← All documentation

Requests

Requests is one inbox for what individuals ask your organization: about a decision an AI system made or helped make, and about their protected health information. Each request records what was asked (its type), the legal basis your organization recorded, who is handling it, its deadline, and what the person was told. Every type follows the same steps.

Recording a request here does not mean a law applies to it, and Backsplice never decides that. It is a record of what your organization received and did.

The types of request

The form groups the types by what the person asks.

  • Access to information: what an AI-assisted decision used and how, or, under HIPAA, to inspect or obtain a copy of their protected health information.
  • Explanation of a decision: how an AI system was used in a decision about them and the main reasons for it.
  • Accounting of disclosures: a list of the disclosures of their protected health information your organization made.
  • Correction or amendment: information about them is wrong or incomplete, in data an AI-assisted decision used or in their protected health information.
  • Opt-out of automated decision-making: not to have decisions about them made with an AI system.
  • Restriction of uses or disclosures: to restrict how your organization uses or discloses their protected health information.
  • Confidential communications: to receive communications of their protected health information by other means or at another location.
  • Appeal or human review: for a decision to be looked at again by a person who can change it.
  • Complaint: about a decision, about how an AI system was used, or about how their information was handled.
  • Other: anything else.

A request about protected health information alone is not about an AI system or a decision, and its page does not ask for one: an accounting of disclosures, a restriction of uses or disclosures, confidential communications, and a request of any other type whose every recorded legal basis is a HIPAA Privacy Rule or 42 CFR Part 2 one (an access or amendment request under HIPAA, for example).

The legal basis is recorded by a person

A request can carry one or more legal-basis tags: the EU AI Act's Article 86, the California CCPA regulations (including automated decisionmaking technology), Colorado's automated decision-making technology law, the HIPAA Privacy Rule's rights over protected health information (45 CFR § 164.524 access, § 164.526 amendment, § 164.528 accounting of disclosures, § 164.522 restriction or confidential communications, § 164.530(d) complaints), or another law or policy. Tick a basis only when your organization has decided the request falls under it. Leave it unticked (None recorded) otherwise.

A request carries at most one HIPAA basis, and it must be the right its type asks for: § 164.524 on Access to information, § 164.526 on Correction or amendment, § 164.528 on Accounting of disclosures, § 164.522 on a restriction or confidential communications, and § 164.530(d) on a Complaint. These are a covered entity's duties. A business associate's part is set by its business associate agreement (45 CFR § 164.504(e)(2)(ii)(E)–(H)), and a business associate must itself provide an electronic copy where the covered entity needs it to meet § 164.524 (§ 164.502(a)(4)(ii)). The rule's deadlines are the covered entity's; an agreement may set a business associate an earlier one. An organization recorded as a business associate alone sees its due date as Your response target ("not yet set" while it is still the rule's date), with the covered entity's deadline beside it, counted from the date the request reached you; confirm that date with the covered entity. Its denial outcomes name whose decision it was: The covered entity denied access, The covered entity denied access in part (the rest was provided), The covered entity denied the amendment and The covered entity denied the amendment in part (the rest was made).

When a basis is ticked, the request's page quotes the provisions of that law that correspond to the request type, word for word and with their citation, for reference. Whether and how a provision applies to your organization is for your organization and its counsel to decide; this is not legal advice.

The deadline follows the legal basis

A request with a HIPAA basis takes the rule's own date as its outer limit: § 164.524 access within 30 days of receipt, and § 164.526 amendment and § 164.528 accounting within 60 days. It is the latest date allowed, not a target: state law or a business associate agreement may set an earlier one. Leave the Due date blank to work to the rule's date, labeled Legal deadline with its paragraph, or set an earlier date, which shows as Your response target with the outer limit beside it. A later date is refused.

