Where a covered entity uses or maintains an electronic health record, the exception in 45 CFR 164.528(a)(1)(i) for treatment, payment and health care operations disclosures does not apply to disclosures through the record, and the individual may receive an accounting of those disclosures for the three years before the request; on request the covered entity provides either an accounting covering its business associates' disclosures or its own accounting plus a list of business associates with contact details, each business associate then accounting on direct request. The Secretary sets by regulation what is collected, taking account of individuals' interests and the administrative burden; the statute's effective dates were 1 January 2014 for records acquired by 1 January 2009 and 1 January 2011 or acquisition for later records, and the implementing regulation has not been finalised (the 2011 proposed rule was not adopted).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.