OpenDQV Cloud starter template (v0.1) — your tenant inherits this baseline. First customer edit creates v1.0 in your audit trail; pin by yaml_hash for replay. Health Insurance Portability and Accountability Act (HIPAA) — 45 CFR 164.528, Accounting of Disclosures compliance contract. Covered entities and business associates must maintain an accounting of disclosures of protected health information (PHI) for six years. This contract enforces completeness at the point of write: covered entity identification, recipient details, disclosure purpose, PHI categories, date, and conditional fields for patient authorization, minimum necessary standard, and research IRB waivers. The omission failure mode: a disclosure record is created without the required recipient type, disclosure purpose, or authorization reference. OCR audit finds incomplete accounting of disclosures. Civil monetary penalties up to $2.1M per violation category per year under 42 USC 1320d-5. Criminal referral possible under 42 USC 1320d-6 (up to $250K fine and 10 years imprisonment for wrongful disclosure).
| Rule | Field | Severity | What it enforces (the message your team sees) |
|---|---|---|---|
| record_id_required | record_id | error | record_id is required — every disclosure accounting entry must be uniquely identifiable per 45 CFR 164.528 |
| record_id_unique | record_id | error | record_id must be unique within this batch — duplicate records compromise the disclosure accounting log (45 CFR 164.528). Note: OpenDQV validates uniqueness within the input payload only; cross-batch uniqueness against the covered entity's disclosure register is the responsibility of the upstream system. |
| covered_entity_name_required | covered_entity_name | error | covered_entity_name is required — 45 CFR 164.528 requires identification of the covered entity or business associate making the disclosure |
| covered_entity_type_required | covered_entity_type | error | covered_entity_type is required — identify whether the disclosing entity is a covered_entity or business_associate per 45 CFR 160.103 |
| covered_entity_type_valid | covered_entity_type | error | covered_entity_type must be one of: covered_entity, business_associate — per 45 CFR 160.103 definitions |
| recipient_name_required | recipient_name | error | recipient_name is required — 45 CFR 164.528(b)(2)(ii) requires the name of the entity or person who received the PHI |
| recipient_type_required | recipient_type | error | recipient_type is required — 45 CFR 164.528(b)(2)(ii) requires the address (and type) of the recipient |
| recipient_type_valid | recipient_type | error | recipient_type must be one of: covered_entity, business_associate, individual, public_health_authority, law_enforcement, oversight_agency, researcher, other |
| phi_categories_required | phi_categories | error | phi_categories is required — 45 CFR 164.528(b)(2)(iii) requires a brief description of the PHI disclosed |
| patient_identifier_required | patient_identifier | error | patient_identifier is required — the disclosure must be linked to a specific individual for the accounting to be meaningful per 45 CFR 164.528 |
| disclosure_purpose_required | disclosure_purpose | error | disclosure_purpose is required — 45 CFR 164.528(b)(2)(iv) requires a brief statement of the purpose of the disclosure |
| disclosure_purpose_valid | disclosure_purpose | error | disclosure_purpose must be one of the 45 CFR 164.512 permitted purposes: treatment, payment, healthcare_operations, required_by_law, public_health, health_oversight, judicial_proceedings, law_enforcement, decedents, research, serious_threat, workers_compensation, patient_authorization, other |
| disclosure_date_required | disclosure_date | error | disclosure_date is required — 45 CFR 164.528(b)(2)(i) requires the date of each disclosure |
| disclosure_date_format | disclosure_date | error | disclosure_date must be a valid date (YYYY-MM-DD) — per 45 CFR 164.528(b)(2)(i) |
| authorization_reference_required_if_patient_auth | authorization_reference | error | authorization_reference is required when disclosure_purpose is patient_authorization — 45 CFR 164.508 requires a valid authorization form; record the reference number |
| minimum_necessary_applied_required_if_payment | minimum_necessary_applied | error | minimum_necessary_applied is required for non-treatment disclosures — 45 CFR 164.502(b) minimum necessary standard applies |
| minimum_necessary_applied_required_if_healthcare_ops | minimum_necessary_applied | error | minimum_necessary_applied is required for non-treatment disclosures — 45 CFR 164.502(b) minimum necessary standard applies |
| minimum_necessary_applied_required_if_research | minimum_necessary_applied | error | minimum_necessary_applied is required for non-treatment disclosures — 45 CFR 164.502(b) minimum necessary standard applies |
| minimum_necessary_applied_required_if_law_enforcement | minimum_necessary_applied | error | minimum_necessary_applied is required for non-treatment disclosures — 45 CFR 164.502(b) minimum necessary standard applies |
| minimum_necessary_applied_valid | minimum_necessary_applied | error | minimum_necessary_applied must be 'true' or 'false' |
| minimum_necessary_method_required_if_applied | minimum_necessary_determination_method | error | minimum_necessary_determination_method is required when minimum_necessary_applied is true — record how the minimum necessary determination was made per 45 CFR 164.514(d) |
| research_irb_waiver_required_if_research | research_irb_waiver | error | research_irb_waiver is required when disclosure_purpose is research — 45 CFR 164.512(i) requires documentation of IRB or Privacy Board waiver of authorization |
| research_irb_waiver_valid | research_irb_waiver | error | research_irb_waiver must be 'true' or 'false' |
| reviewed_by_required | reviewed_by | error | reviewed_by is required — record who reviewed this disclosure accounting entry for HIPAA compliance |
| review_date_required | review_date | error | review_date is required |
| review_date_format | review_date | error | review_date must be a valid date (YYYY-MM-DD) |
Run your own data against this contract in the free trial — drop a CSV in the dashboard, no code, no credit card. Start free trial →