A three-physician family practice outside Harrisburg learns on a Monday that its billing vendor's portal was compromised the week before. The practice manager pulls up the HIPAA breach rule and starts a 60-day clock. Then a colleague asks two questions nobody in the office can answer: does the Pennsylvania Attorney General need a letter, and does the state's own breach act run a shorter clock than the federal one?
Pennsylvania has no single health privacy code. It has a breach act with a HIPAA clause written into it, a mental health statute, an HIV confidentiality act, a drug and alcohol confidentiality act, and licensing-board retention rules, each sitting on the federal baseline. This guide covers how the layers interact, the statutes that matter, what the breach act requires, penalties, provider-type notes, and a checklist.
HIPAA Compliance Pennsylvania: How the Federal and State Rules Stack
HIPAA sets a federal floor. The preemption rule at 45 CFR 160.203 says a HIPAA standard "that is contrary to a provision of State law preempts the provision of State law," then lists exceptions. The one that matters for privacy is paragraph (b): state law survives when it "relates to the privacy of individually identifiable health information and is more stringent than" the Privacy Rule. Under 160.202, "more stringent" includes a state law that "prohibits or restricts a use or disclosure" HIPAA would permit, or that requires "a longer duration" of retention.
Where Pennsylvania is tougher on privacy, Pennsylvania controls; where HIPAA is tougher, HIPAA controls. A Pennsylvania practice complies with both at once; the general framework is in state privacy laws vs HIPAA. Pennsylvania has one unusual feature: since 2022, its breach statute and two of its confidentiality statutes have been amended to point back at HIPAA rather than fight it.
Who Is a Covered Entity in Pennsylvania
The definition is federal and does not change at the state line. 45 CFR 160.103 defines a covered entity as "a health plan," "a health care clearinghouse," or "a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter." In Pennsylvania that captures hospitals, physician practices, dental offices, behavioral health providers, home health agencies, pharmacies, nursing facilities, and health insurers. The test is electronic billing, not size.
Who Is a Business Associate in Pennsylvania
A business associate under 160.103 is a person who, on behalf of a covered entity, "creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter," including "claims processing or administration," "billing," and "practice management," or who provides "legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services" that involve P.H.I. (Protected Health Information). Subcontractors count too. The EHR vendor, billing company, IT firm, cloud backup provider, and answering service all need a signed B.A.A. (Business Associate Agreement); the required terms are in the BAA requirements guide.
Pennsylvania law now uses the same vocabulary: the Mental Health Procedures Act defines "business associate" by reference to 45 CFR 160.103, and the breach act requires any "vendor that maintains, stores or manages computerized data on behalf of another entity" to notify that entity "following discovery" of a breach.
Pennsylvania Privacy Statutes That Stack on HIPAA
Five bodies of Pennsylvania law matter, each cited to the General Assembly's or the Pennsylvania Code's own text. The Breach of Personal Information Notification Act (Act 94 of 2005, amended by Act 151 of 2022 and Act 33 of 2024) gets its own section below; the other four follow here.
The Mental Health Procedures Act (Act 143 of 1976)
Section 111 says "all documents concerning persons in treatment shall be kept confidential and, without the person's written consent, may not be released or their contents disclosed to anyone except" five listed recipients. Since Act 32 of 2022, the fifth is "a covered entity or a covered entity's business associate that makes the use, disclosure or request for disclosure in accordance with 45 CFR Pt. 164 Subpt. E." The Act's scope, per Section 103, is "all involuntary treatment of mentally ill persons, whether inpatient or outpatient, and for all voluntary inpatient treatment."
Two limits remain. Section 111 still says "in no event" may "privileged communications, whether written or oral, be disclosed to anyone without such written consent," and the Department of Human Services regulations at 55 Pa. Code Chapter 5100 still list a narrow set of nonconsensual releases and require that "requests for information and the action taken should be recorded in the patient's records." Have counsel confirm how the 2022 amendment and Chapter 5100 fit together.
The Confidentiality of HIV-Related Information Act (Act 148 of 1990)
Section 7 limits disclosure of "confidential HIV-related information" to a closed list of recipients, among them the subject, persons named in a written consent, treating staff, insurers for payment, and public health authorities. The written consent must contain nine elements, including the purpose, "how much and what kind of information is to be disclosed," a revocation statement, and an expiration "date, event or condition." A consent that "on its face substantially fails to conform" cannot be used. Every consented disclosure must carry a statutory notice ending: "A general authorization for the release of medical or other information is not sufficient for this purpose."
