HIPAA Accounting of Disclosures in Behavioral Health: The 60-Day Request and the Log Most Programs Cannot Produce

Most behavioral health programs have never received a request for an accounting of disclosures. That is exactly why the first one goes badly. A former client, often mid-litigation, writes in asking who you have shared their records with. The request lands with a front desk that has no procedure for it, the clock starts running, and the compliance officer discovers that the disclosures in question are scattered across an incident binder, a legal folder, an email thread with the county and a state survey file nobody indexed by client.

This post walks through what the HIPAA Privacy Rule actually requires, which disclosures behavioral health operators most often forget to log, and how to build a disclosure log that answers a request in an afternoon rather than a month.

What the Accounting Requirement Covers

Under the HIPAA Privacy Rule’s accounting provision at 45 CFR 164.528, a client has the right to receive an accounting of disclosures of their protected health information made by a covered entity in the six years before the date of the request. A covered entity must act on the request no later than 60 days after receiving it, and may extend that once by no more than 30 days if it gives the client a written statement of the reasons for the delay and the date the accounting will be provided. The first accounting in any 12-month period must be provided free of charge; later requests in the same 12 months may carry a reasonable, cost-based fee if the client is told in advance and given a chance to withdraw or modify the request.

The accounting is not a list of everyone who touched the chart. Several broad categories are excluded, most importantly disclosures for treatment, payment and health care operations, disclosures to the client themselves, disclosures made under a valid signed authorization, and incidental disclosures. What remains is the set of disclosures made without the client’s authorization for reasons outside routine care and billing. HHS summarizes the client rights framework on its HIPAA Privacy Rule page, and the regulation text is the controlling source for the exceptions.

The Disclosures Behavioral Health Programs Forget to Log

In our compliance reviews, the disclosures that are missing from a program’s log are almost never exotic. They are routine events that staff do not think of as disclosures because they feel like part of running a licensed facility.

• State licensing surveys: When a state licensing surveyor or a Medicaid program-integrity reviewer pulls client charts, that is generally a disclosure for health oversight, which falls outside treatment, payment and operations and therefore belongs in the accounting.
• Mandated abuse and neglect reports: A clinician’s report to child or adult protective services is required by law, but it is still a disclosure without authorization and still accountable.
• Duty-to-warn and emergency disclosures: A call to law enforcement or a potential victim to avert a serious threat is permitted, and it must be logged.
• Subpoena and court order responses: Records produced in litigation are often handled by an outside attorney and never make it back into the client’s disclosure history.
• Public health and death reporting: Reports to a health department or a medical examiner are permitted disclosures that are frequently left to whoever happened to handle them.

The distinction that trips up operators most often is between licensure and accreditation. Here is the paragraph we give compliance officers to keep: For a behavioral health program, a state licensing survey and an accreditation survey are treated differently for HIPAA accounting purposes. Charts reviewed by a state licensing agency are generally health oversight disclosures and belong in each affected client’s accounting of disclosures for six years. Charts reviewed by an accrediting body such as The Joint Commission or CARF fall under health care operations, which HIPAA defines to include accreditation activities, so they are excluded from the accounting. Programs that log neither, or log both, are wrong in opposite directions.

What Each Entry Must Contain

Each accounting entry needs four things: the date of the disclosure, the name of the recipient and their address if known, a brief description of the information disclosed, and a brief statement of the purpose (or a copy of the written request that prompted the disclosure). Where the program made multiple disclosures to the same recipient for the same purpose, the rule allows a summarized entry showing the first disclosure, the frequency or number of disclosures, and the date of the last one. That summary option matters for ongoing reporting relationships, such as recurring court-ordered progress reports.

If a health oversight agency or law enforcement official states that an accounting would be reasonably likely to impede their activities, the program may temporarily suspend that portion of the accounting. A written statement from the agency supports a suspension for the period it states; an oral statement supports a much shorter, limited suspension and must be documented. Route any such request to the compliance officer.

Where 42 CFR Part 2 Fits

Substance use disorder programs covered by 42 CFR Part 2 operate under a second set of rules. The 2024 Part 2 final rule aligned Part 2 more closely with HIPAA and added a client right to an accounting of disclosures, including certain disclosures for treatment, payment and operations made through an electronic health record. HHS has indicated that compliance with that specific accounting provision is tied to HHS finalizing corresponding changes to the HIPAA accounting rule, so the expanded obligation is not yet in force. Check the current status on the HHS fact sheet on the Part 2 final rule before you write policy around it.

Part 2 programs that disclose through an intermediary, such as a health information exchange, also need to be able to respond when a client asks which participants received their information under a general designation consent. In practice, that means your contract with the intermediary should state how quickly it will return a disclosure list to you, because you will be the one answering the client.

Why Requests Fail in Practice

When a program cannot produce an accounting on time, the cause is almost always one of the same few failures.

• No single log: Disclosures are recorded in the incident system, the legal file and individual email, so assembling one client’s history means searching five places.
• Logging by event instead of by client: A survey file shows which charts were pulled on a given date, but nobody wrote the disclosure into each of those clients’ records.
• Outside counsel holds the record: Subpoena responses handled by a law firm are never reported back with the client names and dates.
• EHR modules that are switched off: Many behavioral health EHRs include a disclosure-tracking feature that was never configured at go-live.
• No intake path for the request: The front desk treats it like a records request, and the 60-day clock is half spent before compliance sees it.

A One-Week Fix

Pull your last state licensing survey file this week. List every client chart the surveyors reviewed, then open three of those client records and look for a disclosure entry dated to the survey. If none of the three has one, your log is incomplete for every client in that sample, and every licensing survey before it carries the same gap.

From there, the fix is operational rather than technical:

1. Designate one disclosure log, either the EHR’s tracking module or a controlled spreadsheet, and make it the only place entries live.
2. Add a disclosure-logging step to the incident report, subpoena response, mandated report and survey close-out procedures, so the entry is made at the moment of disclosure.
3. Require outside counsel to return client names, dates and record descriptions for every production.
4. Write a short procedure for accounting requests: date-stamp on receipt, route to compliance within one business day, diary the 60-day deadline and the 30-day extension date.
5. Keep the log, every accounting provided and the name of the person responsible for processing requests for six years, consistent with HIPAA documentation retention.

If your policies were written from a template, also check that your Notice of Privacy Practices describes the right to an accounting accurately; our HIPAA compliance checklist is a useful starting point for that review.

How Circa Behavioral Can Help

An accounting request is one of the few HIPAA rights a client can exercise that tests whether your documentation system works end to end. Our compliance services team audits disclosure logs against survey files, legal files and incident records, and builds the procedures that keep them aligned. Programs without a dedicated compliance lead often use our fractional compliance officer service to own this process directly.

To talk through your disclosure tracking or a request you have already received, call (888) 458-6619.

This article is operational guidance, not legal advice. Requirements change and vary by state; confirm current obligations with the primary sources cited above and with qualified counsel. Questions about a specific situation? Call Circa Behavioral at (888) 458-6619.