How long does a covered entity have to produce an accounting of disclosures?

Under the HIPAA Privacy Rule, a covered entity is required to provide an accounting of disclosures to an individual within 60 days of the request. This timeframe is designed to ensure that individuals have timely access to information regarding how their protected health information (PHI) has been used and disclosed.

If the covered entity is unable to provide the accounting within the initial 60 days, they are permitted to request a one-time extension of up to an additional 30 days. This extension must be communicated to the individual, along with the reason for the delay.

This provision is essential for maintaining transparency and trust between healthcare providers and patients, allowing individuals to be aware of and understand their health information practices.