The organization must maintain records of disclosures of protected health information. This documentation serves as the written accounting of disclosures made in the relevant period, including those by business associates, as required by the HIPAA regulation.
The documentation must include:
- the date of the disclosure
- the name and address (if known) of the recipient
- a brief description of the information disclosed
- a brief statement of the purpose of the disclosure (or a copy of the written request)
In cases where the organization has made multiple disclosures to the same recipient for the same purpose, the documentation may list the first disclosure, frequency, and date of the last.
