The first link is a bunch of gobbily gook, but it is the part of the law that states you are entitled to an “accounting” of disclosures that the “covered entity” (ie Hospital).
The second link is to the Wikipedia article that this info was found in. It is under the Privacy Rule section.
http://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act#cite_note-18
I knew it was strict, but didn’t realize HOW strict. Thanks.