Under HIPAA, a “disclosure accounting” is required for all human subjects research that uses PHI without an authorization from the data subject, except for limited data sets.
If such research doesn't have the proper authorization, then it has to have a disclosure accounting, according to Health Insurance Portability and Accountability Act of 1996 (HIPAA).
