Overview of the HIPAA Privacy Rule

The document from which this text is drawn is only a summary and should not substitute for the full legal requirements of the Rule. In cases of conflict, the official Privacy Rule provisions take precedence.

Purpose

The HIPAA Privacy Rule, established by the U.S. Department of Health and Human Services (HHS), sets the first national standards for protecting individually identifiable health information, known as protected health information (PHI). It regulates how covered entities (such as health plans and healthcare providers) may use and disclose PHI and ensures that individuals have the right to understand and control their health information.

Administered by

port high-quality healthcare and public health. It is flexible and comprehensive, accommodating the diverse needs of the health care system.

Key provisions include:

• Greater patient control over personal health data.
• Limits on use and disclosure of health records.
• Required safeguards by health care providers.
• Civil and criminal penalties for violations.
• Balanced allowances for necessary disclosures (e.g., public health).

For patients, it ensures:

• Informed decision-making regarding care and data use.
• The ability to review, obtain, and request corrections to their health records.
• Transparency about how their information is used and shared.
• Limits on disclosures to the minimum necessary information.

Core Components

1. Who Is Covered

• Health Plans (e.g., HMOs, Medicare, Medicaid). Health plans that pay for or provide the cost of medical care, such as individual or group plans, are considered covered entities under HIPAA. This includes health, dental, vision, and prescription drug insurers, as well as HMOs, Medicare, Medicaid, Medicare+Choice, Medicare supplement insurers, and long-term care insurers (excluding nursing home fixed-indemnity policies).
• Health Care Providers who transmit data electronically. Every health care provider, regardless of size, who electronically transmits health information in connection with certain transactions, is a covered entity.
• Health Care Clearinghouses. Health care clearinghouses are entities that process nonstandard information they receive from another entity into a standard (i.e., standard format or data content), or vice versa.
• Business Associates (e.g., billing, legal, IT services). A business associate is a person or organization (not part of a covered entity’s workforce) that performs tasks or provides services involving the use or disclosure of  PHI on behalf of a covered entity. Examples of such activities include claims processing, data analysis, utilization review, and billing.

2. What Information Is Protected

• PHI includes data that identifies an individual and relates to their health, care, or payment.
• PHI may be in electronic, paper, or oral form.
• De-identified data is not protected if properly stripped of identifiers.

3. Permitted and Required Disclosures

Covered entities must disclose PHI:

• To the individual (upon request).
• To HHS for compliance review.

They may disclose PHI (without authorization):

• For treatment, payment, and health care operations.
• With informal agreement (e.g., for family involvement).
• For public interest purposes (e.g., law enforcement, public health, research, judicial proceedings, organ donation).
• As part of a limited data set for public health, research, or operations.

Authorization is required for other uses, such as:

• Marketing (with few exceptions).
• Psychotherapy notes (with specific conditions).

4. Individual Rights

• Access to their PHI.
• Amendments to inaccurate or incomplete PHI.
• Accounting of disclosures (excluding certain routine ones).
• Restrictions on use or disclosure (optional for entities to honor).
• Confidential communications (e.g., alternative contact methods).
• Notice of privacy practices (must be provided and acknowledged).

5. Administrative Requirements

• Policies and procedures for privacy compliance.
• Appoint a Privacy Officer.
• Train workforce on policies.
• Safeguard PHI through physical, technical, and administrative controls.
• Mitigate harm from privacy breaches.
• Establish complaint procedures.
• No retaliation or waiver of rights allowed.
• Retain records for 6 years.

6. Minimum Necessary Rule

Entities must make reasonable efforts to use/disclose only the minimum amount of PHI necessary for a given purpose, except for:

• Disclosures to the individual.
• Disclosures for treatment.
• Uses with authorization.
• Legally required disclosures.

7. Special Organizational Provisions

• Hybrid Entities: Organizations that combine health and non-health functions can separate them.
• Affiliated Covered Entities: Related legal entities may designate themselves as one for compliance.
• Organized Health Care Arrangements: Multiple entities can coordinate care and share PHI.
• Group Health Plans may share limited PHI with plan sponsors under strict conditions.

8. Special Cases

• Personal Representatives: Usually treated as the individual under the Rule (e.g., legal guardians).
• Minors: Parental access may vary depending on state law and professional judgment.

9. Enforcement and Penalties

Civil Penalties

• Ranges from $127 to $63,973 per violation.
• Annual caps can reach over $1.9 million.
• Penalties vary by intent and timeliness of correction.

Criminal Penalties

• Up to $50,000 and 1 year imprisonment for basic violations.
• Up to $250,000 and 10 years for violations with intent to sell, transfer, or use PHI for harm or profit.

10. Enforcement Agency

• Office for Civil Rights (OCR) handles investigations, technical assistance, and penalties.

11. Compliance Timeline

• Most covered entities were required to comply by April 14, 2003.
• Small health plans had until April 14, 2004.

12. State Law Interaction

• Federal law generally preempts conflicting state laws.
• Exceptions: state laws offering greater protections or requiring certain public health reporting may apply.

13. Resources

• Full regulation texts and compliance materials are available through the HHS website.

Source

U.S. Department of Health and Human Services. (n.d.). Summary of the HIPAA Privacy Rule. HHS.gov. https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html