Each of the three allows one extension of no more than 30 days, provided that, no later than the original outer limit, the individual is given a written statement of the reasons for the delay and the date the action will be completed. Record that statement with Extend the deadline on the request's page: the date it was given, the new date it named, and the reasons. The inbox then marks the date Extended. § 164.522 and § 164.530(d) set no deadline, so a restriction, confidential communications or complaint request with that basis shows No deadline set by the rule unless you set your own target (state law or your policy may set one). Count from the date your organization received the request, not the date it was logged.

Every other request has Your response target. A new request starts with your organization's default, a number of days after the date it was received (30 days until an administrator changes it on the register page), and the person recording it can change the date. It is your organization's own target, not a legal deadline. Where a law you record states a period, the request form lists those periods, quoted and cited, beside the date, so your team can set the target with them in view.

The inbox sorts by deadline, with requests that have none last. An open request past its deadline is marked Overdue in red on the inbox, on the AI system's page and in My Work. The handler, or the organization's admins when there is no handler, is reminded once when the due date is 7 days away and once when it has passed. Changing the date sends the reminders again for the new one.

How a request moves

  • Received: recorded, not yet worked on.
  • In progress: someone is preparing the response.
  • Responded: the response is recorded: what the person was told, the outcome, the date, and for an appeal the human reviewer who looked at the decision again. Where you can, choose a reviewer who did not make or own the original decision.
  • Closed: done. A request is closed only after its response is recorded.
  • Denied: refused, with the reason recorded. An access request under § 164.524 or an amendment request under § 164.526 is not denied this way: its denial is a response, recorded with its ground and written denial (below). The rule does not let you decline a restriction of disclosures to a health plan of an item or service paid for in full (§ 164.522(a)(1)(vi)); the record does not know whether it was paid in full, so check that before you record Denied.
  • Withdrawn: the person withdrew it.

A closed, denied or withdrawn request can be reopened with a reason; it returns to In progress. Every move is written to your organization's audit log.

Recording the response

A refused response names every field it refuses in the part you filled in (how access was given, the denial of access, or the denial of amendment), each on its own line, and marks each one; the page opens at the first. The response, the outcome and the date are checked first, and for a partial grant the denial before how access was given, so a second refusal can follow the first. The other forms on the page name one refusal at a time.

Every save of a denial of access or of amendment, its review or its statement stage keeps the record as it stood before: Earlier versions under the denial lists each, with when it was replaced. A response recorded again starts from what was recorded before, its statements included.

The response form shows, for the outcome you choose, only what that outcome records: how access was given, the denial of access, or the denial of amendment. A partial grant shows both of its parts; with no outcome chosen yet every part shows, and a part holding a refused field stays shown. Without JavaScript every part is shown, and the parts an outcome does not use are ignored.

How access was given

When a request for access under 45 CFR 164.524 is answered Access provided or Access partly granted, the response records how (§ 164.524(c)):

  • The access given: inspection, a copy, or both. For a copy, the form the individual asked for (paper or electronic) and, in words, the format.
  • How it was given: in the form and format asked for if it is readily producible that way; if not, in a readable hard copy or another form and format agreed with the individual (for information kept electronically and asked for electronically, a readable electronic form and format agreed with them; a paper copy given for an electronic request is marked on the record; a readable hard copy needs no agreement); or as a summary given instead of access, which the individual agreed to, with any fee, in advance (§ 164.524(c)(2)). An explanation given with the access, agreed to the same way, is ticked beside it. On a request under § 164.524, a summary or an explanation is recorded under Access provided, which is why Explanation provided is not offered there.
  • A copy sent to a person the individual designated: the person and where it went, and that the designation is in writing, signed by the individual, and clearly identifies both (§ 164.524(c)(3)(ii)). Auditors do not see the person or the address.

These entries beside another choice are refused rather than dropped: an agreement ticked beside a choice it does not belong to, a form or format given beside In the form and format asked for or a summary, or the signed-writing tick with no designated person. What was asked for (the kind of access, and the form and format of a copy) is not kept for a summary, or for inspection alone.

