HIPAA Privacy Rule: Requirements & Compliance

Healthcare organizations handle some of the most sensitive information a person can share. Yet protecting that information is not simply a matter of securing databases or restricting access to medical records. A patient's information may be accessed by clinicians, billing teams, insurers, technology providers, and other parties for legitimate business and healthcare purposes. The challenge is knowing where legitimate access ends and improper use or disclosure begins.

This is where the HIPAA Privacy Rule comes in. For organizations operating in the USA, the Rule establishes federal requirements for how protected health information (PHI) can be used and disclosed, while giving individuals rights over their health information. But understanding the regulation is only the starting point. Organizations must translate its requirements into practical policies, workforce responsibilities, access controls, disclosure processes, and evidence of implementation. So, what does the HIPAA Privacy Rule actually require, who must comply with it, and how can organizations determine whether their privacy practices are working as intended?

This guide provides a practical HIPAA Privacy Rule explained approach, covering its key provisions, patient rights, permitted disclosures, minimum necessary standard, and the core considerations for building effective HIPAA Privacy Rule compliance.

What Is the HIPAA Privacy Rule?

The HIPAA Privacy Rule establishes national standards for protecting individually identifiable health information and governs how covered entities may use and disclose PHI. It applies to health plans, healthcare clearinghouses, and certain healthcare providers. The HIPAA framework also places obligations on applicable business associates that handle PHI on behalf of covered entities.  In simple terms, the HIPAA Privacy Rule answers three important questions:

• What health information is protected?
• When can that information be used or disclosed?
• What rights does an individual have over that information?

This makes the Privacy Rule broader than a cybersecurity requirement. It addresses privacy practices involving PHI regardless of whether information is maintained electronically, on paper, or communicated orally.

Explore HIPAA Privacy Rule requirements, PHI protections, patient rights, and compliance considerations with independent assessment services from INTERCERT.

Who Must Comply With the HIPAA Privacy Rule?

Understanding who falls within the scope of the HIPAA Privacy Rule is the first step toward determining an organization's compliance responsibilities. HIPAA does not apply to every organization that handles health-related information. Its Privacy Rule specifically applies to covered entities and certain business associates that handle protected health information (PHI).

Covered Entities

Covered entities are the organizations directly regulated by HIPAA. They generally fall into three categories:

Health Plans: These include health insurance companies, HMOs, employer-sponsored health plans, and government programs that provide or pay for healthcare. Because these organizations handle substantial amounts of health and claims information, they must establish appropriate controls for how PHI is used and disclosed.

Healthcare Clearinghouses: These organizations process health information received from another entity and convert it into standardized formats or transactions. Their role in healthcare data exchange means they are subject to HIPAA requirements when their activities fall within the applicable definitions.

Healthcare Providers: Doctors, hospitals, clinics, pharmacies, and other healthcare providers can be covered entities when they conduct certain healthcare transactions electronically, such as electronic billing or claims transactions. Importantly, being a healthcare provider alone does not automatically make an organization a HIPAA-covered entity; it must meet the applicable HIPAA criteria.

Business Associates

A business associate is generally a person or organization that performs certain functions or provides services for a covered entity that involve creating, receiving, maintaining, or transmitting PHI. This can include technology and cloud service providers, billing and claims-processing companies, healthcare consultants, administrative service providers, and other third parties, depending on the services they perform and how they handle PHI. For example, if a healthcare provider uses an external company to perform billing services and that company handles PHI as part of the service, the company may qualify as a business associate.

Business Associate Agreements Matter?

Covered entities generally must enter into a Business Associate Agreement (BAA) with their business associates. The agreement establishes how PHI may be used and disclosed, requires appropriate safeguards, and sets out the business associate's responsibilities when handling the information.  Business associates can also have direct HIPAA obligations for certain requirements. This means compliance responsibility does not necessarily stop with the healthcare provider. Organizations across the U.S. healthcare ecosystem need to understand where PHI moves, which third parties handle it, and what responsibilities apply at each point. Therefore, for organizations operating in the USA, identifying whether they are a covered entity, business associate, or neither is essential before designing a HIPAA privacy program. Misclassifying an organization can lead to gaps in policies, contractual arrangements, workforce responsibilities, and PHI protections.

What Information Does the HIPAA Privacy Rule Protect?

