Research disclosure accounting list

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

The threshold belongs to one research purpose

Under 45 CFR 164.528, the alternative applies to disclosures for a particular research purpose involving 50 or more individuals. It is not a generic list of every study. Track protocol identity, governing disclosure route, cohort threshold, and accounting period.

Evaluate each purpose separately. One research program may contain several protocols, sponsors, or data selections, and combining them can obscure the information the rule expects. Confirm that the disclosures were made under 45 CFR 164.512(i), identify the particular research purpose, and document that it involved at least 50 individuals. A database with 50 records does not establish that the qualifying disclosures for one purpose involved 50 people.

The alternative list addresses uncertainty about whether one person's PHI was among a large research cohort. If the practice can identify an ordinary accountings event for that person, retain and process that evidence under the applicable workflow. Privacy and research leadership should approve the protocol-to-list mapping before a request arrives.

The content is deliberately specific

Include the protocol or activity name; a plain-language purpose and record-selection criteria; PHI type; date or period, including the last disclosure date; sponsor and researcher names, addresses, and phone numbers; and the may-or-may-not-have-been-disclosed statement.

Write for a person who has never seen the protocol. Explain the research purpose and selection criteria in ordinary language while preserving the protocol's actual boundaries. Describe PHI by category and relevant period without implying that the person's information was definitely included. Validate sponsor and researcher contact information at response time; a protocol file created years earlier may contain stale details.

Build the list from a protocol registry tied to disclosure evidence. Useful fields include protocol identifier, approval or authorization basis, selection logic, data categories, disclosure dates, last date, cohort count, sponsor, researcher, contacts, and source system. Keep version history when a protocol's purpose, criteria, or contacts change.

Contact help is a separate duty

When it is reasonably likely that the individual's PHI was disclosed for a listed protocol, the covered entity must, at the individual's request, assist with contacting the sponsor and researcher. Record the request, likelihood assessment, assistance provided, and outcome without promising that the research party will respond.

Give the individual a clear way to ask for that assistance. Route the request to someone who can compare the person's record to the protocol selection and disclosure evidence. If disclosure is reasonably likely, help make contact using the current sponsor and researcher information. Preserve the date, method, content, and delivery result while limiting additional PHI to what the contact process requires.

Assistance completion and sponsor response are separate outcomes. The covered entity can document the help it provided even when the outside party does not respond. Escalate conflicting evidence or an unreachable contact through the research privacy process.

Example with two protocols

An accounting lists two qualifying protocols. Both contain all required list fields, and one triggers requested contact assistance. List completeness is 2 of 2 protocols; assistance completion is 0 of 1 requests until outreach occurs. The HHS Audit Protocol supports reviewing these elements separately.

Assume one protocol involved 74 individuals and the other involved 180. The individual asks about the 74-person protocol. A source-system match makes inclusion reasonably likely, so the practice helps contact the listed sponsor and researcher and records the secure outreach. The accounting remains a two-protocol list, while the assistance ledger shows one request, one completed outreach, and any later response as a separate event.

Research-list checklist

• Confirm a particular research purpose under the cited disclosure provision.
• Document that the purpose involved at least 50 individuals.
• Include the protocol, plain-language purpose, and selection criteria.
• State PHI categories, disclosure period, and last disclosure date.
• Verify sponsor and researcher names, addresses, and phone numbers.
• Include the required statement that the person's PHI may or may not have been disclosed.
• Offer and track contact assistance when disclosure is reasonably likely and requested.
• Retain protocol, cohort, source, list version, and assistance evidence.

Owner controls

Reconcile the protocol registry to privacy-board or authorization records, disclosure systems, and current sponsor contacts. Sample the threshold calculation and the language used to describe selection criteria. Monitor protocols with missing last dates, stale contacts, unsupported cohort counts, or open assistance requests. Keep the alternative list understandable without weakening the evidence behind it, and route uncertain classifications to research privacy and legal review before the accounting is delivered.