Backsplice records these as your statement; it does not read the request or the copy. No fee is recorded here. If you charge for a copy, or for a summary or explanation the individual agreed to, § 164.524(c)(4) limits the fee to a reasonable, cost-based one covering only copying labor, supplies (paper, or portable media the individual asked for), postage when the individual asked for mailing, and preparing an agreed summary or explanation.

A denial of access, in whole or in part

When a request for access under 45 CFR 164.524 is answered Access denied or Access partly granted, the response records the denial as the HIPAA Privacy Rule describes it. The two outcomes are offered only on a request whose legal basis is that rule; there a refusal is always one of them, so Deny and Refused, with the reason given are not offered. An access request under another law is refused with its reason.

  • The ground: one of the provisions a denial may rest on. The grounds in § 164.524(a)(2) need no review (psychotherapy notes, or information compiled in reasonable anticipation of, or for use in, a legal action or proceeding; an inmate's request for a copy, at a correctional institution; research that includes treatment; Privacy Act records; information obtained from someone other than a provider under a promise of confidentiality). Under the ground, What counts as psychotherapy notes quotes the § 164.501 definition: information outside it is not withheld on that ground. The grounds in § 164.524(a)(3) are **reviewable on request**: a licensed health care professional determined that access is reasonably likely to endanger someone's life or physical safety, or to cause substantial harm. For these, you name the professional who made the determination (a member, or someone outside the organization) and confirm they are licensed.
  • What was withheld, and for a partial grant what was provided: you deny the whole request only where every part falls under a ground, and give access to the rest (§ 164.524(d)(1)). Describe it; never copy the information itself. Auditors see neither description.
  • The written denial: the date it was given, and that it states, in plain language, the basis, the review rights where they exist, and how to complain to you or to the Secretary (§ 164.524(d)(2)). Backsplice records that you say it does; it does not read the letter. A written denial given after the request's legal deadline, its extension included, is marked on the record: the rule asks for a timely one (§ 164.524(b)(2), (d)(2)).

If you do not hold the information and know who does, you tell the individual where to direct the request (§ 164.524(d)(3)). That is not a denial on a ground: record it as Other. Where you act as a business associate, a denial and its review are the covered entity's decision; record what your business associate agreement has you do.

For a reviewable ground, Record the review records each step as it happens: when the individual asked for the review, when you referred it to the reviewing official (optional; you refer it promptly, § 164.524(d)(4)), the reviewing official (a member, or someone outside the organization named in words), and their determination and its written notice. The reviewing official is a licensed health care professional you designate who did not participate in the original decision to deny (§ 164.524(a)(4), (d)(4)): you confirm both, and Backsplice records your statement. It refuses as reviewing official the member who first recorded the denial, and the professional who made the determination, whether you picked them as a member or typed their name (a typed name is matched ignoring case, spacing and a leading "Dr"); it does not verify a license. You provide or deny access as the official determines: after a reversal, the record and the Requests badge show the access still to provide until you reopen the request and record the response with it. A denial recorded again on another ground starts its review afresh, and a denial replaced by a later response leaves the calendar and the badge.

The rule sets no time for the review: the official decides "within a reasonable period of time". You may set your own target on the Requests page (Target for deciding a review of a denial of access); a review requested after you set it is dated by it, shows on the calendar, and counts on the Requests badge once it is past and not yet decided. A review keeps the date it was given, or the absence of one, when the target later changes.

What the badge counts, the Requests page shows too: a Denial review or reversal owed tile and filter (a review past your target and not yet decided, or a reversal whose access is not yet recorded), and a pill on each such request, whose status alone would read Responded.

A denial of amendment, in whole or in part

When a request for amendment under 45 CFR 164.526 is answered Amendment denied or Amendment made in part, the response records the denial. The two outcomes are offered only on a correction request whose legal basis is that rule; there a refusal is always one of them, so Deny and Refused, with the reason given are not offered.

