Part 2 accounting of disclosures

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.25 codifies an accounting framework for consent-based disclosures during the three years before a request, with TPO disclosures included only when made through an electronic health record. The HHS fact sheet, updated January 30, 2026, says the compliance date for this Part 2 right will be set when the corresponding HIPAA accounting right is revised. That timing caveat remains current as of this source check.

Read the rule and its current status together

Current 42 CFR 2.25 states the accounting framework. The HHS final-rule fact sheet, updated in January 2026, says its compliance date will be set when the same right is revised under HIPAA. Do not present the future workflow as currently due under § 2.25.

Preserve usable disclosure evidence

Inventory consent-based disclosures, patient and recipient identifiers, dates, purposes, record descriptions, source systems, corrections, repeated-disclosure logic, and responsible offices. Separate EHR disclosures from portals, interfaces, paper, fax, and other routes.

Do not merge nearby rights

An intermediary list under § 2.24, a HIPAA accounting under 45 CFR 164.528, Part 2 access, and the tolled § 2.25 accounting have different scope and status. Intake should classify the request before starting a clock or promising content.

Classify the request before promising an accounting

Identify the patient, requester authority, entity receiving the request, records, time period, and requested disclosure history. Determine whether the request invokes the tolled section 2.25 framework, a currently applicable HIPAA accounting, a section 2.24 intermediary list, patient access, state law, or another right. Each has different populations, periods, exclusions, content, clocks, and fees.

Use patient-facing language that accurately describes the current route. Avoid denying every request merely because section 2.25 is tolled; another law or voluntary practice may require or support a response. Avoid promising the future Part 2 content as a live federal duty.

Model the future section 2.25 population

For paragraph (a), preserve disclosures made with consent under section 2.31 during the three years before a future request, or a shorter period chosen by the patient. For paragraph (b), separately classify treatment, payment, and health care operations disclosures made through an electronic health record. Keep purpose, consent, route, and event evidence distinct.

Do not confuse user access, internal use, queueing, failed transmission, audit-log viewing, patient access, and external disclosure. Define successful disclosure for each technology and preserve recipient, date, information, purpose, source, payload, status, correction, and evidence.

Prepare the content and response controls

Section 2.25 points to specified parts of 45 CFR 164.528 for suspension, accounting content, provision, and documentation. Build a field map for dates, recipients, addresses when known, information descriptions, purposes or written requests, repeated disclosures, qualifying research summaries, response timing, extension, fees, responsible offices, and retained evidence, subject to the final compliance instructions.

Keep Part 2 readiness logic versioned and disabled from making unsupported legal claims. A future HIPAA revision may change the referenced requirements or operational assumptions.

Inventory and reconcile the evidence

Map EHRs, release modules, interfaces, HIEs, payer connections, portals, secure messages, fax, paper, vendors, legacy platforms, acquisitions, migrations, recipient directories, and manual logs. Record coverage dates, owners, event semantics, retention, search methods, gaps, and recovery tests.

Test a representative three-year period across consent types, purposes, recipients, routes, corrections, retries, and system changes. Reconcile the generated accounting to raw events and known disclosures. Preserve source limitations and remediation work.

Govern the waiting period

Assign an owner to monitor HHS, the Federal Register, and the HIPAA accounting revision. Record source checks and require legal review before activating notices, clocks, fees, templates, or system rules. Keep current HIPAA and state accounting obligations operating on their own authority.

Track readiness measures as readiness: source coverage, field completeness, route classification, reproducibility, correction rate, and unresolved gaps. Do not label a preparation score as section 2.25 compliance.

Example

Fifteen requests are sampled. Twelve identify the governing right, entity, period, disclosure population, owner, and response status; three are routed to a generic audit-log export. Classification completeness is 12 of 15 requests.

Accounting-readiness checklist

• classify Part 2, HIPAA, intermediary-list, access, state, and voluntary response routes;
• preserve consent, purpose, EHR route, recipient, date, payload, correction, and evidence;
• model the three-year and patient-selected periods without activating a false deadline;
• map the section 164.528 content, provision, suspension, fee, and documentation fields;
• inventory and test active, legacy, manual, vendor, and migration sources; and
• monitor the federal trigger and keep readiness reporting separate from legal compliance.

Section 2.25 is real regulatory text with a deferred compliance trigger. Sound preparation respects both facts at the same time.