· ReadyStack
Worked example
Real numbers from this tool, line by line.
$4,383. That is the minimum penalty exposure sitting on one privacy officer's desk at a three-site US family practice: three accounting-of-disclosures requests, all 17 days past the 60-day deadline, at the OCR penalty amounts that took effect on January 28, 2026.
45 CFR 164.528 says a covered entity must act on an individual's request for an accounting of disclosures no later than 60 days after receiving it. A request received on 2026-07-01 was therefore due on 2026-08-30. On 2026-09-16 that request is 17 days late, and a late accounting is a violation. The 2026 amounts at 45 CFR 160.404 put the reasonable-cause tier minimum at $1,461 per violation. Three open requests, still unanswered: $4,383 before anyone argues about culpability.
Four places the clock goes wrong, all in the same afternoon:
The start date. The 60 days run from the date the request was received, not from the date somebody opened the chart or assigned the ticket.
The extension. 164.528(c)(1) allows one extension of no more than 30 days, and only if a written statement of the reasons for the delay and the date the accounting will arrive reaches the individual inside the original 60 days. Send that notice on day 65 and you have not extended anything; you have documented that you were late.
The lookback. Six years before the request. For a request received 2026-07-01 the log has to reach back to 2020-07-01. Ask a general AI assistant and you will often get three years for electronic records instead. That three-year period was proposed under HITECH in 2011 and no final rule ever took effect, so the enforceable period is still the six years in 164.528(a)(1).
The fee. The first accounting an individual asks for in any 12-month period must be provided without charge. Only a later request inside that same 12 months can carry a reasonable, cost-based fee, and only if you tell the individual about the fee first and give them a chance to withdraw or change the request. If the prior accounting went out on 2026-02-10, a request received 2026-07-01 is fee-eligible; if it went out in 2024, it is not.
Then there is the log itself. A patient log with 42 entries is not a 42-line accounting. Disclosures for treatment, payment and health care operations are excluded by 164.528(a)(1)(i), along with disclosures to the individual, incidental disclosures and the other listed exceptions. Take 17 TPO entries out of 42 and the accounting you owe is 25 lines. Sending all 42 is not generous; it is a different document.
So: a browser extension that does exactly this and nothing else. You type the date the request was received, today's date, how many requests are open in the batch, whether the extension notice has already gone out, the date of any prior accounting, and the two log counts. It returns eight answers: the 60-day deadline, the date the single extension would move you to, days left or overdue, the six-year lookback start, free or fee-eligible, the reportable entry count after TPO exclusions, the minimum 2026 exposure, and a sentence saying where the request stands.
All eight are free, in the popup and on the web page, with no key, no sign-in and no usage limit. The same file does the maths in both places. The $60 licence key is for the next axis, not for the answers: exporting each answered request to .csv for the compliance binder, and browser alarms 30, 14 and 1 day before a deadline you have already dated.
An independent HIPAA consultant bills $150-$350 an hour in 2026. Checking the clock costs nothing; being wrong about it starts at $1,461 a request.
Questions people ask
What does this actually do?
You type the date a patient's accounting-of-disclosures request was received. It returns the 45 CFR 164.528 deadline sixty days later, the date the single thirty-day extension would move you to, the six-year lookback start, whether this accounting must be free, how many log entries are reportable after treatment, payment and operations entries come out, and the days you are early or late.
Who is it for?
Privacy officers, HIM and release-of-information staff, and practice managers at US covered entities and business associates who log disclosures and answer patient requests. It is built for people holding a stack of requests with different receipt dates who need each clock separately rather than one policy document that says sixty days.
Why not just ask a chatbot or read the rule?
General assistants still answer with a three-year electronic-record accounting period. That expansion was proposed under HITECH in 2011 and no final rule ever took effect, so six years is what applies. Chatbots also date the clock from the day staff opened the chart instead of receipt, and they do not know your prior accounting date, which decides whether you may charge.
What is free and what needs the key?
Every calculation is free forever: deadlines, extension date, lookback start, fee status, reportable entry count and overdue exposure, with no key, no sign-in and no usage limit. The twenty-nine dollar licence key adds two things on a different axis: exporting your answered requests to a .csv for the binder, and browser alarms thirty, fourteen and one day before a deadline.
What would this cost otherwise?
Independent HIPAA consultants bill roughly one hundred fifty to three hundred fifty dollars an hour in 2026, and small-practice compliance retainers run two hundred to fifteen hundred dollars a month. One accounting answered after day sixty starts at one thousand four hundred sixty-one dollars per violation under the OCR amounts effective January 28, 2026.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.