HIPAA Privacy Rule

The HIPAA Privacy Rule governs how covered entities may use and disclose protected health information. It establishes patient rights over their health information and sets limits on who can access PHI and under what circumstances. Where the Security Rule asks "is the data protected," the Privacy Rule asks the harder operational question: "should this person see this data for this purpose at all?"

The Privacy Rule applies to PHI in all forms — electronic, paper, and oral. It applies in full to covered entities; business associates are bound by the provisions in their BAA and may only use PHI as that agreement permits. Even if you are a technology vendor rather than a provider, you need to understand this rule, because your product's data flows, features, and marketing practices all live inside its boundaries.

The core logic is simple to state: every use or disclosure of PHI must be either permitted by the rule or authorized by the patient. Everything else — the minimum necessary standard, patient rights, the Notice of Privacy Practices — hangs off that principle.

Permitted Uses and Disclosures

PHI can be used and disclosed without patient authorization for three core purposes, collectively called TPO:

Treatment — providing and coordinating healthcare, including consultations and referrals between providers. This is the most permissive category by design; the rule tries hard never to obstruct care.
Payment — billing, claims, eligibility checks, and reimbursement activities.
Healthcare operations — quality assessment and improvement, credentialing, training, auditing, business planning, and general administration.

Beyond TPO, the rule permits (but does not require) roughly a dozen categories of disclosure without authorization, each with its own conditions: disclosures required by law; public health activities (disease reporting, FDA adverse events); reports of abuse, neglect, or domestic violence; health oversight (audits, licensure investigations); judicial and administrative proceedings (with valid orders or subpoenas plus safeguards); limited law enforcement purposes; decedents (coroners, funeral directors); organ donation; certain research with IRB or privacy board approval; averting serious threats to health or safety; specialized government functions; and workers' compensation.

Two disclosures are actually required: to the individual when they exercise their access rights, and to HHS during an investigation.

For anything else — marketing, most sales of PHI, sharing with an employer, using identifiable data to train a commercial model outside operations — you need a valid written authorization: a specific, plain-language document identifying the information, the recipient, the purpose, an expiration, and the right to revoke. Compound or coerced authorizations are invalid; you generally cannot condition treatment on signing one.

Scenario	Authorization Needed?	Notes
Referring physician requests records for a shared patient	No	Treatment
Submitting claims to a payer	No	Payment
Internal quality dashboard using identifiable data	No	Operations, minimum necessary applies
Emailing patient success stories to prospects	Yes	Marketing
Selling patient lists to a pharma company	Yes, with sale disclosure	Sale of PHI provisions apply
Reporting a notifiable disease to a health department	No	Public health
Responding to a subpoena without a court order	Conditional	Requires assurances or protective order
Analytics on properly de-identified data	No	Outside HIPAA entirely
Giving a patient their own records	No — it is mandatory	Right of access, 30-day deadline

The Minimum Necessary Standard

When using or disclosing PHI, covered entities must make reasonable efforts to limit access to the minimum necessary information to accomplish the intended purpose. This means not providing an entire medical record when only a specific data element is needed.

The standard does not apply to: disclosures to or requests by providers for treatment, disclosures to the individual, uses under a valid authorization, disclosures to HHS, and disclosures required by law. It applies with full force to operations, payment, and vendor data flows.

Operationalizing minimum necessary is really an access-design exercise:

Role-based access — define which workforce roles need which categories of PHI and enforce it in systems, not just policy. A billing clerk does not need clinical notes; a support engineer rarely needs any PHI by default.
Routine disclosures — for recurring flows (claims, HIE feeds, vendor integrations), document a standard protocol limiting fields to what the purpose requires.
Non-routine requests — review individually against criteria.
Product implication for vendors — if your API pulls full patient records when your feature needs demographics, you have a minimum necessary problem baked into your architecture. Scope data ingestion to the fields your service actually uses; it also shrinks your breach blast radius.

Patient Rights

The Privacy Rule grants individuals enforceable rights, and covered entities must have working processes — with deadlines — to honor them.

Right of access is the one that gets organizations fined. Individuals can inspect and obtain copies of their PHI in a designated record set, in the form and format they request if readily producible (including electronic copies and transmission to a third party), within 30 days (one 30-day extension allowed with written notice). Fees are limited to reasonable, cost-based charges. OCR has run a sustained Right of Access enforcement initiative with dozens of settlements — many against small practices, many under $100,000 — for blowing the deadline or overcharging. If you build patient-facing products, self-service record export is both a compliance asset and a feature.

Right to request amendment — patients can ask to correct their records; you have 60 days to act, and if you deny (for example, the record is accurate), the patient may file a statement of disagreement that travels with the record.