  • The ground or grounds (a partial denial may rest on several): the information was not created by your organization (unless the individual gives a reasonable basis to believe its originator is no longer available to act on the amendment), is not part of the designated record set, would not be available for inspection under § 164.524, or is accurate and complete (§ 164.526(a)(2)).
  • What was not amended, and for an amendment made in part what was. Describe it; never copy the information itself. Auditors see neither description.
  • The written denial: the date it was given, and that it states, in plain language, the basis, the individual's right to submit a written statement of disagreement and how, that without one they may ask that the request and the denial go with any future disclosure of the information, and how to complain to you or to the Secretary (§ 164.526(d)(1)). Backsplice records that you say it does; it does not read the letter. One given after the legal deadline is marked on the record, as for access.

Record the statement of disagreement then records, as each happens: the date the individual's written statement arrived and what it disputes, or, with no statement, their request that the request and the denial go with future disclosures; your written rebuttal, if you prepare one, and that a copy was given to them (§ 164.526(d)(2), (3)); and that the request, the denial, the statement and the rebuttal are appended or linked to the record they concern ((d)(4)). The record then says what any later disclosure of that information carries ((d)(5)). A denial replaced by a later response takes no statement.

When an amendment is made, in whole or in part, list under Those to inform of the amendment each person or organization you are to inform and give the amendment to: those the individual names as having received the information and needing it, and those you know have it and may rely on it to the individual's detriment, business associates included (§ 164.526(c)(3)). Those the individual names are informed with their agreement (§ 164.526(c)(2)). Record the date each was informed; the list shows how many are still to inform. Record the amendment's steps records, as your statement, that the affected records in the designated record set are identified and the amendment appended or linked to them (§ 164.526(c)(1)), and that the individual was told it was accepted and asked to identify, and agree to your notifying, those who need it ((c)(2)).

Where you act as a business associate, a denial of amendment and its written denial are the covered entity's decision; record what your business associate agreement has you do. A recorded statement of disagreement is kept: it cannot be cleared from the form.

Drafting the written denial with Watney

On a request recorded under the right of access (45 CFR 164.524) or the right to amend (45 CFR 164.526), a member who can act on it can choose the response and its ground under Draft the written denial and Draft with Watney. The letter has a paragraph for each element the rule requires of that denial, in the rule's order: for a denial of access, the basis, the statement of review rights where the ground carries them, and how to complain; for a denial of amendment, the basis, the right to submit a statement of disagreement, what happens without one, and how to complain. An element Watney did not write is shown as a [To complete] naming the element and its text, so none goes missing. The greeting and the signature are always left for you to complete; Watney is told to leave the contact for complaints and any other detail the records do not give as a [To complete] too, so check that it did. Nothing is recorded or sent; Watney's history keeps a copy of what it drafted.

What you choose and the optional description are sent to the AI model provider. The request's record, which names the individual, is not; do not type a name or contact detail into the description. Nothing is recorded: record the denial with the Responded step, and have the letter reviewed before it is sent.

An agreed restriction stays as recorded

Once a request's outcome is Restriction agreed or Confidential communications accommodated, the outcome is fixed: reopening the request and responding again keeps it, and the request cannot be denied. A restriction stays in effect after the request closes, and ends only by its termination (45 CFR § 164.522(a)(2)). When it ends, open the request and use Record the termination, in any status: the date it was terminated, and how: the individual agreed to or asked for it in writing, the individual agreed orally and that agreement is documented, or your organization informed the individual that it is terminating its agreement. The outcome then reads Restriction terminated, which is final. A termination your organization makes by informing the individual is not effective for a restriction the rule required you to agree to (a disclosure to a health plan of an item or service paid for in full, § 164.522(a)(1)(vi)), and is effective only for protected health information created or received after the individual was informed; keep the written request, the documented oral agreement or your notice as evidence. A terminated restriction is kept like an agreed one, until six years after a termination by the individual (below): it is documentation of the restriction (§ 164.522(a)(3)).

