The HIPAA Privacy Rule (45 CFR Part 160 and Subparts A and E of Part 164) establishes national standards for the protection of individually identifiable health information in the United States. Published by the Department of Health and Human Services (HHS) in December 2000 and substantially amended in 2002 and again through the 2013 Omnibus Rule, it remains the foundational federal regulation governing how protected health information (PHI) may be used, disclosed, and safeguarded.
For technology companies operating in the healthcare space — whether building electronic health record systems, providing cloud infrastructure to hospitals, or processing claims data — the Privacy Rule defines the legal boundaries of what you can and cannot do with patient information. Understanding it is not optional.
What the Privacy Rule covers
The Privacy Rule applies to protected health information (PHI): any individually identifiable health information that is created, received, maintained, or transmitted by a covered entity or business associate. This is deliberately broad. PHI includes medical records, billing information, lab results, insurance claims, appointment histories, and any data that connects an individual’s identity to their health condition or care.
A critical distinction separates the Privacy Rule from the Security Rule. The Security Rule applies exclusively to electronic PHI (ePHI). The Privacy Rule applies to PHI in all forms — paper records, verbal communications, faxes, digital files, and any other medium. If a nurse verbally discloses a patient’s diagnosis to an unauthorised person, that is a Privacy Rule violation regardless of whether any electronic system was involved.
Who must comply
The Privacy Rule applies to two categories of organisations.
Covered entities include health plans (insurers, HMOs, employer-sponsored health plans), healthcare clearinghouses, and healthcare providers who conduct standard electronic transactions such as claims submissions. Not every healthcare provider is a covered entity — the trigger is conducting electronic transactions that fall under HIPAA’s transaction standards.
Business associates are organisations or individuals that perform functions or activities on behalf of a covered entity that involve access to PHI. The 2013 Omnibus Rule significantly expanded business associate obligations, making them directly liable for Privacy Rule compliance. For technology companies, this is the most common path into HIPAA scope. If your software touches identifiable patient data — even if you never see a patient — you are almost certainly a business associate.
HHS guidance makes clear that cloud service providers, data analytics firms, health information exchanges, and even subcontractors of business associates fall within this definition. The chain of compliance extends through every layer of the data supply chain.
Key principles of the Privacy Rule
The Privacy Rule is built on several core principles that inform its specific provisions.
Individual control. Patients retain meaningful rights over their health information, including the right to access it, request corrections, and understand how it has been used.
Proportional access. Organisations should access only the PHI they need, in the quantities they need, for legitimate purposes — codified as the Minimum Necessary standard.
Transparency. Covered entities must inform patients about their privacy practices, the uses and disclosures they make, and the rights patients can exercise.
Accountability. Organisations must designate a privacy officer, train their workforce, implement safeguards, and maintain documentation of their compliance efforts.
Patient rights under the Privacy Rule
The Privacy Rule grants individuals six substantive rights regarding their PHI. These rights are enforceable, and covered entities must have processes in place to honour them within specified timeframes.
Right of access
Under 45 CFR § 164.524, individuals have the right to inspect and obtain copies of their PHI maintained in a designated record set. Covered entities must respond to access requests within 30 days (with one 30-day extension permitted). HHS has emphasised through its Right of Access Initiative — a targeted enforcement programme launched in 2019 — that failures to provide timely access are taken seriously. Penalties under this initiative have ranged from £10,000 to over £200,000.
Covered entities must provide PHI in the format requested by the individual if it is readily producible in that format. For electronic records, this includes the right to receive data in electronic form and to direct that copies be transmitted to a third party.
Right to request amendment
Individuals may request amendments to their PHI if they believe it is inaccurate or incomplete (45 CFR § 164.526). Covered entities may deny amendment requests under limited circumstances — for example, if the information was not created by the covered entity or is demonstrably accurate — but must provide a written denial with the reason and the individual’s right to submit a statement of disagreement.
Right to an accounting of disclosures
Under 45 CFR § 164.528, individuals may request an accounting of certain disclosures of their PHI made during the six years prior to the request. This accounting must include the date, recipient, description, and purpose of each qualifying disclosure. Notably, disclosures for treatment, payment, and healthcare operations are generally excluded from this requirement, as are disclosures the individual already knows about (such as those made pursuant to an authorisation).
Right to request restrictions
Patients may request that a covered entity restrict certain uses or disclosures of their PHI for treatment, payment, or healthcare operations (45 CFR § 164.522). Covered entities are generally not required to agree to such requests, with one important exception: they must agree to restrict disclosures to a health plan if the disclosure relates to a service for which the individual has paid out of pocket in full.
Right to confidential communications
Individuals may request that a covered entity communicate with them through alternative means or at alternative locations — for example, requesting that appointment reminders be sent to a personal email address rather than a home address. Covered entities must accommodate reasonable requests.
Right to complain
Individuals have the right to file complaints with the covered entity’s privacy officer or directly with the HHS Office for Civil Rights (OCR) if they believe their privacy rights have been violated. Covered entities may not retaliate against individuals for exercising this right.