The Privacy Rule protects protected health information (PHI), individually identifiable health information held or transmitted by a covered entity or business associate in circumstances covered by HIPAA. PHI can include information such as:

• Medical histories
• Diagnoses and treatment information
• Laboratory results
• Billing and payment information
• Health insurance information
• Patient identifiers
• Other information that can identify an individual and relates to their health or healthcare

Importantly, PHI is not limited to information stored in an electronic health record. This distinction also helps explain the difference between HIPAA's Privacy and Security Rules. The Privacy Rule addresses PHI broadly, while the Security Rule focuses specifically on electronic protected health information (ePHI).

Key HIPAA Privacy Rule Requirements

Understanding the HIPAA Privacy Rule requirements is only the starting point. Compliance depends on how effectively an organization translates those requirements into policies, responsibilities, and day-to-day practices. A privacy policy sitting in a document repository does little on its own if employees do not know how to apply it or if the organization cannot demonstrate that its procedures are being followed. The key requirements include:

Establish Privacy Policies and Procedures

Covered entities must develop and implement policies and procedures that establish how PHI is handled throughout its lifecycle. These should address how information may be accessed, used, and disclosed, as well as how the organization responds to individual requests and exercises of privacy rights. The policies should reflect the organization's actual operations rather than simply reproduce regulatory language. As healthcare workflows, technologies, and third-party relationships change, privacy procedures should be reviewed and updated accordingly.

Assign Privacy Responsibilities and Train the Workforce

HIPAA compliance ultimately depends on the people who handle PHI every day. Covered entities are expected to designate a privacy official responsible for developing and implementing privacy policies and procedures. They must also train members of their workforce on relevant privacy policies and procedures as part of their roles. Training should go beyond explaining what HIPAA is. Employees should understand what information they can access, when they can disclose it, who they can share it with, and what to do when they encounter a privacy concern.

Provide a Notice of Privacy Practices

The Notice of Privacy Practices (NPP) helps individuals understand how a covered entity may use and disclose their PHI and explains their rights under HIPAA. Covered entities generally must provide the notice as required and make it available in the manner prescribed by the Privacy Rule. The NPP should accurately reflect the organization's current privacy practices. An outdated notice can create a disconnect between what patients are told and what the organization actually does with their information.

Control Access, Use, and Disclosure of PHI

Organizations need practical controls to prevent inappropriate access, use, or disclosure of PHI. This includes defining who should have access to information, establishing procedures for permitted disclosures, and applying the minimum necessary standard where applicable. These controls should be supported by documented processes and clear workforce responsibilities. For example, employees should know how to respond when an external party requests patient information and when additional authorization or verification may be necessary.

Protect and Support Individual Privacy Rights

HIPAA also requires organizations to establish processes for handling individual rights, including requests to access or amend PHI and other rights provided by the Privacy Rule. This means organizations need more than a statement that patients have rights. They need a repeatable process for receiving, verifying, responding to, documenting, and tracking those requests within the applicable requirements.

Turning Requirements Into Evidence

The strongest HIPAA privacy programs ensure that every requirement is supported by a corresponding policy, process, workforce action, evidence of implementation, and regular review.  This is an important distinction in HIPAA Privacy Rule compliance. The objective is not simply to demonstrate that policies exist, but to show that privacy requirements are consistently understood, implemented, and monitored across the organization.

When Can PHI Be Used or Disclosed?

One of the most important HIPAA Privacy Rule provisions concerns when protected health information (PHI) can be used or disclosed without obtaining an individual's authorization. HIPAA is not intended to prevent legitimate information sharing. Healthcare providers need to exchange information to deliver care, process payments, coordinate services, and carry out essential healthcare activities. At the same time, the Privacy Rule places boundaries around these disclosures. Organizations must understand the purpose of the disclosure, who is receiving the information, what information is relevant, and what conditions apply before sharing PHI.

Treatment

PHI may generally be used or disclosed when it is necessary to provide, coordinate, or manage healthcare. This can include sharing relevant information between healthcare providers involved in an individual's care. For example, when a primary care physician refers a patient to a specialist, relevant medical information can generally be shared with the specialist to help evaluate the patient and provide appropriate treatment. Similarly, providers involved in coordinating a patient's care may need access to relevant information to make informed clinical decisions. The ability to share PHI for treatment is essential to preventing privacy requirements from becoming a barrier to effective healthcare delivery.

