When a patient requests an accounting of disclosures, Covered Entities do not have to include disclosures for treatments, payments, or health care operations, any disclosures made to the patient, any disclosures previously authorized by the patient, and disclosures to law enforcement. In addition, incidental disclosures, disclosures of PHI in a limited data set, and disclosures of de-identified PHI do not have to be included in the accounting of disclosures.