Section 10 gives "any person aggrieved by a violation of this act" a civil cause of action for compensatory damages, Section 11 makes "each disclosure" a separate violation, and Section 7(f) requires institutional providers to keep written confidentiality procedures. A federal HIPAA authorization form does not satisfy this Act on its own.
The Pennsylvania Drug and Alcohol Abuse Control Act (Act 63 of 1972)
Section 8(b) says patient records "prepared or obtained pursuant to this act" "may not be disclosed without the patient's consent" except to medical personnel "exclusively for purposes of diagnosis and treatment," to officials for the purpose of obtaining benefits, and "to a covered entity or a covered entity's business associate" acting under the Privacy Rule. Anything else requires "an order of a court of common pleas after application showing good cause." Federally assisted programs also carry 42 CFR Part 2.
Records Retention and Copy Fees
Pennsylvania sets retention by license type rather than in one statute:
- Physicians: 49 Pa. Code 16.95(e): "at least 7 years from the date of the last medical service," and for a minor "until 1 year after the minor patient reaches majority, even if this means that the physician retains the record for a period of more than 7 years."
- Dentists: 49 Pa. Code 33.209(b): "a minimum of 5 years from the date of the last dental entry"; 33.209(c) requires a copy "within 30 days of receipt of a written request."
- Hospitals: 28 Pa. Code 115.23: "a minimum of 7 years following the discharge of a patient," and for a minor "until his majority, and then for 7 years."
- Home health agencies: 28 Pa. Code 601.36(b): "retained for 7 years after discharge of the patient."
Those clocks are separate from HIPAA's own six-year rule for compliance documentation at 45 CFR 164.316(b)(2)(i) and 164.530(j)(2); the two are untangled in how long to keep medical records. On fees, 42 Pa.C.S. 6155(b) gives every patient "the right of access to his medical charts and records and to obtain photocopies of the same, without the use of a subpoena," capped at the schedule in 42 Pa.C.S. 6152(a)(2)(i), adjusted each January by the Secretary of Health. HIPAA's "reasonable, cost-based fee" limit at 164.524(c)(4) still applies to a patient's own request, and the lower figure governs.
Pennsylvania Breach Notification Requirements
The Federal Clock
Under 45 CFR 164.404(b), a covered entity notifies each affected individual "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach." Under 164.408, a breach involving 500 or more individuals is reported to HHS "contemporaneously" with the individual notices; a smaller breach is logged and reported "not later than 60 days after the end of each calendar year." An impermissible disclosure is presumed to be a breach unless a four-factor risk assessment under 164.402 shows "a low probability that the protected health information has been compromised." The process is in the breach notification rule guide.
The Pennsylvania Clock
Section 3(a) of the breach act requires "an entity that maintains, stores or manages computerized data that includes personal information" to notify affected Pennsylvania residents "without unreasonable delay" following "determination of the breach." The Act sets no day count for private entities; a state agency gets seven business days. "Personal information" means a name combined with a Social Security number, a driver's license or state ID number, a financial account number with its access code, "health insurance information" (a policy or subscriber number with an access code or other medical information that permits misuse of benefits), or online account credentials. Standalone "medical information" counts only when held by a state agency or its contractor, and encrypted data is outside the Act unless the key was also compromised.
Notice to the Pennsylvania Attorney General
Act 33 of 2024 added Section 3(c.1): when notice "must be given to more than 500 affected individuals in this Commonwealth, notice shall be made concurrently to the Office of Attorney General," stating the organization name and location, breach date, a summary, and estimated totals overall and for Pennsylvania. Section 5 separately requires notice to the nationwide consumer reporting agencies when more than 500 persons are notified at one time. Section 5.4, also from 2024, requires the entity to pay for 12 months of credit monitoring when a name was exposed with a Social Security number, bank account number, or driver's license or state ID number.
The HIPAA Clause: Deemed Compliance, With a Condition
Section 5.3, added by Act 151 of 2022, says "any covered entity or business associate that is subject to and in compliance with the privacy and security standards" of HIPAA and HITECH "shall be deemed to be in compliance with the provisions of this act." The clause has a condition: the entity must actually be in compliance with the federal standards. A practice with a current risk analysis, written policies, and a documented breach procedure has a strong claim to that safe harbor; one that skipped those steps does not. The Attorney General notice was added two years after the deeming clause, and no court decision or Attorney General guidance on how the two interact was located for this article. The conservative course for a breach touching more than 500 Pennsylvania residents is to send the Attorney General notice alongside the HHS report and let counsel decide whether it was required.