Payment

Covered entities may also use or disclose PHI for activities related to payment for healthcare services. This can include determining eligibility or coverage, processing claims, billing patients or insurers, and obtaining payment for healthcare services already provided. For instance, a healthcare provider may need to provide relevant patient and treatment information to a health plan when submitting a claim. The information shared should still be appropriate for the payment activity and handled according to applicable HIPAA requirements.

Healthcare Operations

The Privacy Rule also permits certain uses and disclosures for healthcare operations. These activities support the day-to-day management, administration, quality, and improvement of healthcare organizations. Healthcare operations can include activities such as quality assessment and improvement, population-based activities related to improving health or reducing healthcare costs, reviewing the competence or qualifications of healthcare professionals, and other activities permitted under the Privacy Rule. For example, an organization may use appropriate PHI as part of a quality improvement program designed to identify patterns in patient care and improve the quality of its services.

Public Health Activities

Certain disclosures are permitted when PHI is needed for specific public health activities. These provisions allow healthcare organizations to provide relevant information to authorized public health authorities for purposes such as controlling disease, injury, or disability. This can be particularly important during situations involving communicable diseases or other public health concerns. However, the disclosure must fall within the circumstances permitted by the Privacy Rule and applicable law.

Health Oversight Activities

PHI may also be disclosed in certain circumstances to government agencies or authorities conducting health oversight activities. These activities can involve audits, investigations, inspections, licensing, disciplinary proceedings, or other oversight of the healthcare system. Such disclosures allow regulators and authorized agencies to carry out their responsibilities while maintaining the limitations established by HIPAA.

Judicial and Administrative Proceedings

The Privacy Rule allows certain disclosures of PHI for judicial and administrative proceedings when the applicable HIPAA conditions are satisfied. For example, an organization may receive a request for patient information in connection with a legal proceeding. That does not mean the organization can automatically release the requested records. It must determine whether the disclosure meets the applicable HIPAA requirements and whether additional safeguards or procedures apply.

Law Enforcement Purposes

HIPAA also permits certain disclosures to law enforcement officials, but these disclosures are subject to specific conditions. The Privacy Rule does not give law enforcement unrestricted access to an individual's medical records simply because the information may be relevant to an investigation. Organizations should therefore have defined procedures for handling law enforcement requests, including determining whether the request meets the applicable legal and HIPAA requirements before releasing PHI.

Workers' Compensation

Certain disclosures may be made for workers' compensation purposes when permitted by applicable laws and regulations. For example, a healthcare provider may need to disclose relevant medical information associated with an employee's workplace injury to support a workers' compensation claim. The disclosure should remain within the scope permitted by the applicable requirements.

Permitted Does Not Mean Unrestricted

A critical principle of the HIPAA Privacy Rule regulations is that a permitted purpose does not automatically make every disclosure permissible. Organizations still need to consider what information is being requested, why it is needed, who is requesting it, whether the recipient is authorized to receive it, and what limitations apply. Where the minimum necessary standard applies, reasonable steps must also be taken to limit the information to what is necessary for the intended purpose. This is why effective HIPAA Privacy Rule compliance requires more than knowing the permitted categories. Organizations need clear procedures that help employees evaluate requests consistently and prevent unnecessary disclosure of PHI.

What Is the HIPAA Minimum Necessary Rule?

The minimum necessary standard is one of the most important concepts in HIPAA Privacy Rule compliance. Generally, covered entities must take reasonable steps to limit uses, disclosures, and requests for PHI to the minimum necessary to accomplish the intended purpose. For example, if an employee needs limited patient information to perform a particular administrative function, that does not automatically mean the employee should have unrestricted access to the patient's entire medical record.

Organizations should therefore establish appropriate policies, procedures, and role-based access practices. There are important exceptions. The minimum necessary standard does not generally apply to disclosures to or requests by healthcare providers for treatment purposes, disclosures to the individual, and certain other circumstances specified by the Privacy Rule. The practical lesson is straightforward: Access to PHI should be based on business and clinical need, not simply technical availability.

When Is HIPAA Authorization Required?

HIPAA does not require authorization for every use or disclosure of PHI. Certain activities, including many disclosures for treatment, payment, and healthcare operations, are permitted without obtaining separate authorization, provided the applicable Privacy Rule requirements are met.

However, authorization may be required when a use or disclosure is not otherwise permitted under the Privacy Rule. This can apply to certain marketing activities and other uses of PHI outside the permitted purposes. Organizations should not treat a patient's general consent to receive healthcare as blanket permission to use or disclose their PHI for unrelated purposes.

