If your organization handles medical records or patient data in any capacity, the HIPAA Privacy Rule likely applies to you.
This rule is one of the key pillars of the Health Insurance Portability and Accountability Act (HIPAA), and it outlines exactly how protected health information (PHI) should be handled to safeguard patient privacy.
That includes not just hospitals and doctors’ offices, but also billing companies, IT vendors, health plans, and any other third-party partners who work with PHI.
These groups are called covered entities and business associates, and they’re all responsible for following the HIPAA Privacy Rule to remain compliant.
In this guide, we’ll break down what the HIPAA Privacy Rule is, who it covers, what it protects, and how your organization can stay compliant.
Whether you’re a healthcare provider or a vendor supporting the industry, understanding this rule is essential to avoiding fines and building patient trust.
Beginner’s Guide to the HIPAA Privacy Rule
Before diving into HIPAA compliance, it’s important to start with the foundation: the HIPAA Privacy Rule. Officially titled the Standards for Privacy of Individually Identifiable Health Information, this rule is at the core of how patient data must be handled in the U.S. healthcare system.
The Privacy Rule sets the baseline for how protected health information (PHI) can be used and disclosed, who it applies to, and what rights patients have over their own health data.
If you’re new to HIPAA or just need a refresher, this guide will walk you through a simple, plain-language summary of the HIPAA Privacy Rule, plus a quick breakdown of the other key HIPAA rules you should know.
By the end, you’ll understand what HIPAA requires, who must comply, and how to build stronger privacy protections into your organization’s day-to-day operations.
What is HIPAA and Why It Matters
The Health Insurance Portability and Accountability Act (HIPAA) was passed in 1996 to protect both patients and healthcare organizations.
-
For patients, HIPAA ensures the privacy and security of personal health information.
-
For healthcare providers, it promotes efficiency and accountability across the system.
Without proper safeguards, a data breach could harm both patients and providers—resulting in privacy violations, financial losses, and legal consequences.
On top of this, failure to comply can result in huge potential costs. The US Department of Health and Human Services administers HIPAA. Its internal Office of Civil Rights (OCR) enforces civil fines for noncompliance. Serious or chronic violations of HIPAA can result in criminal penalties, enforced by the Department of Justice (DOJ).
So, even if you’re only acting out of self preservation, you need to understand and abide by the privacy rule—and all of HIPAA.
[su_button url=”https://www.rsisecurity.com/compliance-advisory-services/hipaa/” target=”blank” style=”flat” size=”11″]Assess your HIPAA / HITECH compliance[/su_button]
HIPAA Privacy Rule Summary
The HIPAA privacy rule was the first of what would eventually become four HIPAA rules. It sets the stage for the whole Act by defining key terminology, such as:
- The HIPAA Privacy Rule applies to which of the following
- Which entities are covered
- What HIPAA helps protect
- Which information is protected
Importantly, these definitions guide all other HIPAA rules. But the privacy rule also includes specific regulations, namely:
- How exactly the privacy rule regulates safety
- Which safeguards it required
A Brief History of the HIPAA Privacy Rule
Although HIPAA was originally passed in 1996, the HIPAA Privacy Rule didn’t take shape until a few years later. Because Congress didn’t issue its own privacy legislation within the first three years, the Department of Health and Human Services (HHS) took the lead. In 1999, HHS released a draft proposal of the Privacy Rule and opened it up for public comment.
That comment period brought in more than 50,000 responses from healthcare professionals, advocacy groups, insurers, and other stakeholders. Their input helped shape the first official version of the HIPAA Privacy Rule, which was finalized in December 2000.
Key updates followed:
- 2002: The Privacy Rule was revised and finalized with clarifications on permissible disclosures and patient rights.
- 2013: The Omnibus Final Rule consolidated and strengthened all HIPAA rules, expanding the responsibilities of business associates and updating requirements to fit the digital era.
These changes have helped evolve the Privacy Rule from a paper-based standard into a modern, flexible framework that applies to electronic health records, cloud storage, and other modern technologies. Today, the HIPAA Privacy Rule continues to guide how healthcare organizations protect protected health information (PHI) in an increasingly connected world.
Who is Covered by the Privacy Rule
The Centers for Medicaid and Medicare Services (CMS) has prepared a covered entity guidance toolkit to determine whether or not the regulations apply to your business.
Here’s a breakdown of who is directly covered:
-
Health Plans
This includes health insurance companies, HMOs, employer-sponsored group health plans, and government programs like Medicare and Medicaid. These organizations manage or pay for healthcare services and are required to follow HIPAA regulations. -
Healthcare Providers
Any provider who transmits health information electronically is covered, including doctors, surgeons, dentists, psychologists, hospitals, clinics, pharmacies, and more. -
Healthcare Clearinghouses
These are organizations that process non-standard health data into standardized formats (and vice versa), such as billing companies or medical data processors.
In addition to these, business associates, organizations that provide services to covered entities and require access to PHI, must also comply.
This includes IT vendors, legal firms, billing services, cloud storage providers, and others. HIPAA requires business associates to have formal contracts in place (called Business Associate Agreements) that define how PHI will be protected.
If you’re unsure where your organization falls, the Centers for Medicare & Medicaid Services (CMS) provides a helpful toolkit to determine if you’re a covered entity or business associate.
What is Protected by the Privacy Rule
According to the Privacy Rule Summary, HIPAA protects any and all “individually identifiable health information that’s harbored, used, or transmitted by a covered entity.” This information is designated as personal (or protected) health information (PHI).
