Under HIPAA, patients have a right to information about certain disclosures, referred to as an accounting. Under the current iteration of the regulations, covered entities and business associates need not account for disclosures for treatment, payment, and health care operations purposes. The HITECH Act of 2009 included a requirement that patients receive an accounting of most disclosures from an "electronic health record." On May 31, 2011, the HHS Office for Civil Rights (OCR) surprised some in the industry by including a requirement, in a notice of proposed rulemaking, that covered entities provide patients with an accounting of disclosures, not only from an electronic health record, but from all protected health information held in an "electronic designated records set." Under the proposal, covered entities and business associates would have to maintain a record of the date and time information was accessed, as well as the name of the person accessing the electronic designated record set. The information would have to be retained for at least three years.

In the preamble to the 2011 proposed rules, OCR observed that some covered entities received few requests from patients for an accounting. OCR seemed to conclude that few patients asked for an accounting because the information it would include under the current regulations would not be of interest to patients. Therefore, OCR sought to broaden the information that could be obtained through a request from an accounting. The federal government's Unified Agenda of Regulatory and Deregulatory Actions, published on May 9, 2018, indicates that the notice of proposed rulemaking regarding the accounting rule will be withdrawn. There will be an advance notice of proposed rulemaking issued to solicit input from the public on implementing the HITECH Act’s accounting requirement "and on certain workability changes to the accounting requirement."