HIPAA regulations long on the books require that covered entities (i.e. health care providers, payors and clearinghouses) provide patients with accounting of disclosures of their protected health information (PHI) for any purpose other than treatment, payment or health care operations (TPO). The HITECH Act upped the ante, requiring accounting of disclosures of PHI for TPO as well. Regs implementing this requirement were to be keyed off of the meaningful use regs, and they have now arrived.