Upon request, an intermediary must provide to patients who have consented to the disclosure of their records using a general designation, pursuant to § 2.31(a)(4)(ii)(B), a list of persons to which their records have been disclosed pursuant to the general designation.

1. (a) Under this section, patient requests:

   1. (1) Must be made in writing; and
   2. (2) Are limited to disclosures made within the past 3 years.

2. (b) Under this section, the entity named on the consent form that discloses information pursuant to a patient's general designation (the entity that serves as an intermediary) must:

   1. (1) Respond in 30 or fewer days of receipt of the written request; and
   2. (2) Provide, for each disclosure, the name(s) of the entity(ies) to which the disclosure was made, the date of the disclosure, and a brief description of the patient identifying information disclosed.

[89 FR 12625, Feb. 16, 2024]