Is the privacy rule under HIPAA?

Editorial team Published on

Yes, the Privacy Rule is a core regulation and subpart of HIPAA (the Health Insurance Portability and Accountability Act).

What the Privacy Rule Does

  • Protects Data: It sets national standards to protect medical records and other individually identifiable health information, known as Protected Health Information (PHI).
  • Limits Disclosure: It places limits and conditions on how healthcare providers, health plans, and clearinghouses use and share patient data without direct authorization.
  • Grants Patient Rights: It gives people the right to examine, get copies of, or request corrections to their health records.

Other Major HIPAA Rules

  • Security Rule: Protects electronic Protected Health Information (ePHI).
  • Breach Notification Rule: Requires notifying patients and authorities when a data breach happens.

Are HIPAA and the privacy rule the same thing?

No, HIPAA and the Privacy Rule are not the same thing.

The Difference

  • HIPAA is the broader federal law (the Health Insurance Portability and Accountability Act of 1996) that creates the overall legal framework for protecting health information.
  • The Privacy Rule is just one specific regulation created under HIPAA. It specifically controls how patient medical records and other protected health information (PHI) can be used and shared.

Other Parts of HIPAA

HIPAA includes other major rules alongside the Privacy Rule:

  • Security Rule: Protects electronic health data using technical, physical, and administrative safeguards.
  • Breach Notification Rule: Explains what to do and who to notify if patient data is exposed.

What are the 5 main HIPAA rules?

The five main rules of the Health Insurance Portability and Accountability Act (HIPAA) are the Privacy Rule, Security Rule, Breach Notification Rule, Transactions and Code Sets Rule, and Unique Identifiers Rule.

1. The Privacy Rule

  • What it does: Controls how protected health information (PHI) is used and shared by healthcare providers and plans.
  • Key right: Gives patients the right to view, get copies of, and request corrections to their medical records.

2. The Security Rule

  • What it does: Protects electronic protected health information (ePHI).
  • Key controls: Requires administrative, physical, and technical safeguards—such as encryption and access controls—to secure digital medical data.

3. The Breach Notification Rule

  • What it does: Requires healthcare groups to report compromised PHI.
  • Key requirement: Mandates notifying affected individuals, the government, and sometimes the media without unreasonable delay (within 60 days).

4. The Transactions and Code Sets Rule

  • What it does: Standardizes electronic billing and data exchanges.
  • Key goal: Makes healthcare claims and transactions uniform and efficient by using standard coding formats like ICD-10.

5. The Unique Identifiers Rule

  • What it does: Assigns standard identification numbers to healthcare participants.
  • Key example: Requires providers to use a unique 10-digit National Provider Identifier (NPI).

What are the 7 patient rights under HIPAA?

Under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, patients have fundamental rights regarding their Protected Health Information (PHI).

The primary patient rights established under HIPAA include:

  • Right to Access and Copy: Patients can inspect and obtain copies of their medical and billing records.
  • Right to Request Amendments: Patients can ask to correct or amend incomplete or inaccurate information in their records.
  • Right to an Accounting of Disclosures: Patients can obtain a list of certain times and reasons a provider or health plan shared their health information.
  • Right to Request Restrictions: Patients can ask providers or health plans to limit how they use or share their health data.
  • Right to Confidential Communications: Patients can request that providers contact them via alternative methods or at alternative locations (such as a work phone instead of a home phone).
  • Right to a Notice of Privacy Practices: Patients have the right to receive a written explanation of how their health information is used and disclosed by a covered entity.
  • Right to File a Complaint: Patients can file a privacy complaint with the health provider's privacy officer or the U.S. Department of Health and Human Services (HHS) Office for Civil Rights if they believe their rights were violated.

What is the new HIPAA rule in 2026?

The main new HIPAA requirement for 2026 is updating privacy notices under the HHS Model Notices of Privacy Practices to include stricter protections for substance use disorder (SUD) patient records.

Key 2026 Privacy Rule Updates

  • February 16, 2026 Deadline: Healthcare providers and health plans had to update their Notice of Privacy Practices (NPP).
  • Substance Use Records: Notices must now explain how substance use disorder records are protected under 42 CFR Part 2.
  • Legal Protections: Patient records generally cannot be used in civil or criminal legal cases without explicit consent or a court order.
  • Patient Rights: Patients gained clearer rights to restrict sharing, opt out of fundraising, and file complaints.

Proposed Security Rule Changes (Under Review)

Regulators are also pushing a major update to the HIPAA Security Rule that changes how organizations handle data safety:

  • No More "Addressable" Rules: Optional security steps are becoming mandatory.
  • Mandatory MFA: Multi-factor authentication is required across all systems.
  • Required Encryption: Patient data must be encrypted both in transit and at rest.

The HIPAA Privacy Rule

9 related questions found

Is privacy rule considered PHI?

No, the HIPAA Privacy Rule itself is not considered Protected Health Information (PHI); rather, the Privacy Rule is the federal regulation that defines, governs, and protects PHI.

