purpose, PHI scope, or legal route can require another entry. Grouping by vendor name alone can hide separate disclosure patterns.

Build the group from event-level evidence. Normalize recipient names and known addresses, then confirm that the underlying person or entity is actually the same. Compare the purpose and applicable disclosure provision, rather than relying on a broad label such as “government” or “oversight.” Check whether the PHI scope remained materially consistent. If those facts diverge, create another group or an ordinary individual entry.

One organization can contain distinct recipients or programs. Similarly, one recipient can receive PHI for separate investigations, reporting duties, or requests. The accounting should help the individual understand those distinctions. Compression is appropriate only when it preserves that meaning.

The summary retains three time signals

Preserve the first event's ordinary accounting fields, a defensible frequency, periodicity, or count, and the last event date. Keep the underlying event-level record so the practice can reconstruct the summary, correct errors, and answer a focused question.

The first event supplies the ordinary date, recipient name and known address, PHI description, and purpose statement or qualifying request. Then choose a truthful description of what followed: a precise count, an understandable frequency, or a stable periodicity. State the last disclosure date within the accounting period. A phrase such as “multiple times” is hard to validate and gives the individual little useful information.

Reconcile the source population before summarizing

Start with all candidate disclosure events for the requested period, including relevant business-associate records. Apply inclusion and exclusion decisions, resolve duplicates and failed transmissions, and lock the event population. Then group qualifying repeated events. Keep raw identifiers, normalized fields, group ID, and any manual override so the summary can be reproduced.

System retries need explicit treatment. Three transmission attempts may represent one completed disclosure, while three successful sends may be three events. Time-zone conversion can also move an event across a requested-period boundary. Define those rules before counting and retain the original timestamps.

Example across event groups

A practice identifies 18 disclosure events. Ten qualify for one repeated-disclosure summary, five qualify for a second, and three need individual entries. The accounting contains five presented entries backed by all 18 source events. Compression should never reduce the source-event denominator.

Suppose the first group contains ten monthly disclosures to the same state program for the same reporting purpose, while the second contains five disclosures to one investigator under a single written request. The three remaining events involve different recipients or purposes. The accounting shows two summaries and three ordinary entries. Internal reconciliation still shows 18 included events, their group assignments, and the reason each outlier stayed separate.

Summary checklist

• Assemble and classify the complete event population for the requested period.
• Confirm recipient identity and known address across proposed group members.
• Verify one qualifying purpose and disclosure pathway for the group.
• Compare PHI scope and separate events whose meaning differs materially.
• Carry forward the first event's complete ordinary accounting fields.
• State a supportable frequency, periodicity, or number and the last event date.
• Retain every underlying event, correction, and grouping decision.
• Trace a sample from raw logs to the summary and back before delivery.

Owner controls

Use a grouping rule that tests recipient identity, purpose, rule pathway, and accounting period. The HHS Audit Protocol can guide evidence review. Sample summarized groups against raw logs and treat a changed purpose as a new group even when the recipient is unchanged.

Measure source events, summarized events, presented entries, exceptions, manual overrides, and corrections after quality review. A high compression ratio is neither a success nor a failure by itself. The useful control is whether every summarized event belongs in the group and every presented field can be reproduced from evidence.

Review groups that cross system migrations, recipient reorganizations, or changes in disclosure authority. Compare the first and last events, plus a sample from the middle, to detect drift that a count alone will miss. Version the grouping logic and re-run affected summaries when corrections change the event population. Keep the individual-facing presentation readable while the internal reconciliation retains its full precision.