When must a covered entity account for disclosures of protected health information made during the course of litigation?
Individuals have a right to receive, upon request, an accounting of disclosures of protected health information made by a covered entity (or its business associate), with certain exceptions. These exceptions, or instances where a covered entity is not required to account for disclosures, include disclosures for treatment, payment, or health care operations and disclosures authorized by the individual. See 45 CFR 164.528 (GPO). Disclosures that are subject to the accounting for disclosures requirement include disclosures made by a covered entity that is not a party to the litigation or proceeding and that are made: • as required by law (under §§ 164.512(a) and (e)(1)(i)); • for a proceeding before a health oversight agency (under § 164.512(d)); or • in response to a subpoena, discovery request, or other lawful process (under § 164.512(e)). Conversely, covered entities need not account for disclosures of protected health information for litigation that are made with the individual’s auth