Under an agreed restriction, the restricted information may still be used, or disclosed to a health care provider, when the individual needs emergency treatment and the information is needed for it; you then ask the provider not to use or disclose it further (§ 164.522(a)(1)(iii), (iv)). Record each such use under Emergency treatment uses on the request: the date, and whether your organization used the information itself or disclosed it to a health care provider; for a disclosure, the provider and that you asked them not to use or disclose it further. A use is dated between the response that agreed the restriction and today, or a termination by the individual: after a termination by your notice, information from before it is still restricted. Entries are never edited; they are kept with the request. Explain a mistaken one in the request's notes.

The disclosure log and the accounting of disclosures

Risks & operations → Disclosure log is where an organization admin records each disclosure of protected health information as it happens: the date, who received it and their address, what was disclosed, why, the permission it was made under, and who made it if a business associate did (an accounting includes disclosures by business associates, 45 CFR § 164.528(b)(1)). Use your own record number for the individual, never their name. Log every disclosure, including one an exclusion covers (treatment, payment and health care operations, to the individual, under an authorization, and the others in § 164.528(a)(1)): choose the exclusion, and the accounting leaves it out. A disclosure the rules did not permit is accounted for, and so is an ordinary disclosure to law enforcement. A disclosure made again and again for one purpose is logged each time; the accounting can give them as one entry (below).

A health oversight agency or law enforcement official to whom a disclosure was made may ask for the individual's accounting of it to be suspended (§ 164.528(a)(2)): in writing, for the time the statement specifies, or orally, documented in the notes with who asked, for no longer than 30 days unless a written statement follows. Record the kind of statement, its date, the end of the suspension and who asked.

An Accounting of disclosures request produces the accounting on its own page: enter the individual's record number exactly as logged and choose Produce the accounting, and it lists every accountable disclosure recorded in the log in the 6 years before the date the request was received, or a shorter period the individual asked for, with the date, the recipient and their address, what was disclosed and why (§ 164.528(b)). Disclosures left out under an exclusion, or suspended, are counted on the page; the downloaded file lists only what the individual receives. Record this accounting as provided keeps it exactly as given, whatever the log says later, as § 164.528(d) requires; then move the request to Responded once it is sent. The first accounting an individual asks for in any twelve months is free; a later one may carry a reasonable, cost-based fee only if the individual is told in advance and can withdraw or change the request (§ 164.528(c)(2)). An organization recorded as a business associate uses the same page to give the covered entity what it needs for the covered entity's accounting (§ 164.504(e)(2)(ii)(G)). The log and the accountings are open to organization admins only, and downloading them comes with a paid plan.

Two summary forms are optional when you produce the accounting (§ 164.528(b)(3), (4)):

  • Give repeated disclosures to one recipient for one purpose as one entry: multiple disclosures to the same person or entity for a single purpose, under a permission of § 164.512 or to HHS, become one entry: the first one's date, recipient, description and purpose, how many were made in the period, and the date of the last. The same recipient (capital letters and spacing aside), permission and purpose text make one group; a disclosure the rules did not permit, or one recorded as Other, stays its own entry.
  • List the research protocols in place of the research disclosures logged under them: where disclosures for a particular research purpose under § 164.512(i) were for 50 or more individuals, list the protocol instead. Record each protocol under Research protocols on the disclosure log: its name, a plain-language description with its purpose and how records were selected, the type of information disclosed, the period and the last disclosure, and the sponsor's and researcher's name, address and telephone number. In the log, link each research disclosure to the protocol it was made under. The accounting lists every protocol whose period overlaps its own, with its period and last disclosure taken within the accounting's, and the statement that the individual's information may or may not have been disclosed for it; it leaves out the research disclosures logged under a listed protocol, and a research disclosure not linked to one stays listed. A protocol whose last disclosure within the period is not known cannot be recorded in an accounting until its disclosures are logged. The research summary lists every protocol recorded as for 50 or more individuals whose period overlaps the accounting's. Untick, for this accounting, a protocol whose criteria for selecting records could not have included the individual, or whose disclosures in the period were for fewer than 50 individuals, and produce it again: that protocol is not listed, and its disclosures are listed as disclosures. The choice is kept when you record or download the accounting; producing it again from the lookup lists every protocol again. At the individual's request, you help them contact the sponsor and the researcher where it is reasonably likely their information was disclosed (§ 164.528(b)(4)(ii)).