| Item | HIPAA (federal) | Pennsylvania breach act |
|---|---|---|
| Individual notice deadline | Without unreasonable delay, no later than 60 calendar days after discovery (164.404) | Without unreasonable delay following determination; no day count for private entities (Section 3(a)) |
| Regulator notice | HHS, contemporaneously if 500 or more; annual log if fewer (164.408) | Attorney General, concurrently, if more than 500 Pennsylvania residents (Section 3(c.1)) |
| Media or credit bureaus | Media if more than 500 residents of a state (164.406) | Consumer reporting agencies if more than 500 persons (Section 5) |
| Vendor duty | BA notifies the CE within 60 days (164.410) | Vendor notifies the entity "following discovery" (Section 3(c)) |
| HIPAA-covered entities | Fully subject | Deemed compliant if "subject to and in compliance with" HIPAA (Section 5.3) |
HIPAA Penalties in Pennsylvania
Federal OCR Penalties
OCR's civil money penalties follow the four culpability tiers at 45 CFR 160.404, with amounts inflation-adjusted at 45 CFR 102.3. The 2025 figures per violation: did not know, $145 to $73,011; reasonable cause, $1,461 to $73,011; willful neglect corrected within 30 days, $14,602 to $73,011; willful neglect not corrected, $73,011 to $2,190,294. The calendar-year cap for identical violations is $2,190,294. The lower enforcement-discretion caps OCR has applied since 2019 are tracked in the penalty amounts post.
Recent actions show the range: a $1.19 million civil money penalty against Gulf Coast Pain Consultants for Security Rule violations (December 3, 2024), a $10,000 ransomware settlement (January 15, 2025), and OCR's first enforcement action for lack of timely breach notification, settled for $475,000 (January 9, 2017), the case to remember while a 60-day clock is running.
State Enforcement
Section 8 of the breach act makes a violation "an unfair or deceptive act or practice" under Pennsylvania's Unfair Trade Practices and Consumer Protection Law and gives the Office of Attorney General "exclusive authority" to sue under it. Separately, HITECH lets a state attorney general sue in federal court for HIPAA violations affecting state residents; under 42 U.S.C. 1320d-5(d), statutory damages run "up to $100" per violation, capped at $25,000 per calendar year for identical violations, plus attorney fees. The HIV Act adds a private right of action, and licensing boards discipline: 49 Pa. Code 33.209(h) treats a dentist's records failure as "unprofessional conduct."
Pennsylvania HIPAA Rules by Provider Type
Hospitals and Health Systems
Hospitals carry the seven-year retention rule at 28 Pa. Code 115.23, the Section 7(f) duty to keep written HIV confidentiality procedures, and the subpoena election at 42 Pa.C.S. 6152. A hospital breach almost always exceeds 500 Pennsylvania residents, which puts the Attorney General notice, the credit-bureau notice, and credit monitoring into the incident plan.
Dental Practices
The Pennsylvania-specific items for dental offices are the five-year retention minimum at 49 Pa. Code 33.209(b), the 30-day copy deadline at 33.209(c), and 33.209(d), which says the duty to transfer records "exists irrespective of a patient's unpaid balance." HIPAA's own 30-day access deadline at 164.524(b)(2) runs in parallel.
Behavioral Health Providers
This is where the state layer is thickest. Inpatient and involuntary treatment records fall under the Mental Health Procedures Act and 55 Pa. Code Chapter 5100. Drug and alcohol records fall under Act 63, and federally assisted programs add 42 CFR Part 2. Any HIV-related information triggers Act 148's nine-element consent. The release-of-information procedure has to ask which statute governs each record before a form is chosen; the behavioral health program is built around that layered approach.
Home Health Agencies
28 Pa. Code 601.36 requires clinical records be retained seven years after discharge and requires "the patient's written consent" for "release of information outside the home health care agency, except as otherwise provided by law." Scheduling, electronic visit verification, and telehealth platforms each need a BAA, and each is a "vendor" with a notification duty under Section 3(c) of the breach act.
Pennsylvania HIPAA Compliance Checklist
| Requirement | Federal or state | Deadline or frequency | Documentation |
|---|---|---|---|
| Security risk analysis | Federal (164.308(a)(1)) | Current; reviewed when systems change | Signed risk analysis and risk management plan |
| BAA with every PHI vendor | Federal (164.504(e), 164.314(a)) | Before access; reviewed yearly | Signed BAA per vendor, vendor breach clause |
| Breach notice to individuals | Federal + state | 60 days (HIPAA); without unreasonable delay (state) | Four-factor assessment, letters, mailing proof |
| Breach notice to Attorney General | State (Section 3(c.1)) | Concurrently, if more than 500 PA residents | Copy of notice, submission confirmation |
| Record retention | State (49 Pa. Code 16.95, 33.209; 28 Pa. Code 115.23, 601.36) | 7 years physicians, hospitals, home health; 5 years dentists; minors longer | Written retention schedule |
| HIV information consent | State (Act 148, Section 7) | Before each consented disclosure | Nine-element consent; notice on each disclosure |
| Mental health and D&A releases | State (MHPA Section 111; Act 63 Section 8) + Part 2 | Before disclosure | Governing-statute check, consent on file, request log |
One closing note: the Security Rule update HHS proposed in January 2025 (multifactor authentication, mandatory encryption, and more) is proposed, not final, and OCR is not enforcing it. The current Security Rule text is what a Pennsylvania practice is measured against today.
