HIPAA Privacy Rule: What You Need to Know

The HIPAA Privacy Rule requires covered entities to use and share protected health information (PHI) only in ways the rule allows. They must limit PHI to the minimum necessary and give patients a Notice of Privacy Practices. They must also honor patient rights, such as access to records within 30 days, and get written authorization for other uses.

HIPAA Privacy Rule Requirements Explained

The HIPAA Privacy Rule sets the national standard for protecting people's medical records and other protected health information. It defines how covered entities and their business associates can use and disclose PHI. It also grants patients specific rights over their health data.

It sets duties that apply whenever patient data is used or shared. Knowing these rules is key for any organization that handles health data.

The Privacy Rule comes from the Health Insurance Portability and Accountability Act. It is set out in 45 CFR Part 160 and Part 164 (Subparts A and E). It applies to covered entities. These are the organizations HIPAA directly regulates. There are three kinds: health plans, healthcare clearinghouses, and healthcare providers who conduct certain transactions electronically, such as billing insurance. A clearinghouse is a business, such as a billing service, that converts health data into the standard electronic format.

Many of the rule's limits also reach business associates. These are the vendors who handle PHI for a covered entity. This article explains the core rules every compliance team must know and put in place.

Permitted Uses and Disclosures of PHI

Treatment, Payment, and Healthcare Operations (TPO)

The Privacy Rule lets covered entities use and share PHI without the patient's permission for three key purposes:

• Treatment: Providing, coordinating, or managing healthcare and related services. This includes consultations between providers, referrals, and sharing patient data with specialists involved in care.
• Payment: Tasks tied to getting paid for healthcare services. This includes billing, claims handling, coverage decisions, and utilization review (checking that care is needed and appropriate).
• Healthcare operations: Administrative and quality tasks needed to run a covered entity. This includes quality assessment, training programs, compliance programs, business planning, and auditing.

TPO (treatment, payment, and healthcare operations) is the broadest category of permitted use. It covers most day-to-day PHI handling within healthcare organizations. However, the minimum necessary standard still applies to most uses and sharing of PHI for payment and operations.

This standard limits the PHI you share to what the specific purpose needs. Sharing with another provider for treatment is an exception, covered below.

Required Disclosures

The Privacy Rule requires covered entities to share (disclose) PHI in only two cases:

1. To the individual: When a patient (or their personal representative) asks for their own PHI, covered entities must provide it within 30 days, with limited exceptions.
2. To HHS for enforcement: When the Department of Health and Human Services asks for PHI during a compliance investigation, review, or enforcement action.

All other disclosures are either permitted by the rule or need the patient's written authorization. Covered entities should set up clear steps for handling both types of required disclosures.

Permitted Disclosures Without Authorization

Beyond TPO, the Privacy Rule allows disclosures without the patient's permission in several specific cases:

• Public health activities: Reporting to public health authorities for disease surveillance and injury prevention, and reporting tied to FDA-regulated products.
• Victims of abuse, neglect, or domestic violence: Reporting to government agencies that the law allows to receive such reports.
• Health oversight activities: Audits, investigations, and inspections by health oversight agencies.
• Judicial and administrative proceedings: In response to a court order, or to a subpoena when certain conditions are met.
• Law enforcement purposes: Under specific conditions. Examples include court orders, official requests, and help identifying or locating a suspect, fugitive, material witness, or missing person.
• Decedents: To coroners, medical examiners, and funeral directors.
• Research: Under set conditions. One example is when an Institutional Review Board (IRB) or Privacy Board approves a waiver of authorization. These boards oversee research. A waiver means the patient's written permission is not needed.
• Serious threat to health or safety: When necessary to prevent or lessen a serious and imminent threat.
• Specialized government functions: Military, veterans, national security, and protective services activities.
• Workers' compensation: As authorized by workers' compensation law.

Each category has its own rules and conditions (45 CFR 164.512). Organizations must train their staff on these policies (45 CFR 164.530(b)). Before releasing PHI, staff should know which category applies. They should also record the reason for each disclosure.

The Minimum Necessary Standard

What It Requires

The minimum necessary standard is a key part of the Privacy Rule. It requires covered entities to limit how they use, share, and request PHI. They must keep it to the minimum amount necessary for the intended purpose.

This standard applies to most uses and disclosures, but it has important exceptions.

The minimum necessary standard does not apply to:

• Disclosures to or requests by a healthcare provider for treatment purposes.
• Disclosures to the individual who is the subject of the information.
• Uses or disclosures under a valid authorization.
• Disclosures to HHS for enforcement purposes.
• Uses or disclosures required by law.
• Uses or disclosures required for HIPAA compliance.

Implementing Minimum Necessary

Organizations must write policies that set the minimum necessary for routine and non-routine disclosures:

• Routine disclosures: Set standard steps that limit the PHI released in common, recurring cases. For each kind of routine request, define which types of PHI fit and how much.
• Non-routine disclosures: Create criteria for reviewing each request on its own. A named person or team should review each one to find the minimum PHI needed.
• Role-based access: Identify the staff who need access to PHI and the types of PHI each role needs. Set up access controls in your electronic systems that enforce these limits.

