Who does the HIPAA privacy rule apply to?

Editorial team Published on

The HIPAA Privacy Rule applies to covered entities (health plans, health care clearinghouses, and certain health care providers) and their business associates that handle protected health information in any form.

Covered Entities

The Privacy Rule governs organizations that handle patient data. These groups are:

  • Health plans: Health, dental, vision, and prescription drug insurers, as well as government programs like Medicare and Medicaid.
  • Health care clearinghouses: Entities that process nonstandard health information into standard data formats (or vice versa).
  • Health care providers: Doctors, clinics, hospitals, psychologists, dentists, chiropractors, and pharmacies that transmit any health information electronically in connection with standard HIPAA transactions.

Business Associates

  • Vendors and contractors: Any person or organization outside a covered entity's workforce that performs services involving access to protected health information (such as billing companies, legal consultants, cloud storage providers, and accountants).

Types of Protected Information

  • All formats: Unlike the HIPAA Security Rule (which focuses strictly on electronic data), the Privacy Rule protects individually identifiable health information regardless of the medium—covering electronic, paper, and oral/spoken communications.

Who is not covered by the privacy rule?

The HIPAA Privacy Rule does not cover organizations that are not classified as covered entities (health plans, health care clearinghouses, and health care providers conducting electronic transactions) or their business associates.

Non-Covered Entities and Groups

  • Employers: Employment records held by an employer in their role as an employer are excluded.
  • Life and Disability Insurers: Policies providing life, disability, or auto insurance coverage are not covered.
  • Schools and Educational Institutions: Student records managed under the Family Educational Rights and Privacy Act (FERPA) are excluded.
  • Law Enforcement Agencies: Police and investigative groups collecting information outside traditional health care operations are not covered.
  • Direct-to-Consumer Apps: Many wellness programs, fitness clubs, and mobile health apps that operate independently from a covered healthcare provider are excluded.
  • Workers' Compensation Carriers: Programs paying for non-medical or injury compensation benefits are generally outside the rule.
  • Family Members: Relatives of patients are not regulated entities under the rule.

Excluded Data Types

  • De-identified Information: Health data that removes all individual identifiers or is certified by a statistician falls completely outside the Privacy Rule.
  • Deceased Records: Health information regarding individuals who have been deceased for more than 50 years is excluded.

Who is exempt from the HIPAA privacy rule?

Organizations and data types that do not function as covered entities or business associates are exempt from the HIPAA Privacy Rule. HIPAA only applies to health plans, healthcare clearinghouses, healthcare providers who transmit health information electronically, and their business associates.

Exempt Entities and Organizations

  • Standard Employers: Employers acting in their employment role (managing sick leave, drug tests, or fitness-for-duty notes) are exempt, though their records may fall under other laws like the ADA.
  • Life and Disability Insurers: These companies collect health data but do not engage in standard electronic healthcare transactions covered by HIPAA.
  • Workers' Compensation Carriers: Insurers handling claims related to workplace injuries operate outside direct HIPAA jurisdiction.
  • Most Schools and Districts: Educational institutions maintain student health information, but these are governed by the Family Educational Rights and Privacy Act (FERPA) rather than HIPAA.
  • Law Enforcement and State Agencies: Police departments, child protective services, and local agencies do not meet the definition of a covered entity in their normal investigative capacities.
  • Direct-to-Consumer Apps: Fitness trackers, wellness apps, and data brokers that interact directly with consumers without a link to a covered entity are exempt.

Exempt Types of Information

  • Employment Records: Specific employment records held by a covered entity in its capacity as an employer are excluded.
  • De-Identified Data: Health information that has been stripped of individual identifiers or certified by a statistician has no restrictions under HIPAA.
  • Decedents' Information: Records of individuals who have been deceased for more than 50 years are excluded.

Does HIPAA apply to the president of the United States?

Yes, the President of the United States has the same legal right to medical privacy under the Health Insurance Portability and Accountability Act (HIPAA) as any other American citizen.

How HIPAA Applies to the President

  • Covered Entities: Medical providers, military hospitals like Walter Reed, and military or official physicians treating the president are bound by HIPAA rules.
  • Patient Consent: Personal health information cannot be shared publicly or with the press without the president's explicit authorization.
  • Waiver Rights: The president can choose to release medical details or authorize a personal physician to share updates, but information outside that consent remains protected.
  • Ethical Duties: Aside from federal law, doctors have a professional and ethical obligation under the American Medical Association to keep patient medical details confidential.

Limits and Exceptions

  • No Public Right to Know: There is no specific federal law or presidential exception in HIPAA that strips away privacy rights or mandates full public transparency regarding a president's medical history.
  • Standard Exceptions: Medical staff may share protected health information without consent strictly for direct treatment, billing, or specific public health and national security coordination.

Which entity enforces the HIPAA privacy rule?

The Health Insurance Portability and Accountability Act (HIPAA) is primarily enforced by the Office for Civil Rights (OCR), an agency within the U.S. Department of Health and Human Services (HHS).

Primary Federal Enforcement

  • Office for Civil Rights (OCR): Enforces the HIPAA Privacy, Security, and Breach Notification Rules by investigating complaints, conducting audits, and imposing civil monetary penalties (CMPs).
  • Centers for Medicare & Medicaid Services (CMS): Enforces HIPAA administrative simplification rules, including transaction and code sets, national identifiers, and insurance portability requirements.

Criminal and State Enforcement

  • Department of Justice (DOJ): Handles criminal violations of HIPAA, which involve "knowingly" misusing or selling protected health information.
  • State Attorneys General: Have the legal authority to bring civil actions and seek damages or penalties on behalf of residents affected by HIPAA violations.

