Under HIPAA, a "disclosure accounting" is required

For all human subjects research that uses PHI without an authorization from the data subject, except for limited data sets.