Neither summary form applies to a 42 CFR § 2.25 accounting: its disclosures are made with consent or for treatment, payment or health care operations, not under § 164.512. An accounting recorded as provided keeps the summaries and the protocols as given, and counts its entries (a summarized entry stands for several disclosures).

42 CFR Part 2 requests

An organization that answered that it operates a Part 2 program may also record two Part 2 bases, whatever its HIPAA answer; a lawful holder of Part 2 records that is not a Part 2 program records a request under the HIPAA bases where HIPAA applies to it.

  • 42 CFR § 2.25 on an accounting of disclosures: an accounting of the disclosures of Part 2 records made with the individual's consent under § 2.31 in the 3 years before the request (or a shorter period the individual chose), subject to § 2.25(b): those for treatment, payment or health care operations are in it only where made through an electronic health record. It must meet 45 CFR § 164.528(a)(2) and (b) through (d) (§ 2.25(a)), so it is due within 60 days, with one extension, and a suspension holds. In the disclosure log, mark each such disclosure under A disclosure of Part 2 records; the § 2.25 accounting lists the marked ones whatever the HIPAA exclusions say (one logged before the field existed, or left unmarked, is not listed), and a provided one is kept with its rule. HHS has reportedly delayed compliance with § 2.25 until it finalizes changes to 45 CFR § 164.528, a delay the stored regulation text does not record: have counsel confirm whether the accounting, and its deadline, are owed yet.
  • 42 CFR § 2.26 on a restriction: the same as a § 164.522 restriction here: a Part 2 program need not agree to a restriction (§ 2.26(a)(2)) except one of disclosures to a health plan, for payment or health care operations and not otherwise required by law, of a record that pertains solely to an item or service paid to the program in full other than by the plan (§ 2.26(a)(6)); in an emergency the restricted record may be used, or information derived from it disclosed to a health care provider, which is logged (§ 2.26(a)(3), (4)); an agreed restriction does not prevent a use or disclosure required by law, or one permitted for a purpose other than treatment, payment or health care operations (§ 2.26(a)(5)); and it is terminated the same three ways (§ 2.26(b)). The rule sets no deadline.

A request carries one HIPAA or Part 2 basis. A Part 2 program that is also a covered entity may owe both: record the request once under each basis. One written response may serve both if it meets each rule.

Who sees what

  • Administrators record and edit requests, see every request, and can delete one recorded in error, except a request under which an accounting of disclosures was provided: that accounting is kept (§ 164.528(d)), so the request is kept with it. Nor can they delete a request that records an agreed restriction or confidential-communications accommodation, or a restriction's termination: it may still be in effect, or documents one that was, so it is never deleted by hand; the nightly job keeps it as described below. Nor can they delete a HIPAA request within six years of its closing, except one recorded by mistake, while it is open, within 24 hours of being recorded.
  • Contributors see the requests they handle or review and, from the request's page, move them through every step: record the response, extend a HIPAA deadline, close, deny or mark withdrawn, reopen with a reason, and record a restriction's termination. Recording and editing a request's details, and deleting one, are for administrators.
  • Auditors with access to the AI system registry see every request and export the register, with the names and contact details of the requester and the individual withheld: they see your reference for the person instead.