When authorization is required, it must meet specific HIPAA requirements, including identifying the information, purpose, and parties involved. Organizations should therefore have clear procedures to determine when authorization is needed and how it must be obtained and documented.

What Rights Do Patients Have Under HIPAA?

The HIPAA Privacy Rule gives individuals important rights over their protected health information (PHI). Depending on the circumstances and applicable exceptions, patients generally have the right to access and obtain copies of their health information, request amendments, ask for certain restrictions, request confidential communications, receive an accounting of certain disclosures, and receive a Notice of Privacy Practices. One of the most important rights is the ability to access PHI contained in designated record sets. While HIPAA provides this right, certain limited exceptions and specific procedures can apply to how access requests are handled.

For healthcare organizations, protecting these rights requires more than simply including them in a privacy policy. Organizations need a consistent process for receiving, verifying, responding to, and documenting patient requests. Employees should understand how to handle these requests and when they need to escalate them. Therefore, effective HIPAA Privacy Rule compliance means ensuring that patient rights are not only documented but also implemented consistently in everyday operations.

Show stakeholders that your organization takes the protection of PHI and patient privacy seriously. INTERCERT provides independent HIPAA assessment and certification services aligned with applicable HIPAA requirements.

Why the Notice of Privacy Practices Matters?

The Notice of Privacy Practices is an important transparency mechanism under the Privacy Rule. It explains how a covered entity may use and disclose PHI, outlines individual rights, and explains the organization's obligations concerning health information. Covered entities must make the notice available to individuals and, where applicable, prominently post it on relevant websites.  Current regulatory developments make this area particularly important.

As of February 16, 2026, HHS states that HIPAA-covered entities must include information concerning certain substance use disorder patient records under 42 CFR Part 2 in their Notice of Privacy Practices. HHS has also published revised model notices to help organizations meet the applicable requirements.  At the same time, organizations should carefully monitor the changing regulatory position surrounding the 2024 reproductive-health Privacy Rule. HHS states that a June 18, 2025 federal court order vacated most of that rule, while certain NPP modifications remained in effect.

This is a good example of why HIPAA Privacy Rule guidelines should be reviewed against current regulatory requirements rather than relying indefinitely on older policies or templates.

HIPAA Privacy Rule vs. Security Rule vs. Breach Notification Rule

The HIPAA Privacy Rule, Security Rule, and Breach Notification Rule address different aspects of protecting health information, and understanding the distinction is essential for effective HIPAA compliance. The Privacy Rule focuses on how PHI may be used and disclosed and establishes individual rights over their health information. The Security Rule, on the other hand, focuses specifically on protecting electronic protected health information (ePHI) through appropriate administrative, physical, and technical safeguards. The Breach Notification Rule addresses what organizations must do when a breach of unsecured PHI occurs, including applicable notification requirements.

These rules work together but are not interchangeable. An organization may have strong cybersecurity measures that satisfy many Security Rule expectations while still having weaknesses in its Privacy Rule practices. For example, if an employee improperly discloses a patient's PHI to an unauthorized person, the organization may have a Privacy Rule issue even if its systems and networks are protected by strong technical security controls.

In simple terms, the Privacy Rule governs how PHI is used and shared, the Security Rule protects ePHI, and the Breach Notification Rule governs the response to certain breaches of unsecured PHI. Understanding how these requirements interact helps organizations build a more complete HIPAA compliance program rather than treating privacy and security as the same issue.

How Can Organizations Demonstrate HIPAA Privacy Rule Compliance?

HIPAA Privacy Rule compliance should be supported by evidence that demonstrates how privacy requirements are translated into everyday practices. Having policies in place is important, but organizations should also be able to show that those policies are implemented, followed by the workforce, and reviewed when gaps are identified.

Documented Privacy Policies and Procedures

Organizations should maintain current policies that explain how PHI is accessed, used, disclosed, and protected. These procedures should reflect actual business and healthcare workflows rather than simply repeat regulatory language. Regular reviews can help ensure policies remain aligned with organizational changes and applicable HIPAA requirements.

Workforce Training Records

Training records provide evidence that employees and other workforce members have been informed about their HIPAA responsibilities. Organizations should be able to demonstrate who received training, when it occurred, and what privacy requirements were covered. This helps establish that privacy obligations are understood beyond the policy level.

Business Associate Agreements

Where business associates are involved, organizations should maintain appropriate Business Associate Agreements (BAAs) and related documentation. These agreements help establish how PHI may be handled and clarify the responsibilities of the parties involved.