When covered entities ask other covered entities for PHI, they must also limit the request to the minimum needed for the stated purpose. This duty applies to both the asking and disclosing parties.

Patient Rights Under the Privacy Rule

Right of Access

Patients have the right to see and get a copy of their PHI kept in a designated record set. This includes medical records, billing records, enrollment records, and other records used to make decisions about the patient. Covered entities must:

• Respond to access requests within 30 days (one 30-day extension allowed with written notice).
• Provide PHI in the format the patient asks for if it can be readily produced. If not, use another readable format.
• Charge only a reasonable, cost-based fee for copies.
• Provide electronic copies of ePHI when the patient asks and the records are kept electronically.

The right of access does not cover psychotherapy notes. It also does not cover information gathered for a lawsuit or other legal proceeding.

Right to Request Amendment

Patients may ask a covered entity to amend (correct) PHI in a designated record set. The covered entity must act on the request within 60 days, with one 30-day extension allowed. If it agrees, it must make the change. It must also tell the patient and other relevant parties. If the covered entity denies the request, it must send a written denial. The denial must give the reason for the decision and explain the patient's right to submit a statement of disagreement.

Right to an Accounting of Disclosures

People have the right to get a list of certain disclosures of their PHI from the six years before the request. This list is called an accounting. It leaves out disclosures for treatment, payment, and healthcare operations. It also leaves out disclosures the person authorized, and a few other kinds. Each entry must include the date, the recipient's name (and address, if known), what PHI was shared, and why.

Right to Request Restrictions

Patients may ask a covered entity to limit how it uses or shares their PHI for treatment, payment, or healthcare operations. Covered entities usually do not have to agree. There is one key exception. A covered entity must agree to block disclosures to a health plan for payment or healthcare operations when two things are true: the patient paid for the service in full out of pocket, and no law requires the disclosure.

Right to Request Confidential Communications

Patients may ask covered entities to contact them in a different way or at a different place. For example, a patient may ask that appointment reminders go to a work email instead of a home address. Healthcare providers must honor reasonable requests. Health plans must honor reasonable requests when the patient clearly says the usual way of contacting them could put them in danger.

Notice of Privacy Practices (NPP)

Content Requirements

Every covered entity must develop and distribute a Notice of Privacy Practices that informs individuals about how their PHI may be used and disclosed. The NPP must include:

• How the covered entity may use and disclose PHI.
• The individual's rights regarding their PHI.
• The covered entity's legal obligations regarding PHI.
• Contact information for the privacy officer or named complaint contact.
• The effective date of the notice.
• A statement that the organization is required by law to maintain the privacy of PHI.

The NPP must be written in plain language that patients can readily understand. Overly technical or legal language defeats the purpose of the notice.

Distribution Requirements

Healthcare providers who treat patients directly (a direct treatment relationship) must:

• Give patients the NPP no later than the first service delivery, meaning the first time you provide care (including care delivered electronically).
• Try in good faith to get the patient's written acknowledgment that they got it. This does not apply in an emergency.
• Make the NPP available to anyone who asks for it.
• Post the NPP where patients can easily see it at the service delivery site.
• Post the NPP on the organization's website if it has one.

Health plans must give the NPP at enrollment. Sometimes the notice has a material change, meaning a meaningful one. A health plan that posts its notice online must post the change by the date it takes effect. It must also include the change in its next annual mailing. A health plan without a website notice must send the revised notice within 60 days. Any material change to privacy practices means the covered entity must promptly revise its NPP.

Authorization Requirements

When Authorization Is Required

An authorization is required for uses and disclosures of PHI that are not otherwise permitted or required by the Privacy Rule. Common cases that need authorization include:

• Marketing communications: Using PHI to send marketing messages. There are limited exceptions for face-to-face communications and promotional gifts of nominal (small) value.
• Sale of PHI: Sharing PHI in exchange for payment.
• Psychotherapy notes: Most uses and disclosures of psychotherapy notes.
• Research: When an IRB or Privacy Board has not approved a waiver of authorization.
• Fundraising: Using more PHI than the rule allows. The allowed set includes basic personal details (name, address, other contact information, age, gender, date of birth), dates of care, department of service, treating physician, outcome information, and health insurance status. Every fundraising message must offer a clear way to opt out.

Valid Authorization Elements

A valid authorization must contain specific core elements and required statements:

Core elements:

• Description of the PHI to be used or shared.
• Name or specific identification of the people allowed to use or share it.
• Name or specific identification of the people who may receive it.
• Description of the purpose of the use or sharing.
• An expiration date or event.
• The person's signature and date.

