Accounting of disclosures requests

How do we produce an accounting of disclosures when a patient asks who received their information, verified and delivered inside the HIPAA timeline?

Make the accounting a report from the disclosure log, not a search. When a patient asks who received their health information, Callvu verifies the patient's identity and the period requested, captures the request in writing, chases and verifies the disclosures that must be accounted for from the disclosure log in the EHR and the release of information records (public health reports, disclosures required by law, law enforcement, research without authorization, and any other disclosure outside treatment, payment, operations and the patient's own authorizations), checks each entry for the required elements, produces the accounting in the required form, delivers it to the patient in the way they asked, and writes the request and the delivery to the EHR inside the sixty-day timeline.

In scopeSimpleCallvu moves: chase and verify, write back

Talk to an expert Try it in the sandbox

Last updated November 7, 2026.

The problem today

The accounting took three departments two months, because the public health reports were in one log and the subpoena responses in another.

Today, without Callvu

A patient asks who has received their records. The privacy office starts a search: the release of information system for authorized releases, a spreadsheet for public health reporting, the legal department's files for subpoenas, the research office for studies. Each department responds on its own schedule; the accounting is assembled by hand and delivered late, and nobody is sure it is complete.

The HIPAA Privacy Rule gives the patient the right to an accounting of disclosures for the six years before the request, excluding disclosures for treatment, payment and operations, those made to the patient, those under an authorization, and a few other categories, and requires each entry to show the date, the recipient, a description of the information and the purpose. The organization has sixty days, one thirty-day extension, and must give the first accounting in any twelve months free. The accounting is only as good as the log that fed it.

A disclosure logged when it happens is an accounting that takes an hour, not a quarter.

How it runs

From the requestto the system of record.

A patient (or their personal representative) asks for an accounting of disclosures in the portal, in writing or by phone. Callvu verifies the requester and opens the request with the date.

Patient: States the period and the delivery method, and receives the accounting.
Privacy office: Owns the request, confirms the accounting and handles exceptions in the Decision Desk.
Callvu: Verifies, captures, pulls and checks the disclosures, produces and delivers the accounting, tracks the clock and writes back.

Verify and capture
The patient's identity (or the personal representative's authority) is verified at the level the organization sets, the period is captured (up to the six years before the request, or a shorter period the patient chooses), the delivery method is chosen, and the patient is told whether a fee applies (none for the first accounting in twelve months, a cost-based fee thereafter with the chance to withdraw).
Chase and verify the disclosures
The accountable disclosures for the period are pulled from the disclosure log in the EHR and the release of information records: public health reports, disclosures required by law, judicial and administrative proceedings, law enforcement, research without authorization (with the protocol-level listing where fifty or more were made for one study), health oversight, and disclosures by business associates reported to the organization; each entry is checked for the date, the recipient's name and address where known, a description of the information and the purpose or a copy of the request; a gap for the period (a department that logged outside the system, a business associate that has not reported) is chased from that department or associate on the clock.
Produce and decide exceptions
The accounting is produced in the required form with the excluded categories explained; a suspended entry (a law enforcement or health oversight request for a temporary suspension), an unresolved gap near the deadline or a disputed authority goes to the privacy office in the Decision Desk with the entries and only the allowed outcomes.
Deliver and write back
The accounting is delivered to the patient by the method chosen with the delivery recorded, and the request, the period, the accounting as delivered, the date and any extension notice are written to the EHR and the privacy office's records for the retention period.

Where it ends: The patient received a complete accounting from the disclosure log inside the HIPAA timeline, the gaps were chased from the departments that held them, and the EHR holds the request and the delivery. The Decision Trace shows the period, the categories included and excluded and any exception decision; the Audit Trace shows the request date, the chases, the delivery and the write.

Runtime enforcement

What is enforcedwhile the work runs.

The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.

Regulations

HIPAA accounting of disclosures (45 CFR 164.528): An individual has a right to an accounting of disclosures of protected health information made in the six years before the request, except disclosures to carry out treatment, payment and health care operations, to the individual, pursuant to an authorization, for a facility directory or to persons involved in care, for national security or intelligence, to correctional institutions or law enforcement custody, as part of a limited data set, or made before the compliance date; each entry must include the date, the name and address of the recipient, a brief description of the information and a brief statement of the purpose or a copy of the written request; for research disclosures of fifty or more individuals a protocol-level accounting may be given; the entity must act within sixty days with one thirty-day extension on written notice, and the first accounting in any twelve-month period is free.
Temporary suspension (45 CFR 164.528(a)(2)) and documentation (164.528(d)): A health oversight agency or law enforcement official may ask in writing that disclosures to them be excluded from the accounting for a stated period; the entity must document the information required for an accounting, the written accounting provided and the titles of the persons responsible, and retain it for six years.
Business associate reporting (45 CFR 164.504(e)(2)(ii)(G)): Business associate agreements must require the associate to document disclosures and provide the information needed for an accounting, so the chase extends to associates for the period.

Company policies

Disclosures are logged in the EHR disclosure log when they are made, by every department; the accounting is a report, not a search.
The first accounting in twelve months is free; a fee for a further one is disclosed before it is produced.
Gaps are chased from the department or business associate that holds them, on the clock.
The EHR is the system of record for the disclosure log, the request and the delivery.

Controls

Identity and representative verification.
Period and delivery capture with fee disclosure.
Disclosure log pull with category rules.
Entry checks for the required elements and gap chases.
Decision Desk for suspensions and unresolved gaps.
Delivery recording and EHR write with the sixty-day clock.

Clocks and deadlines

Response: Sixty days from the request, with one thirty-day extension on written notice.
Lookback: Six years before the request, or the shorter period the patient chooses.
Retention: The accounting and the request kept six years.

Documents and checks

The request with the period and the delivery method
The disclosure entries pulled and checked
The chases and the responses
The accounting as delivered
The EHR record of the request and the delivery

In the Decision Trace

The categories included and excluded and why.
Any suspension or exception decision.

In the Audit Trace

The request date and the clock.
Each chase and response with time.
The delivery and the write with time.

The handoff

Between the front doorand the back office.

The front door

The portal, a written request or a call; the patient is verified and states the period on a controlled screen.

The back office

The privacy office confirms a report rather than assembling one, and sees only suspensions and gaps.

The Decision Desk

A requested suspension, an unresolved gap near the deadline or a disputed representative authority goes to the privacy office in the Decision Desk with the entries and only the allowed outcomes.

Proof

In scope.Proof at scale, not one process at a time.

The kind of process Callvu runs in production for customers in this industry. Ask for a reference on this exact process. The results below are the industry's published proof; each claim code links to its record on agents.callvu.com.

23 hospitals in the Ministry of Health network run on Callvu.

Across Callvu customers

More than 1,000 processes are live across Callvu customers.

Across Callvu customers

Questions

What buyers ask next,answered plainly.

Which disclosures are included?

Those outside treatment, payment and operations and outside the patient's own authorizations: public health, required by law, legal proceedings, law enforcement, research without authorization, oversight, and business associates' disclosures, for up to six years before the request.

What does each entry show?

The date, the recipient's name and address where known, a description of the information and the purpose or a copy of the request.

Is there a fee?

The first accounting in any twelve months is free; a later one may carry a cost-based fee the patient is told about before it is produced, with the chance to withdraw.

Related processes

Release of information requests Record amendment requests Requests to restrict disclosures Patient right of access requests Try it in the sandbox All healthcare processes

Bring this process, or the one that costs you most.

We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.