The HIPAA regulations give individuals the right to know to whom their medical records have been disclosed for up to six years prior to the date of the request. The rule excludes disclosures for treatment, payment, and health care operations—essentially anything you would want to know. The HITECH (Health Information Technology for Economic and Clinical Health) section of the 2009 federal stimulus bill shortens the accounting period to three years and includes disclosures for treatment, payment, and health care operations. What information needs to be accounted for and in what format are contentious enough issues that the Department of Health and Human Services has still not published regulations for implementing the law.