HIPAA Privacy Rule
The federal rule that governs who may see patient health information, in any form, and what rights patients hold over their own records.
What Is the HIPAA Privacy Rule?
The HIPAA Privacy Rule is the federal regulation that sets national standards for how covered entities and their business associates may use and disclose protected health information. It applies to PHI in every form, spoken, written, or electronic, and gives patients enforceable legal rights over their own health records.
What the Privacy Rule Covers
The Privacy Rule lives at 45 CFR Part 160 and Subparts A and E of Part 164. HHS published it in December 2000 and modified it in August 2002. The Office for Civil Rights enforces it.
It permits covered entities to use and disclose PHI without patient authorization for three purposes: treatment, payment, and health care operations. Almost everything beyond those three requires written authorization from the patient. The rule also applies the minimum necessary standard, meaning staff should access only the smallest amount of information needed to do the job in front of them.
The Rights It Gives Patients
- Access and obtain a copy of their records, acted on within 30 calendar days, with one permitted extension of up to 30 more days
- Request corrections to information that is inaccurate or incomplete
- Receive an accounting of certain disclosures
- Request restrictions on how their information is shared, and request confidential communications
- Receive a Notice of Privacy Practices explaining how the organization handles their data
Privacy Rule vs Security Rule
These are separate rules and clinics confuse them constantly. The Privacy Rule governs who may see PHI and under what circumstances, across every format including paper charts and spoken conversations. The Security Rule governs how electronic PHI is technically protected, through safeguards like encryption, access controls, and audit logs. A practice can satisfy one and still violate the other.
Related Terms
For a complete guide, read our full article on HIPAA compliance for medical practices.
SecTec helps clinics meet Privacy Rule obligations as part of our HIPAA compliance service.
Years Protecting Businesses
BAA Coverage on Healthcare Engagements