Permitted uses and disclosures
The Privacy Rule does not prohibit all sharing of PHI. It establishes a framework of permitted and required disclosures, balancing individual privacy against the practical needs of the healthcare system.
Treatment, payment, and healthcare operations (TPO)
The most common basis for using or disclosing PHI is for treatment, payment, and healthcare operations. A covered entity may use and disclose PHI for these purposes without obtaining individual authorisation. Treatment includes the provision, coordination, and management of care. Payment includes activities related to billing, claims management, and reimbursement. Healthcare operations encompass quality assessment, training, compliance activities, and other administrative functions.
Public interest and benefit activities
The Privacy Rule permits disclosures without authorisation for twelve categories of public interest activities (45 CFR § 164.512), including:
- Public health activities — reporting to public health authorities, tracking disease outbreaks, post-marketing surveillance of FDA-regulated products.
- Victims of abuse, neglect, or domestic violence — reporting to government authorities authorised to receive such information.
- Health oversight activities — audits, investigations, and inspections conducted by health oversight agencies.
- Judicial and administrative proceedings — disclosures in response to court orders or subpoenas meeting specific requirements.
- Law enforcement purposes — under defined circumstances such as court orders, grand jury subpoenas, or to identify suspects or locate missing persons.
- Research purposes — with appropriate institutional review board (IRB) or privacy board approval, or using de-identified or limited data sets.
- Serious threat to health or safety — disclosures necessary to prevent or lessen a serious and imminent threat.
- Workers’ compensation — as authorised by workers’ compensation laws.
Each of these exceptions has specific conditions and limitations. They do not represent blanket permissions to share PHI.
Authorisation-based disclosures
Uses and disclosures not covered by TPO or the public interest exceptions require a valid written authorisation from the individual. HHS specifies the required elements of a valid authorisation under 45 CFR § 164.508, including a description of the information to be disclosed, the purpose, the recipient, an expiration date, and the individual’s signature. Authorisations must be written in plain language and inform the individual of their right to revoke.
Certain categories of PHI — psychotherapy notes, marketing communications, and the sale of PHI — carry additional authorisation requirements that go beyond the standard provisions.
The Minimum Necessary standard
The Minimum Necessary standard (45 CFR § 164.502(b)) is one of the Privacy Rule’s most operationally significant requirements. It mandates that covered entities and business associates must make reasonable efforts to limit PHI access to the minimum necessary to accomplish the intended purpose.
In practice, this means:
- For routine uses and disclosures, organisations must identify the persons or classes of persons who need access to PHI, the categories of PHI to which they need access, and the conditions under which access is appropriate.
- For non-routine disclosures, each request must be reviewed individually to determine the minimum information required.
- For requests received from other covered entities, the organisation may reasonably rely on the requesting entity’s assertion that the information requested is the minimum necessary.
The Minimum Necessary standard does not apply to disclosures made for treatment, disclosures to the individual, disclosures made pursuant to an authorisation, disclosures required by law, or disclosures to HHS for compliance investigations.
For technology companies building healthcare applications, the Minimum Necessary standard has direct implications for system design. Role-based access controls, data segmentation, and audit logging are not merely good security practices — they are mechanisms for operationalising a legal requirement.
Notice of Privacy Practices
Every covered entity with a direct treatment relationship with individuals must maintain and distribute a Notice of Privacy Practices (NPP) under 45 CFR § 164.520. The NPP must describe:
- How the entity may use and disclose PHI
- The individual’s rights under the Privacy Rule
- The entity’s legal duties regarding PHI
- How to file complaints
- A point of contact for further information
Health plans must distribute the NPP at enrolment and within 60 days of a material revision. Healthcare providers must make the NPP available at the first service encounter and post it prominently in their facilities. The 2013 Omnibus Rule added requirements to describe how the entity may use PHI for fundraising and how it handles breach notification.
Business associate requirements
The relationship between covered entities and business associates is governed by business associate agreements (BAAs) under 45 CFR § 164.502(e) and § 164.504(e). A BAA must be in place before a covered entity shares PHI with a business associate, and it must specify:
- The permitted and required uses of PHI by the business associate
- An obligation not to use or disclose PHI beyond what the agreement permits
- Safeguard requirements
- Reporting obligations for security incidents and breaches
- Requirements for returning or destroying PHI at termination
Since the 2013 Omnibus Rule, business associates are directly subject to Privacy Rule requirements — they cannot deflect responsibility to the covered entity. Subcontractors of business associates are also classified as business associates and must have their own BAAs in place.
For technology companies, the BAA is the contractual and legal instrument that defines your HIPAA obligations. Negotiating appropriate BAA terms — particularly around breach notification timelines, liability allocation, and the scope of permitted uses — is a critical step in any healthcare engagement.