---
FAQ
Does Pennsylvania's breach notification law apply to HIPAA-covered practices?
Yes, with a safe harbor. Section 5.3 of the Breach of Personal Information Notification Act, added in 2022, deems a covered entity or business associate that is subject to and in compliance with HIPAA's privacy and security standards to be in compliance with the Act. The condition is real compliance, so the safe harbor is only as strong as the practice's federal program.
When must a Pennsylvania practice notify the Attorney General of a breach?
Since Act 33 of 2024, Section 3(c.1) requires notice to the Office of Attorney General concurrently with individual notices whenever more than 500 affected individuals in Pennsylvania must be notified. The notice states the organization name and location, breach date, a summary, and the estimated number of individuals affected overall and in Pennsylvania.
How long must Pennsylvania physicians and dentists keep patient records?
Physicians must keep records at least 7 years from the last medical service, and for minors until 1 year after the patient reaches majority (49 Pa. Code 16.95). Dentists must keep records a minimum of 5 years from the last entry and furnish copies within 30 days of a written request (49 Pa. Code 33.209). HIPAA's separate six-year clock covers compliance documentation, not charts.
Are mental health and HIV records treated differently in Pennsylvania?
Yes. The Mental Health Procedures Act keeps treatment documents confidential absent written consent, with a 2022 exception for HIPAA-covered entities acting under the Privacy Rule. The Confidentiality of HIV-Related Information Act requires a nine-element written consent for most disclosures, a statutory notice on each disclosure, and gives aggrieved individuals a civil cause of action.
Who enforces HIPAA in Pennsylvania?
The HHS Office for Civil Rights enforces HIPAA federally, with 2025 penalties up to $73,011 per violation in the lower tiers and a $2,190,294 calendar-year cap. The Pennsylvania Attorney General enforces the state breach act under the Unfair Trade Practices and Consumer Protection Law and may also sue under HITECH for HIPAA violations affecting Pennsylvania residents. Licensing boards discipline records violations.
Conclusion
Pennsylvania rewards a practice that has done the federal work: the state breach act deems a HIPAA-compliant entity compliant, and the mental health and drug and alcohol statutes now point back at the Privacy Rule. The state-only pieces are short and specific: the Attorney General notice, the retention clocks, the HIV consent form, and the fee caps. Build the federal program properly, then bolt those on.
One Guy Consulting's Full-Scope plan covers the risk analysis, the written policies, the breach procedure, and the vendor agreements that the Pennsylvania deeming clause depends on, with consulting time to add the state overlays. Start with a free 30-minute compliance review. No obligation, no pressure.
Sources
- Pennsylvania Breach of Personal Information Notification Act, Act 94 of 2005 as amended (palegis.us)
- Pennsylvania Mental Health Procedures Act, Act 143 of 1976 as amended (palegis.us)
- Pennsylvania Confidentiality of HIV-Related Information Act, Act 148 of 1990 (palegis.us)
- Pennsylvania Drug and Alcohol Abuse Control Act, Act 63 of 1972 as amended (palegis.us)
- 42 Pa.C.S. 6155, rights of patients to medical records (palegis.us)
- 42 Pa.C.S. 6152, subpoena of records and copy fee schedule (palegis.us)
- 49 Pa. Code 16.95, physician medical records (Pennsylvania Code)
- 49 Pa. Code 33.209, dental patient records (Pennsylvania Code)
- 28 Pa. Code 115.23, hospital preservation of medical records (Pennsylvania Code)
- 28 Pa. Code 601.36, home health clinical records (Pennsylvania Code)
- 55 Pa. Code 5100.32, nonconsensual release of mental health information (Pennsylvania Code)
- 42 U.S.C. 1320d-5(d), enforcement by state attorneys general (uscode.house.gov)
- 45 CFR 160.203, preemption of state law
- 45 CFR 164.404, breach notification to individuals
- 45 CFR 164.408, breach notification to the Secretary
- 45 CFR 160.404, amount of a civil money penalty
- 45 CFR 102.3, inflation-adjusted civil money penalty amounts
- HHS: HIPAA Breach Notification Rule
Related Reading