Required statements:

• The individual's right to revoke (cancel) the authorization in writing.
• Whether treatment, payment, enrollment, or eligibility depends on the authorization.
• The chance that the recipient could share the PHI again (re-disclosure).

Authorizations are not valid if they are missing required elements, have expired, or have been revoked. Covered entities must not act on flawed authorizations.

De-Identification of PHI

Safe Harbor Method

The Privacy Rule provides two methods for de-identifying PHI so that it is no longer subject to HIPAA regulations. The Safe Harbor method requires removal of 18 specific identifiers. These apply to the person and to their relatives, employers, and household members:

1. Names.
2. Geographic data smaller than a state.
3. Dates (except year) related to an individual.
4. Phone numbers.
5. Fax numbers.
6. Email addresses.
7. Social Security numbers.
8. Medical record numbers.
9. Health plan beneficiary numbers.
10. Account numbers.
11. Certificate/license numbers.
12. Vehicle identifiers and serial numbers.
13. Device identifiers and serial numbers.
14. Web URLs.
15. IP addresses.
16. Biometric identifiers.
17. Full-face photographs and comparable images.
18. Any other unique identifying number or code.

Additionally, the covered entity must have no actual knowledge that the remaining information could identify an individual. For a detailed breakdown of these identifiers, see our PHI guide.

Expert Determination Method

The Expert Determination method requires an individual with the right statistical and scientific knowledge to apply those methods and find that the risk of identifying an individual from the data is very small. The expert must document the methods and results of the review.

Organizations that need to use health data for analytics, research, or business intelligence should weigh both methods to find which approach best fits their needs.

Privacy Rule FAQ

Can a covered entity share PHI with a patient's family members?

Yes, but with conditions. A covered entity may share PHI with a family member, relative, or close personal friend of the patient. This is allowed if the patient agrees, or does not object when given the chance. If the patient is not present or cannot respond, as in an emergency, the provider may use professional judgment to decide whether sharing is in the patient's best interest. The provider may then share only information directly tied to the person's role in the patient's care.

What is the difference between the Privacy Rule and the Security Rule?

The Privacy Rule governs all forms of PHI (paper, oral, and electronic) and defines when and how PHI may be used and disclosed. The Security Rule applies specifically to ePHI and requires administrative, physical, and technical safeguards to protect electronic data. Both rules work together to create a broad framework for PHI protection.

How long must an organization retain Privacy Rule documentation?

The Privacy Rule requires keeping policies, procedures, and certain records for six years from the date of creation or the date when it was last in effect, whichever is later. This includes authorizations, NPPs, complaint records, and compliance records.

What are the penalties for Privacy Rule violations?

Civil monetary penalties range from $145 to $2,190,294 per violation. The amount depends on the level of culpability, meaning how much the organization knew or should have known. Penalties for identical violations are capped at $2,190,294 per calendar year. Tier 1 (did not know) carries the lowest penalties, while Tier 4 (willful neglect not corrected) carries the highest. Criminal penalties may also apply for knowing violations, with fines up to $250,000 and imprisonment up to 10 years for offenses committed with intent to sell or use PHI for personal gain.

Does the minimum necessary standard apply to oral communications?

Yes. The minimum necessary standard applies to PHI shared out loud (oral disclosures). Healthcare providers should take reasonable steps to limit incidental disclosures. These are things overheard by accident despite reasonable care. Steps include speaking in private areas, lowering voices, and avoiding talk about PHI in public spaces. Dental practices face particular challenges here.

The Privacy Rule does not require you to remove every risk of incidental disclosure. It only requires reasonable safeguards.

Privacy Rule Takeaways

The HIPAA Privacy Rule sets a broad framework for guarding patient data. It also lets health information flow where it is needed for quality care, efficient payment, and effective healthcare operations.

To comply, organizations must understand permitted uses and disclosures and put the minimum necessary standard in place. They must also honor patient rights and keep proper authorization procedures.

Privacy Rule compliance is not a one-time task. It takes ongoing effort: regular training, policy review, and attention to changing rules and guidance. Organizations that build Privacy Rule requirements into daily work build trust with patients. They also lower the risk of enforcement actions.

One Guy Consulting helps healthcare organizations put Privacy Rule requirements in place. It offers practical policy templates and staff training programs. Explore our HIPAA compliance guide for a broader view. Or browse our privacy policy templates for ready-to-use Privacy Rule documents. Reach out to build a privacy program that protects patients and sets your practice up for long-term compliance.

Privacy Rule Key Provisions Reference

Sources

• 45 CFR Part 164, Subpart E: Privacy of Individually Identifiable Health Information.
• 45 CFR 164.502: Uses and Disclosures of PHI: General Rules.
• 45 CFR 164.520: Notice of Privacy Practices.
• HHS: HIPAA Privacy Rule.

Related Reading

• HIPAA Authorization Form Requirements.
• HIPAA Minimum Necessary Rule.
• PHI vs PII vs ePHI: Key Differences.
• HIPAA Compliance for Websites.