The HIPAA Privacy Rule explained: uses, disclosures and patient rights

The HIPAA Privacy Rule answers the questions front-desk staff, billing teams and software vendors face every day: can we share this, with whom, how much, and what must we give the patient? This guide goes through the rule section by section — PHI, permitted uses and disclosures, minimum necessary, patient rights, the Notice of Privacy Practices and business associates — and covers the changes of 2025 and 2026.

By Alex Martyushin, founder & risk consultant · Updated 30 October 2026 · 14 min read

For the wider picture — who HIPAA covers, the Security and Breach Notification Rules, penalties and a full compliance checklist — see our HIPAA compliance guide.

What is the HIPAA Privacy Rule?

The Privacy Rule — formally the Standards for Privacy of Individually Identifiable Health Information — was issued by HHS under the Health Insurance Portability and Accountability Act of 1996. It sits in 45 CFR Part 160 and Subparts A and E of Part 164. Most covered entities had to comply from 14 April 2003 (small health plans a year later). The HITECH Act of 2009 and the 2013 Omnibus Rule extended it, notably making business associates directly liable for certain requirements and strengthening limits on marketing and sale of PHI.

The rule balances two aims: protecting individuals’ health information while allowing the information flows needed for good care and public health. That is why it permits a great deal of sharing without consent, and then puts guardrails on everything else.

Who must comply

• Covered entities — health plans, health care clearinghouses and health care providers that conduct standard electronic transactions such as claims.
• Business associates — vendors and contractors that create, receive, maintain or transmit PHI on a covered entity’s behalf, and their subcontractors. They are directly liable for uses and disclosures not permitted by their contract or the rule, and for providing records to the covered entity or individual where required.

Organisations that do both covered and non-covered work can designate themselves a hybrid entity and apply the rule only to their health care components.

What PHI is under the Privacy Rule

Protected health information is individually identifiable health information — about a person’s physical or mental health, the care provided, or payment for care — held or transmitted by a covered entity or business associate in any form: electronic, paper or oral. Demographic details count when linked to care, so an appointment list with names is PHI even without diagnoses.

Some information is outside the definition: employment records a covered entity holds as an employer, education records covered by FERPA, information about people who have been dead for more than 50 years, and data properly de-identified under the Safe Harbor or Expert Determination methods. The 18 Safe Harbor identifiers are listed in our main HIPAA guide. Between full PHI and de-identified data sits the limited data set — PHI with direct identifiers removed but dates and town or ZIP code retained — which can be used for research, public health or operations under a data use agreement.

Permitted uses and disclosures

The core principle is simple: a covered entity may not use or disclose PHI except as the Privacy Rule permits or requires, or as the individual authorises in writing. There are two required disclosures — to the individual (or personal representative) when they ask for access or an accounting, and to HHS during a compliance investigation. Everything else falls into the categories below.

The 12 public interest purposes

PHI may be used or disclosed without authorisation, under specific conditions, when:

• required by law;
• for public health activities, such as disease reporting and FDA adverse-event reporting;
• about victims of abuse, neglect or domestic violence;
• for health oversight activities, such as audits and inspections;
• for judicial and administrative proceedings;
• for law enforcement purposes;
• about decedents, to coroners, medical examiners and funeral directors;
• for cadaveric organ, eye or tissue donation;
• for research, under a waiver approved by an IRB or privacy board, or other conditions;
• to avert a serious threat to health or safety;
• for essential government functions, such as military and national security activities;
• for workers’ compensation.

Each comes with conditions. A law enforcement request, for example, is not an automatic “yes” — it must fit one of the specific situations the rule describes, and many need a court order, subpoena or written assurances.

When written authorisation is required

An authorisation is a specific, signed document that names the information, the recipient, the purpose and an expiry date or event, and tells the individual they can revoke it. It is required for most uses and disclosures of psychotherapy notes, for marketing (with narrow exceptions such as face-to-face communications), and for any sale of PHI. Treatment and enrolment generally cannot be made conditional on signing one.

The minimum necessary standard

When using, disclosing or requesting PHI, covered entities and business associates must make reasonable efforts to limit it to the minimum necessary for the purpose. In practice that means role-based access so staff only see what their job needs, standard protocols for routine disclosures (such as what goes to a billing company), and case-by-case review of non-routine requests.

The standard does not apply to:

• disclosures to, or requests by, a health care provider for treatment;
• uses or disclosures to the individual;
• uses or disclosures made under a valid authorisation;
• disclosures to HHS for compliance and enforcement;
• uses or disclosures required by law;
• uses or disclosures required to comply with the HIPAA transaction rules.

Minimum necessary failures are among the issues OCR cites most often — typically staff with access to every record when they need a fraction of them, or whole files sent where a summary would do. Many of the cases described in our guide to HIPAA violation examples come down to this standard.

