Part 2 accounting three-year lookback

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.25(a) describes a three-year lookback before the request date for disclosures made with consent, or a shorter period chosen by the patient. Paragraph (b) uses the same three-year period for qualifying TPO disclosures made through an EHR. HHS continues to state that section 2.25's compliance date will be set with the corresponding HIPAA accounting revision.

Define the requested interval

Under 42 CFR 2.25(a), the future accounting covers the three years before the request or a shorter period selected by the patient. Record the request timestamp, chosen interval, time zone, boundary-day logic, and source systems before searching.

Keep the compliance boundary visible

The HHS fact sheet says the accounting compliance date will be set when the corresponding HIPAA right is revised. A readiness test can measure historical availability without telling a patient that § 2.25 currently compels a completed accounting.

Test source coverage by interval

Map active and legacy EHRs, release systems, interfaces, secure messaging, document exchange, manual logs, acquisitions, migrations, and vendors. Record unavailable periods and do not silently shorten the search.

Distinguish this period from nearby rights

The section 2.25 period differs from the existing HIPAA framework in 45 CFR 164.528, which uses a six-year period subject to its exclusions, and from the section 2.24 intermediary list, which has its own three-year scope and 30-day response rule. Identify the governing right before choosing the period, event population, or deadline.

Record the authority and current compliance status in the request file. A matching number of years does not make two rights interchangeable.

Lock the readiness interval

Capture the hypothetical or actual request date and time, patient-selected shorter period if any, time zone, start and end instants, leap-day and boundary treatment, and approved calendar method. Keep the interval stable while identity, consent, source, or event questions are resolved.

Counsel should approve edge-case conventions rather than letting each application calculate them differently. Store the calculation inputs and output with the test.

Build the correct disclosure population

For the general rule, identify disclosures made with a section 2.31 consent. For TPO, confirm the treatment, payment, or operations purpose and the electronic-health-record route. Separate successful external disclosures from internal access, uses, drafts, failed messages, and unrelated logs.

Link each event to the patient, consent version, recipient, purpose, route, date, information description, source identifier, status, retry or correction, and evidence. Retain historical recipient and consent data so old events are evaluated using facts true at the time.

Cover the entire period technically

Inventory active and retired EHRs, release tools, interfaces, exchanges, portals, secure messaging, vendors, acquisitions, migrations, archives, recipient directories, and manual sources. Record coverage dates, retention, time zones, event meanings, owner, search method, and known gaps.

Test recovery for the oldest month in the window, not only recent production data. A three-year retention label does not prove that logs remain readable, normalized, linked to patients, or exportable after a migration.

Reconcile and report readiness honestly

Compare generated entries with known disclosures, consent records, recipient acknowledgments, payload evidence, and correction history. Investigate missing intervals, duplicates, unknown recipients, overwritten timestamps, and systems that retained only the last retry.

Document which sources and periods were proven, limited, or unavailable and assign remediation. Keep the HHS timing statement attached to readiness reports so stakeholders do not treat a test as a live section 2.25 response.

Review retention settings before any source reaches its deletion date. Preserve only what applicable law and approved schedules support, but make deliberate decisions about logs needed for future implementation rather than losing them through default vendor settings.

Example

Thirteen readiness searches use a locked interval. Ten cover every named system and reconcile corrections; two omit a legacy portal and one changes the start date mid-search. Interval completeness is 10 of 13 searches.

Three-year-lookback checklist

• identify the exact accounting right and its current compliance status;
• lock request date, shorter patient period, time zone, boundaries, and calculation method;
• classify consent disclosures and TPO EHR events without mixing access or internal use;
• link every event to consent, recipient, purpose, date, payload, route, and evidence;
• prove active, legacy, vendor, archive, and migration coverage across the full period; and
• reconcile results, document limitations, and report preparation as readiness.

The three-year lookback is a future Part 2 accounting specification. It does not replace the existing HIPAA six-year framework or intermediary-list rules.