Personal data

The requester's name and contact details are optional, as is the individual, the person the request is about when someone else asks for them (a parent or a personal representative). Record them only if your team needs them here to respond. How the requester was verified records how you confirmed who they are and their authority to ask: describe the method, never an identity document number. Auditors see how the requester was verified. Names and contact details are withheld from auditors, left out of reminders, notifications, the digest and the calendar, not searched, and deleted with your organization's data. Keep names out of the summary and the response: use your reference for the person instead.

Viewing a request about an individual's rights over their protected health information (a HIPAA type of request, or one under a HIPAA legal basis), an entry of the disclosure log or an accounting of disclosures is written to your organization's audit log as a phi.viewed event: who viewed which record, from the dashboard, the API or a connected assistant. A list records one event naming how many such records it showed. The event names each record by its identifier, never by its reference, summary or contents. A download of such records is recorded as an export. An API key or a connected assistant reading such a request gets it without its references, summary, response or other text a person typed, and a text search through either never matches it: only the dashboard shows them.

How long requests are kept

How long to keep request records is your organization's decision. Some laws require records of requests and responses to be kept for a period, and the request page quotes those provisions where they are recorded. This is not legal advice.

By default, Backsplice keeps a request until an administrator deletes it or your organization's data is deleted. An administrator can instead set Retention of closed requests on the register page: closed requests are then deleted that many months after they were closed, by a nightly job. The setting is measured from the date a request was closed and cannot be set below 48 months, the longest of the record-keeping periods quoted beside it that every request is held to (the California CCPA regulations, § 7101(a); Colorado's § 6-1-1703 as reenacted by SB 26-189, which takes effect on January 1, 2027 for consequential decisions made from that date; and California's employment regulations on automated-decision systems, § 11013(c), four years). Colorado's period runs from the date of the decision, not from the request. Other laws can require longer, and a request involved in a complaint, an investigation or litigation may need to be kept until that ends; the nightly job cannot tell. Leave the field blank to go back to keeping every request.

Only Closed requests are deleted this way: a closed request is one whose response was recorded. Open requests, Denied requests and Withdrawn requests are never deleted by the setting; an administrator can delete one by hand, unless an accounting of disclosures was provided under it, it records an agreed restriction or accommodation or a restriction's termination, or it is a HIPAA request (a HIPAA basis, or a type about protected health information) closed less than six years ago. A HIPAA request recorded by mistake can be deleted while it is open, within 24 hours of being recorded. A request with a HIPAA legal basis, or of a type about protected health information, is not deleted by the nightly job until six years after it was closed, whatever the period set. An agreed restriction or confidential-communications accommodation is never deleted by the setting, because 45 CFR § 164.530(j)(2) runs six years from when documentation was created or last in effect, whichever is later, and an agreed restriction stays in effect until it is terminated (§ 164.522(a)(2)). A restriction terminated with the individual's written or documented oral agreement is deleted by the setting only once six years have passed since its termination, when it was last in effect. A restriction your organization terminated by informing the individual stays in effect for information created or received before you informed them (§ 164.522(a)(2)(iii)), so it is kept like an agreed one. One whose termination date is not recorded is kept. Whether this record is the documentation the rule requires is for your organization to decide. A deleted request cannot be restored. Your organization's audit log records each nightly deletion with the number of requests deleted, never what they said or who made them, and records every change to the setting.

Exporting

Export CSV downloads the requests the register is showing, with the same filters. An auditor's file withholds the name and contact columns.

PDF, on a request's page, downloads that one request as a document for your organization's records: the request, the response if one is recorded, and the provisions of the recorded legal basis that bear on this type of request, quoted for reference. Review it before sharing any of it with the person: it carries your handler's and reviewer's names and your internal reasons. Anything the record does not hold is stated as not recorded. Administrators and auditors with access to the AI system registry can download it; an auditor's copy withholds the person's name and contact and says so. Each download is recorded in your organization's audit log.

In the digest

The daily or weekly digest email lists how many requests are past due and how many are due within 7 days: the organization's counts for administrators, and the requests they handle or review for other members. Auditors are not told. The digest carries counts only, never the person's name, contact or reference.