Authorization and Disclosure Documentation

Records such as authorization forms and disclosure procedures can demonstrate how the organization determines whether PHI may be shared. They also provide evidence that employees follow defined processes when handling requests for patient information.

Patient Request and Complaint Records

Organizations should have documented processes for handling patient requests, including requests to access or amend PHI, as well as privacy complaints. Maintaining appropriate records demonstrates that individual rights are actively supported rather than simply stated in a policy.

Notice of Privacy Practices

The Notice of Privacy Practices (NPP) should accurately communicate the organization's privacy practices and individual rights. Organizations should maintain evidence that the appropriate notice is provided and made available as required.

Monitoring and Corrective Actions

Ongoing reviews, monitoring activities, and corrective-action records can demonstrate that the organization actively evaluates its privacy practices. When a gap is identified, documenting the issue, corrective action, responsible parties, and follow-up helps show that the organization is working to improve its privacy controls.

From Documentation to Demonstrable Compliance

Ultimately, organizations should be able to connect each HIPAA requirement to a clear policy, defined process, effective implementation, documented evidence, and continuous improvement. For organizations in the USA, this approach provides a stronger basis for demonstrating that HIPAA Privacy Rule controls are not merely documented but are actually embedded into day-to-day operations.

Adopting an Effective HIPAA Privacy Program

Effective HIPAA Privacy Rule compliance is not a one-time exercise. Organizations need a structured approach that connects regulatory requirements with their actual workflows, workforce responsibilities, and handling of PHI. A practical program can be built around the following steps:

Identify Where PHI Exists

Start by identifying the types of PHI the organization creates, receives, maintains, and transmits. Map where information is stored, who handles it, and which internal teams or third parties have access. This provides a clear picture of the organization's PHI environment and potential privacy risks.

Determine Applicable HIPAA Requirements

Not every HIPAA requirement applies in exactly the same way to every organization. Determine which HIPAA Privacy Rule regulations, provisions, and individual rights requirements apply based on the organization's role, activities, and relationships with covered entities or business associates.

Assess Current Practices

Compare what the organization's policies require with what actually happens in practice. Review how employees access and disclose PHI, how patient requests are handled, how third parties receive information, and whether existing procedures are consistently followed. This helps identify gaps between documented controls and operational reality.

Establish and Maintain Policies

Develop clear policies and procedures for accessing, using, disclosing, and managing PHI. These should be practical enough for employees to apply during their daily responsibilities and should be reviewed whenever significant operational or regulatory changes occur.

Define Roles and Responsibilities

Clearly establish who is responsible for privacy oversight and ensure workforce members understand their individual responsibilities. Employees should know what information they can access, when PHI can be disclosed, and when a request should be escalated to the appropriate privacy or compliance personnel.

Monitor and Review Implementation

Privacy controls should be periodically reviewed to determine whether they are working as intended. Organizations can use internal reviews, monitoring activities, complaint trends, training records, and other evidence to identify weaknesses before they develop into larger compliance problems.

Correct Gaps and Drive Improvement

When weaknesses are identified, organizations should document the issue, determine its cause, assign corrective actions, and track the resolution. This creates a continuous improvement cycle rather than treating HIPAA compliance as a checklist completed once a year.

Moreover, a sustainable HIPAA privacy program connects requirements, policies, people, processes, evidence, and improvement. This approach helps organizations in the USA move beyond simply preparing for an external review and toward maintaining privacy practices that work consistently in everyday operations.

HIPAA Privacy Compliance Is More Than Protecting Patient Information

The HIPAA Privacy Rule is ultimately about more than restricting access to medical records. It establishes a framework for ensuring that PHI is used and disclosed for legitimate purposes, that individuals can exercise their privacy rights, and that organizations have defined processes for managing sensitive health information responsibly.

For healthcare organizations in the USA, effective HIPAA Privacy Rule compliance requires these requirements to become part of everyday operations. Policies need to reflect actual workflows, employees need to understand their responsibilities, patient requests need to be handled consistently, and privacy controls need to be backed by objective evidence and ongoing review.

This is where choosing the right certification and compliance partner becomes important. INTERCERT brings an independent, structured approach to HIPAA compliance, with experienced professionals focused on evaluating organizational practices against applicable requirements and identifying opportunities to strengthen privacy controls. Its experience across diverse industries and international markets provides organizations with a practical perspective on managing compliance requirements in complex operating environments.