An “accounting” is a log of certain disclosures of full PHI that must be made available to a patient upon request that includes information about the disclosure like the date it occurred, the name of the recipient, a description of the PHI and the purpose.

A “disclosure” means the PHI left the institution that is covered by HIPAA (e.g., the hospital, clinic, health system). But it can also mean that a person who is not an employee of the institution viewed or accessed the PHI, even on the institution’s premises.

An accounting for disclosures is required when:

• Identifiable patient health information is accessed for research purposes; AND
• Access is without patient authorization (i.e., under an IRB partial or full waiver of authorization); AND
• You are accessing PHI from UW-Madison’s Health Care Component (HCC) and you are employed outside the HCC or from UW Health and you are employed outside of the Affiliated Covered Entity (ACE); OR
• You are accessing PHI from other healthcare entities where you are not employed or workforce for research purposes – even if you are on the medical staff for clinical care purposes – such as from UnityPoint Health-Meriter or Access Community Health Centers (ACHC).

See this Accounting for Disclosures Guidance for more information and to access the link to account for disclosures. Note that if you obtained data through the UW Clinical Research Data Services (CRDS), CRDS will account for you when an accounting is required.