Accounting of disclosures
A list of certain disclosures of someone's medical records in the six years before the request. Narrower than it sounds: treatment, payment and the provider's own operations are left out.
What it means
It is a right nothing in the process announces. On request, a provider must produce a list of the disclosures it made of a person's medical information in the six years before the request — with the date, the name and address of who received it, what was disclosed, and why.
It does not cover everything. Disclosures for treatment, payment and health care operations are excluded, along with disclosures made under an authorization, to the person themselves, incidentally, for a facility directory or care notification, for national security or law enforcement, and anything in a limited data set.
The provider has sixty days. It may take one extension of no more than thirty days, and only with a written statement of the reasons and the date it will deliver. The first accounting in any twelve-month period is free.
Why it matters
It is the only practical way to discover that a dead person's medical identity has been used, because an unfamiliar recipient shows up as a name and a date.
The right survives the death — a decedent's records stay protected for fifty years, and whoever has authority to act for the estate can exercise it.
It produces evidence rather than suspicion, which is usually the part a fraud report is missing.
When you are likely to meet it
- When a bill or an explanation of benefits arrives for care that never happened.
- When you find treatment in a relative's file that was not theirs.
- When you are trying to work out who else holds a person's medical information.