Patient rights under the Privacy Rule

A personal representative — such as a parent of a minor, a legal guardian or a person with a health care power of attorney — generally exercises these rights on the individual’s behalf, subject to state law and safety exceptions.

The Notice of Privacy Practices

Covered entities with direct treatment relationships or health plan members must give a Notice of Privacy Practices (NPP) in plain language. It must describe:

• how the entity may use and disclose PHI, with at least one example for treatment, payment and operations;
• uses and disclosures that need authorisation, and the right to revoke it;
• the individual’s rights and how to exercise them;
• the entity’s legal duties, including notifying affected individuals of a breach of unsecured PHI;
• how to complain to the entity and to HHS, and a contact person;
• the effective date.

Providers must make a good-faith effort to get written acknowledgement that the patient received the notice, post it in the facility and, if they have a website about their services, post it there. Health plans must remind members at least every three years how to get it. When practices change materially, the notice must be revised before the change takes effect. Covered entities that receive or maintain substance use disorder records subject to 42 CFR Part 2 had to update their notices by 16 February 2026 — see the changes below.

Business associates and the Privacy Rule

Before a business associate receives PHI, the covered entity must have satisfactory assurances in a written business associate agreement. The agreement must, among other things:

• describe permitted and required uses and disclosures, and prohibit any others;
• require appropriate safeguards, including Security Rule compliance for ePHI;
• require reporting of impermissible uses and disclosures, security incidents and breaches;
• flow the same restrictions down to subcontractors through their own agreements;
• make PHI available for access, amendment and accounting where relevant;
• make internal practices and records available to HHS;
• require return or destruction of PHI at termination where feasible.

Treat BAAs as part of a wider third-party risk assessment: an agreement says what the vendor must do, not whether it can. New SaaS, messaging and AI tools adopted without procurement review are the usual gap.

Administrative requirements

Every covered entity must designate a privacy official and a contact for complaints, train all workforce members on its policies, apply sanctions for violations, put administrative, technical and physical safeguards in place to protect PHI in all forms, mitigate known harmful effects of improper disclosures, refrain from retaliation and from requiring individuals to waive rights, and keep policies, procedures and required documentation for six years. These obligations scale: a two-dentist practice and a hospital network both need them, in very different shapes.

How the Privacy Rule relates to the Security and Breach Notification Rules

The three reinforce each other. A Privacy Rule failure — a misdirected email — can become a breach that must be notified; a Security Rule failure — an unpatched server — can produce an impermissible disclosure. That is why most organisations manage them as one programme with one risk register.

Recent changes to the Privacy Rule (2024–2026)

Reproductive health care privacy rule: vacated

In April 2024 HHS finalised a rule prohibiting certain uses and disclosures of PHI to investigate or impose liability for lawful reproductive health care, with an attestation requirement for some requests. On 18 June 2025 the US District Court for the Northern District of Texas, in Purl v. HHS, vacated most of that rule nationwide. The court left in place the Notice of Privacy Practices changes linked to 42 CFR Part 2. Reports indicate the vacatur was not overturned on appeal. In practice the attestation requirement no longer applies, and organisations that changed their notices for the vacated reproductive health provisions have been advised to review those changes. State laws protecting reproductive health information still apply where they exist.

Part 2 alignment with HIPAA

A final rule published in February 2024 brought the confidentiality rules for substance use disorder treatment records (42 CFR Part 2) closer to HIPAA: a single consent can now cover future uses for treatment, payment and operations; recipients who are covered entities or business associates may redisclose under HIPAA rules; breach notification requirements now apply to Part 2 records; and penalties are aligned with HIPAA. Compliance was required by 16 February 2026, including the related NPP updates. Part 2 records still carry stricter protection against use in legal proceedings against the patient.

Pending: access and care coordination changes

A 2021 proposal would, among other things, shorten the access deadline from 30 to 15 calendar days, limit fees further and add a minimum necessary exception for individual-level care coordination. Regulatory agenda entries listed a final rule for August 2026, and a separate proposal on timely access was listed for later in 2026. As at 30 October 2026 we found no final rule published. Agency timetables are not binding; check OCR’s rulemaking page before changing your procedures — but answering access requests well within 30 days is good practice regardless.

Privacy Rule risks in your register

The Privacy Rule produces a short list of recurring risks. Scored on the same risk matrix as your security risks, they sit naturally next to the HIPAA risk analysis.

Scores are illustrative on a 5×5 matrix. Indicators worth tracking monthly: open access requests and their age, accounts with broad roles, vendors without a BAA, and sanctions applied. If you also hold Californian or European data outside HIPAA, the same register can hold your CCPA and GDPR risks.