Understanding the Difference

  • The HIPAA Privacy Rule: A legal framework set by the U.S. Department of Health and Human Services that outlines national standards for protecting individual medical privacy and patient rights.
  • Protected Health Information (PHI): The actual individually identifiable health data (such as medical records, names, or test results) that is created, stored, or transmitted by a healthcare provider, health plan, or clearinghouse.

In short, the Privacy Rule is the law, and PHI is the data protected by that law.

What are the three main rules of HIPAA?

The three main rules of the Health Insurance Portability and Accountability Act (HIPAA) are the Privacy Rule, the Security Rule, and the Breach Notification Rule.

1. The HIPAA Privacy Rule

The Privacy Rule sets national standards to protect individuals' medical records and other protected health information (PHI).

  • Scope: Applies to paper, electronic, and spoken PHI.
  • Patient Rights: Gives patients the right to view, obtain copies of, and request corrections to their health records.
  • Use and Disclosure: Limits how organizations can share health data, enforcing the "minimum necessary" standard so staff only access data required for their specific jobs.

2. The HIPAA Security Rule

The Security Rule specifies the administrative, physical, and technical safeguards organizations must use to protect electronic protected health information (ePHI).

  • Administrative Safeguards: Security policies, staff training, and periodic risk assessments.
  • Physical Safeguards: Facility access controls, workstation security, and device protection.
  • Technical Safeguards: Access controls, password protection, and end-to-end data encryption.

3. The HIPAA Breach Notification Rule

The Breach Notification Rule requires covered entities to notify affected individuals, the government, and sometimes the media when unsecured PHI is compromised.

  • Individual Notice: Affected patients must be notified without unreasonable delay and within 60 days of discovering the breach.
  • Government Notice: The Department of Health and Human Services (HHS) must be notified within 60 days (or immediately if 500 or more individuals are affected).
  • Media Notice: Prominent local media outlets must be alerted if a breach affects more than 500 residents in a single state or jurisdiction.

What is not allowed under HIPAA?

Under the Health Insurance Portability and Accountability Act (HIPAA), healthcare providers, health plans, and clearinghouses are strictly not allowed to share or use a patient's Protected Health Information (PHI) without the patient’s written authorization, except for specific purposes like treatment, payment, or healthcare operations.

Prohibited Actions and Disclosures

  • Sharing with employers: Providers cannot give your health information or test results directly to your employer without your signed consent.
  • Marketing use: Selling patient information or using PHI for commercial marketing or advertising without explicit permission is barred.
  • Social media sharing: Posting patient photos, details, or identifying medical stories online is forbidden.
  • Gossip and casual talk: Discussing patient conditions in public areas or with unauthorized family and friends is prohibited.
  • Leaving unsecured records: Leaving paper charts, unencrypted laptops, or visible computer screens exposed to unauthorized people is a violation.

What HIPAA Does Not Cover

HIPAA only applies to covered entities and their business associates. It does not restrict:

  • Employment files: Health data kept in an employer's personnel or HR files (like sick notes or drug tests) is not protected by HIPAA.
  • Consumer apps: Fitness trackers, smartwatches, and period-tracking apps are generally not bound by HIPAA rules.
  • Public records: Information already made public through news or court filings.

What are the 10 most common HIPAA violations?

The 10 most common HIPAA violations involve mishandling protected health information (PHI) through employee error, weak security, or administrative oversight.

Top 10 Most Common Violations

  • Employee Snooping: Accessing patient files, family records, or coworker charts without a direct, professional need to know.
  • Lost or Stolen Devices: Leaving unencrypted laptops, smartphones, tablets, or USB drives where they can be stolen or accessed by outsiders.
  • Failure to Conduct Risk Analyses: Neglecting regular, organization-wide checkups to find and fix security gaps.
  • Improper Disposal of Records: Tossing paper charts in regular trash or failing to securely wipe old hard drives.
  • Weak Passwords and Access Controls: Using simple passwords or giving too many staff members broad, unmonitored access to electronic records (ePHI).
  • Unauthorized Texting or Emailing: Sending patient details over regular, unsecured text messages or standard email instead of encrypted platforms.
  • Missing Business Associate Agreements (BAAs): Failing to sign legal BAA contracts with outside vendors and cloud providers who handle patient data.
  • Delayed Breach Notifications: Missing the legal deadline to notify patients, the government, and the media within 60 days of discovering a data breach.
  • Inadequate Employee Training: Not providing regular, documented privacy and security awareness education for staff.
  • Denying or Delaying Patient Access: Taking longer than allowed (or refusing outright) to give patients copies of their own medical records.

What are three items required by the privacy rule?

The HIPAA Privacy Rule requires covered entities to implement three key operational provisions for managing patient data: limiting use and disclosure to permitted purposes, enforcing the minimum necessary standard, and providing individuals with specific rights to access and control their protected health information.

Key Requirements of the Privacy Rule

  • Permitted Uses and Disclosures: Organizations may use or share Protected Health Information (PHI) only for treatment, payment, and healthcare operations, or when specifically authorized in writing by the patient.
  • Minimum Necessary Standard: Staff must limit the use, request, or disclosure of PHI to the absolute minimum amount needed to accomplish the intended purpose.
  • Individual Patient Rights: Patients retain the legal right to inspect, copy, amend, and request restrictions or an accounting of disclosures regarding their medical records.