Privacy Rule vs Security Rule
The Privacy Rule and Security Rule are complementary but distinct. Understanding the boundary between them prevents confusion in implementation.
| Dimension | Privacy Rule | Security Rule |
|---|---|---|
| Scope | All PHI (paper, oral, electronic) | ePHI only |
| Focus | Who may access PHI and under what conditions | How ePHI is technically protected |
| Requirements | Patient rights, permitted disclosures, Minimum Necessary, NPP | Administrative, physical, and technical safeguards |
| Flexibility | Principles-based with specific mandates | Mix of required and addressable implementation specifications |
The Security Rule can be understood as the technical implementation layer for the confidentiality protections the Privacy Rule establishes. You cannot comply with the Security Rule without understanding the Privacy Rule’s requirements, and you cannot fulfil the Privacy Rule’s safeguard obligations without implementing the Security Rule’s controls.
De-identification standards
The Privacy Rule provides two methods for de-identifying PHI, after which the data is no longer subject to HIPAA regulations (45 CFR § 164.514).
Safe Harbour method
The Safe Harbour method requires the removal of 18 specific categories of identifiers, including names, geographic data smaller than a state, dates (other than year) related to an individual, telephone numbers, email addresses, Social Security numbers, medical record numbers, and biometric identifiers. The entity must also have no actual knowledge that the remaining information could identify an individual.
This method is straightforward but conservative. It can significantly reduce the analytical utility of datasets, particularly for research involving geographic or temporal patterns.
Expert Determination method
Under the Expert Determination method, a qualified statistical or scientific expert applies generally accepted statistical and scientific principles to determine that the risk of identifying an individual from the data is very small. The expert must document the methods and results of the analysis.
This method offers greater flexibility and can preserve more data utility, but requires engaging qualified expertise and maintaining defensible documentation of the determination process.
HHS has published detailed guidance on de-identification methods, emphasising that organisations should select the approach best suited to their intended use of the data and their capacity to implement it correctly.
Common Privacy Rule violations
Understanding frequent violations helps organisations target their compliance efforts. Based on HHS enforcement actions and OCR investigation data, the most common Privacy Rule violations include:
- Failure to provide timely access to records — the single most enforced provision under the Right of Access Initiative.
- Impermissible disclosures — sharing PHI without authorisation or a valid legal basis, including disclosures to employers, family members without consent, or through unsecured channels.
- Insufficient safeguards — failing to implement reasonable administrative, technical, or physical safeguards to protect PHI, such as leaving records in publicly accessible areas or sending PHI via unencrypted email.
- Lack of a valid business associate agreement — sharing PHI with vendors without a compliant BAA in place.
- Failure to provide a Notice of Privacy Practices — not distributing or making available the required NPP.
- Minimum Necessary violations — accessing or disclosing more PHI than necessary for the intended purpose, often through overly broad system access permissions.
Penalties for Privacy Rule violations range from £100 to £50,000 per violation, with annual maximums of £1.5 million per violation category. The 2013 Omnibus Rule introduced a tiered penalty structure based on the level of culpability, from unknowing violations to wilful neglect.
Practical implementation for technology companies
For technology companies operating as business associates, Privacy Rule compliance requires both organisational and technical measures.
Designate a privacy officer. Even if not a covered entity, business associates benefit from assigning clear accountability for privacy compliance. This person should own policy development, training, and incident response.
Map your PHI data flows. Document where PHI enters your systems, how it moves through your architecture, where it is stored, and who can access it. This mapping is the foundation for Minimum Necessary implementation and breach response planning.
Implement role-based access controls. Align system permissions with the Minimum Necessary standard. Users should have access only to the PHI categories required for their function. Audit access regularly and revoke permissions promptly when roles change.
Build audit logging into your architecture. The ability to produce an accounting of disclosures — and to investigate potential breaches — depends on comprehensive, tamper-resistant logging of all PHI access events.
Establish an authorisation workflow. If your product enables disclosures that require patient authorisation, build compliant authorisation capture and tracking directly into your application. Store authorisation records with the associated disclosure events.
Train your workforce. Every member of your team who may encounter PHI must receive Privacy Rule training. This includes engineers with production database access, support staff who may see PHI in tickets, and anyone involved in data processing. Training should be documented and refreshed annually.
Prepare for breach response. The Breach Notification Rule (45 CFR §§ 164.400-414) requires business associates to notify the covered entity within 60 days of discovering a breach of unsecured PHI. Having an incident response plan that integrates with your BAA obligations is essential.
Negotiate BAAs carefully. Understand the scope of PHI you will handle, the permitted uses, and your notification obligations. Ensure your BAA terms align with your actual operational capabilities — committing to obligations you cannot meet creates legal exposure.
A platform like Prova GRC can streamline Privacy Rule compliance by centralising policy management, automating evidence collection for safeguard requirements, tracking business associate agreements, and mapping controls across HIPAA’s interconnected rules. For organisations managing Privacy Rule obligations alongside other frameworks such as SOC 2 or ISO 27001, cross-framework control mapping reduces duplication and accelerates audit readiness.