Right to an accounting of disclosures — a list of certain disclosures (excluding TPO and a few other categories) over the prior six years. This requires logging non-routine disclosures as they happen; you cannot reconstruct it later.

Right to request restrictions — generally you may decline, with one mandatory exception: if a patient pays fully out of pocket and asks you not to disclose that service to their health plan, you must comply.

Right to confidential communications — reasonable requests for alternative contact methods or locations (call my cell, not my home) must be accommodated, no explanation required. This matters enormously for sensitive care contexts.

Notice of Privacy Practices

Covered entities must provide patients with a Notice of Privacy Practices (NPP) describing how PHI may be used and disclosed, the entity's legal duties, and the patient's rights, along with complaint procedures and a contact point. Direct treatment providers must give the NPP at the first service encounter, make a good-faith effort to obtain written acknowledgment of receipt, post it prominently on site, and publish it on their website. Health plans distribute it at enrollment and remind members every three years. The NPP must be written in plain language and updated when material practices change. HHS publishes model notices — customize one rather than drafting from scratch.

De-Identification

The Privacy Rule allows use of de-identified health information without restriction — de-identified data is not PHI, which makes de-identification the legal foundation of most healthcare analytics, benchmarking, and AI training.

There are exactly two valid methods:

Safe Harbor — remove all 18 specified identifiers (names, geographic units smaller than a state, all date elements except year, ages over 89, phone, email, SSN, MRN, account numbers, device and vehicle identifiers, URLs, IP addresses, biometrics, full-face photos, and any other unique identifier) and have no actual knowledge the remaining data could identify individuals. It is mechanical and defensible, but destroys analytic value in dates and geography.
Expert Determination — a person with appropriate statistical expertise applies accepted methods, determines the re-identification risk is very small, and documents the analysis. This preserves more utility (fuzzy dates, broader geography) at the cost of an expert engagement and periodic re-review.

Two adjacent concepts founders confuse with de-identification: a limited data set (dates and some geography retained, usable for research, operations, and public health only under a data use agreement — it is still PHI), and "anonymized" or "hashed" data, which has no HIPAA meaning. Hashing an email address does not de-identify anything; a hashed identifier is still a unique identifier under Safe Harbor.

Privacy Rule Compliance Checklist

Frequently Asked Questions

Does the Privacy Rule apply to business associates?

Partially but meaningfully. Business associates may use and disclose PHI only as their BAA and the rule permit, must apply minimum necessary, must support patient access and accounting obligations, and face direct liability for using PHI beyond their agreement. A vendor that mines customer PHI for its own product analytics without de-identifying it first is violating the Privacy Rule, not just its contract.

Can we use patient data to train machine learning models?

Identifiable PHI can generally be used internally for healthcare operations purposes (like improving quality of care for your covered entity customers, if your BAA permits), but building a general commercial model is not "operations." The clean paths are patient authorization or — far more practical at scale — Expert Determination de-identification before training. Get the data use analyzed before the model exists, not after.

Is a patient's name alone PHI?

A name in isolation is not health information. A name in a context that implies health status — on an oncology clinic's mailing list, in a patient portal database — is PHI, because the association with care is itself health information. Context, not the field type, determines PHI status.

What are the penalties for Privacy Rule violations?

The same tiered civil penalty structure described in What Is HIPAA — roughly $140 to over $71,000 per violation depending on culpability, with annual caps into the millions for willful neglect — plus criminal exposure for knowing misuse. Right of access failures have produced a steady stream of settlements, and impermissible disclosures (including via web tracking technologies sending patient data to advertisers) are an active OCR enforcement focus.

Can staff look up their own or a family member's record?

Employees have the same right of access to their own records as any patient — through the formal process, not by self-lookup in production systems. Accessing a family member's, coworker's, or celebrity's record without a job-based need is snooping: a Privacy Rule violation, a fireable offense under a required sanction policy, and occasionally a criminal prosecution. Audit-log monitoring for this pattern is expected.

Do website analytics and ad pixels violate the Privacy Rule?

They can. OCR and the FTC have both warned that tracking technologies on patient portals, scheduling pages, and symptom-specific pages can transmit PHI (IP address plus health context) to third parties without authorization or a BAA. Audit every tag on any page where users are identifiable and health-related, and remove or gate anything without a BAA.

In the next lesson, we will cover breach notification requirements.

Privacy programs run on policies, training, and evidence — exactly what compliance tooling automates well. AuditXYZ helps you compare compliance automation platforms and auditors so you can build and prove your HIPAA privacy program efficiently.

HIPAA Privacy Rule: Governing PHI Use and Disclosure