The HIPAA Privacy Rule

9 related questions found

Who does HIPAA privacy apply to?

The HIPAA Privacy Rule applies strictly to covered entities and their business associates.

Covered Entities

These are the primary groups that must follow HIPAA rules:

  • Health care providers: Doctors, clinics, dentists, pharmacies, psychologists, nursing homes, and hospitals that transmit any health information electronically in standard transactions (like billing or insurance claims).
  • Health plans: Health insurance companies, HMOs, company health plans, and government programs like Medicare and Medicaid.
  • Health care clearinghouses: Entities that process nonstandard health data into a standard electronic format (or vice versa).

Business Associates

These are individuals or outside companies that perform work or services for a covered entity and need access to protected health information.

  • Examples include billing companies, accountants, legal consultants, IT vendors, and cloud storage providers.
  • They are directly liable for following HIPAA privacy and security rules.

What is Not Covered

HIPAA does not apply to:

  • Employers: General employment records and sick leave notes held by an employer are excluded.
  • Consumer tech: Fitness trackers, smartwatches, and most consumer health apps (unless they are working directly on behalf of a covered entity).
  • Life insurers and schools: Most life insurance companies, schools, and law enforcement agencies are exempt.

What are exceptions to the privacy rule?

The HIPAA Privacy Rule allows medical providers and health plans to share protected health information without patient permission in specific public interest and operational situations.

Core Exceptions and Permitted Disclosures

  • Treatment, Payment, and Operations (TPO): Sharing data for patient care, billing, quality checks, and medical management.
  • Public Health Activities: Reporting disease outbreaks, child abuse, or faulty medical devices to public health authorities.
  • Averting Serious Threats: Disclosing information to prevent an immediate and severe threat to a person or the public safety.
  • Law Enforcement Purposes: Helping locate a suspect, reporting a crime on the premises, or obeying a court order.
  • Judicial and Administrative Proceedings: Responding to lawful subpoenas, warrants, or judge's orders.
  • Health Oversight: Providing records to government agencies that audit or inspect healthcare programs.
  • Workers' Compensation: Sharing injury details to process workers' compensation claims.
  • Required by Law: Following any other federal, state, or local laws that mandate the disclosure.

What are three exceptions to HIPAA?

The three specific exceptions under the HIPAA Breach Notification Rule define when unauthorized access to or acquisition of protected health information (PHI) is not legally considered a reportable breach.

Three Core Exceptions to a HIPAA Breach

  • Unintentional Acquisition, Access, or Use of PHI: An employee or workforce member accesses health data accidentally in good faith and within their authorized scope of work, without further improper disclosure. (Example: A nurse accidentally opens the wrong electronic chart but closes it immediately upon realizing the error.)
  • Inadvertent Disclosure Between Authorized Persons: A person who is authorized to access PHI mistakenly shares it with another authorized person within the same organization or health care arrangement. (Example: Two clinicians with proper authorization mistakenly swap a verbal update using the wrong patient file name, but the recipient cannot retain or misuse the data.)
  • Unauthorized Disclosure Where Data Cannot Be Retained: An unauthorized recipient receives PHI, but the covered entity has a good-faith belief that the person could not have reasonably retained or compromised the information. (Example: A misdirected fax or email sent to an external party who immediately calls to report it and confirms they did not read, save, or print the document.)

Other Common Exceptions to HIPAA Privacy Rules

Beyond breach notification, the Department of Health and Human Services (HHS) allows the disclosure of PHI without patient authorization in specific public interest scenarios, including:

  • Treatment, payment, and healthcare operations (TPO)
  • Public health activities and disease reporting
  • Judicial and administrative court orders
  • Law enforcement and public safety threats
  • Workers' compensation compliance

What is the new HIPAA rule in 2026?

The main new HIPAA requirement for 2026 is updating privacy notices under the HHS Model Notices of Privacy Practices to include stricter protections for substance use disorder (SUD) patient records.

Key 2026 Privacy Rule Updates

  • February 16, 2026 Deadline: Healthcare providers and health plans had to update their Notice of Privacy Practices (NPP).
  • Substance Use Records: Notices must now explain how substance use disorder records are protected under 42 CFR Part 2.
  • Legal Protections: Patient records generally cannot be used in civil or criminal legal cases without explicit consent or a court order.
  • Patient Rights: Patients gained clearer rights to restrict sharing, opt out of fundraising, and file complaints.

Proposed Security Rule Changes (Under Review)

Regulators are also pushing a major update to the HIPAA Security Rule that changes how organizations handle data safety:

  • No More "Addressable" Rules: Optional security steps are becoming mandatory.
  • Mandatory MFA: Multi-factor authentication is required across all systems.
  • Required Encryption: Patient data must be encrypted both in transit and at rest.

What is not a requirement of the HIPAA privacy rule?

Installing specific technical mechanisms like internet firewalls is not a direct requirement of the HIPAA Privacy Rule.

Understanding the Difference

  • The Privacy Rule: Focuses on the policies, procedures, and rights regarding the use and disclosure of Protected Health Information (PHI). It does not mandate specific hardware or technical tools like firewalls.
  • The Security Rule: Covers technical safeguards (such as encryption and firewalls) to protect electronic PHI (ePHI).

Key Requirements of the HIPAA Privacy Rule

  • Designating a Privacy Officer: Entities must name a person responsible for developing and implementing privacy policies.
  • Business Associate Agreements (BAAs): Contracts must be established with third-party vendors who handle PHI.
  • Patient Rights Documentation: Entities must provide notices of privacy practices and allow patients to access their records.
  • Policies and Procedures: Written protocols must be implemented to safeguard patient confidentiality.