All electronic, paper, oral, and other forms of the following information are protected if they could be used to identify a given patient or client:
- Records of past, present, and future health conditions
- History of medical service encounters and treatments
- Financial records pertaining to any healthcare received
Importantly, de-identified PHI is not protected, nor is it regulated in terms of use or disclosure. De-identification involves a concerted effort to remove all pieces of information that could possibly be used to ID a client, as well as any other close connections that could indirectly ID them. A qualified statistician can verify the integrity of a de-identified document.
Also Read: What are the HIPAA Security Rule Requirements?
How the Privacy Rule Works in Practice
The most important element of the privacy rule is its codification of how PHI is to be protected.
Firstly, it specifies that PHI may only be used or disclosed in HIPAA permitted cases or when formally authorized by the patient to whom PHI pertains. Permitted use and disclosure cases include:
- To the individual – PHI may be disclosed to the individual who is the subject of the information in question, as well as certain personal representatives thereof.
- In healthcare operations – Covered entities may use or disclose PHI, internally or in concert with other covered entities providing care to a given individual, for purposes of:
- Providing healthcare services (therapy, surgery, etc.)
- Obtaining payment for services (through premiums, etc.)
- Maintaining business operations (assessment, planning, etc.)
-
With informal permission
– PHI may be used or disclosed if informal permission is granted, or if a medical professional determines such use or disclosure to be in the best interest of an individual unable to consent (due emergency, the influence of drugs, etc.).
- Incidental or combined – Uses or disclosures of PHI that occur as part of or incident to other permitted uses or disclosures are, likewise, also permitted.
-
In the public interest
– PHI may be used or disclosed without permission or authorization in 12 specific purposes that benefit a public interest:
- When required by law or court order
- To support public health initiatives
- To government agencies regarding abuse
- To aid health oversight activities
- As part of judicial proceedings
- For investigations or law enforcement
- To coroners and funeral arrangers
- For bodily donation purposes
- For medical and scientific research
- To prevent serious health threats
- For essential governmental functions
- In matters related to workers’ compensation
-
Of limited data sets
– Documents containing PHI may be used or disclosed if particular identifying information is removed. The recipient of such information must enter into a data use agreement that upholds the spirit of privacy rule regulations.
Within these parameters, covered entities are also obligated to limit their use and disclosure of PHI to only the minimum necessary amount required. This means sharing as little information as possible, with as few parties as possible, within the given permitted use case.
Importantly, the privacy rule also requires covered entities to disclose PHI to its subject(s) upon request, or to government agencies in certain situations. No minimum necessary requirement applies to required disclosures, nor any disclosure made to the subject of the PHI.
Overview of the Other HIPAA Rules
While the HIPAA Privacy Rule is the foundation, it’s just one piece of the full compliance picture. There are three other major rules that every covered entity and business associate must understand:
The HIPAA Security Rule
First finalized in 2003, this rule builds on the Privacy Rule by requiring specific protections for electronic protected health information (ePHI). It includes safeguards across four areas:
- Administrative – policies, training, and oversight
- Physical – secure facility access and device protection
- Technical – encryption, secure access controls, and audits
- Organizational – contracts and shared responsibility frameworks
The HIPAA Enforcement Rule
This rule outlines how HIPAA is enforced, including the penalties for non-compliance:
- Civil penalties up to $1.5 million per year
- Criminal penalties up to 10 years in prison and $250,000 in fines
The rule was updated significantly through the HITECH Act in 2009, which strengthened enforcement and required stricter compliance tracking.
The HIPAA Breach Notification Rule
Also introduced by HITECH, this rule requires covered entities to notify:
- Affected individuals within 60 days of discovering a breach
- The media, if over 500 residents of a region are affected
- The Department of Health and Human Services (HHS), immediately for large breaches, or annually for smaller ones
These rules all work together. For example, the Privacy Rule sets the standards for PHI; the Security Rule defines how to protect electronic PHI; and the Breach Notification Rule ensures accountability if PHI is expose
How to Achieve and Maintain Compliance
With all of the safeguards and other rules required, compliance can be a challenge for covered entities and business associates. That’s why, for most entities, professional advisory services are the easiest and best way to keep your patients — and company — safe.
RSI Security offers a robust suite of HIPAA compliance services to guide your company through all stages of HIPAA compliance. We’re fully accredited Compliance Assessors and Advisors.
As such, we’re happy to help with:
- Initial inventory and preparation
- Patch identification and implementation
- Risk analysis of patient data environment
- Audits for all required safeguards
- Ongoing compliance support
RSI Security is your best option for compliance with HIPAA over the short and long term.
Professionalize Your Compliance and Cybersecurity
Here at RSI Security, we’re dedicated to helping companies across industries meet all their compliance needs. In healthcare and adjacent industries, that means HIPAA. But, depending on the nature of your business, you might also need to meet other standards, such as PCI DSS, or GDPR. We offer compliance advisory services for any framework you need.
Plus, we know compliance is just the start of your cybersecurity.
Our team of experts boasts a decade of experience providing all kinds of cyberdefense solutions to companies of all sizes. Whether you need overall architecture implementation or vulnerability management, or even focused penetration testing, we’ve got you covered.
Protect your organization from costly HIPAA violations, download our HIPAA Checklist today to ensure you’re fully compliant
Download Our HIPAA Checklist
