The HIPAA Privacy Rule is the federal regulation that gives you rights over your medical records and limits when doctors, hospitals, health plans, and their contractors can share your health information without your permission. Issued by the U.S. Department of Health and Human Services to carry out the Health Insurance Portability and Accountability Act of 1996, it sets a national baseline that every covered provider and insurer in the country must follow.1HHS.gov. Summary of the HIPAA Privacy Rule The point of the rule is practical: your information still has to move between a treating doctor, a specialist, and your insurer for care to happen, but you get to see what is in your file, ask for corrections, and control most uses outside of that core.
Who Has to Follow the Rule
The Privacy Rule binds three kinds of organizations, which the regulation calls covered entities:2eCFR. 45 CFR 160.103 – Definitions healthcare providers who transmit health information electronically for billing or other standard transactions, health plans (including private insurers, employer group plans, Medicare, and Medicaid), and healthcare clearinghouses that translate billing data between providers and insurers.
It also reaches the contractors these entities hire to handle your data. IT vendors, billing companies, cloud storage providers, shredding services, and outside law firms are treated as “business associates,” and a covered entity has to have a written contract in place before sharing your information with them.3U.S. Department of Health and Human Services (HHS). Business Associates That contract has to require the associate to safeguard the information, limit how it is used, and report unauthorized disclosures.4eCFR. 45 CFR 164.504 – Uses and Disclosures: Organizational Requirements
One important boundary: your employment records are not covered, even when they contain health information. If your employer keeps medical data about you in a personnel file, HIPAA does not apply to it.5U.S. Department of Health and Human Services (HHS). Employers and Health Information in the Workplace Other laws might, but not this one.
What Information the Rule Protects
The rule protects what it calls protected health information, or PHI. That is any individually identifiable information about your health, the care you have received, or how it was paid for, when a covered entity creates or receives it.2eCFR. 45 CFR 160.103 – Definitions Electronic records, paper charts, and spoken conversations between providers are all included. The regulation identifies 18 types of identifiers, from names and Social Security numbers to full-face photographs, birth dates, and biometric data, that can tie information back to you.6U.S. Department of Health and Human Services. Guidance Regarding Methods for De-identification of Protected Health Information
Once those identifying details are stripped out under one of two approved methods, the information is no longer PHI and the rule stops applying to it.6U.S. Department of Health and Human Services. Guidance Regarding Methods for De-identification of Protected Health Information That is why a hospital can publish aggregated statistics or share de-identified data with researchers without asking you first.
Your Rights Over Your Health Information
The rule does more than tell providers what they cannot do. It gives you specific rights you can exercise directly.
See and Get a Copy of Your Records
You can inspect and get a copy of nearly all the medical and billing records a covered entity holds about you. The entity has to respond within 30 days, with one 30-day extension allowed if it explains the delay in writing.7eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information You can request paper or electronic copies. Any fee has to be reasonable and cost-based, limited to labor for copying, supplies, and postage.
The same right lets you direct your records to a third-party app or personal health platform. If you ask your provider to send electronic health information to an app you have chosen, the provider generally cannot refuse as long as it can produce the data in the format the app uses.8U.S. Department of Health and Human Services (HHS). The Access Right, Health Apps, and APIs Once the data reaches the app, the provider is not responsible for how the app handles it.
Ask for a Correction
If something in your record is wrong or incomplete, you can ask the covered entity to fix it. The entity can deny the request in limited situations, such as when it did not create the record or when it believes the record is already accurate. If it denies your request, you can file a written statement of disagreement, and that statement has to go into your permanent file.
Get an Accounting of Disclosures
You can request a log of the times your information was shared for purposes other than treatment, payment, or healthcare operations, going back six years.9eCFR. 45 CFR 164.528 – Accounting of Disclosures of Protected Health Information The accounting has to identify who received the information, when, and why.
Restrict Certain Disclosures
You can ask a covered entity to restrict how it uses or shares your information for treatment, payment, or operations. The entity usually does not have to agree. There is one situation where it does: if you paid for a service entirely out of pocket, the provider must honor a request to keep that service off any report to your health plan, unless the disclosure is required by law.10eCFR. 45 CFR 164.522 – Rights to Request Privacy Protection for Protected Health Information That is useful when you want a sensitive visit to stay off an insurance explanation of benefits.
Choose How You Are Contacted
You can ask that communications reach you through a different channel or at a different address, such as calls to your work phone instead of home, or statements mailed to a P.O. box. Health plans have to accommodate the request when you say standard communications could endanger you, and they cannot ask you to justify that concern.1HHS.gov. Summary of the HIPAA Privacy Rule
Receive a Notice of Privacy Practices
Every covered entity has to give you a written notice explaining how it uses and shares your information, what your rights are, and how to complain. The notice has to use plain language and carry the header: “THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.”11eCFR. 45 CFR 164.520 – Notice of Privacy Practices for Protected Health Information Providers with a direct treatment relationship hand it to you at your first visit; health plans provide it at enrollment.
Rights for Representatives and Minors
A personal representative, such as a legal guardian or someone holding power of attorney, can exercise these rights for you. A parent generally counts as a minor child’s personal representative and can access the child’s records, unless state law says otherwise.12HHS.gov. Personal Representatives and Minors Once a child reaches the age of majority, they take over all Privacy Rule rights, including over records created when they were a minor.
When Your Data Can Be Shared Without Asking You
Covered entities can use and disclose your PHI without your permission for three core purposes: treatment, payment, and healthcare operations. Treatment covers coordinating and delivering care across providers. Payment covers billing, claims processing, and coverage decisions. Operations covers the administrative work of running a practice, including quality improvement, staff training, and fraud detection.1HHS.gov. Summary of the HIPAA Privacy Rule
Beyond that, the rule allows disclosure without authorization for a defined list of public interest activities, including reporting communicable diseases to public health authorities, reporting suspected child abuse or neglect, responding to court orders or law enforcement requests that meet specific criteria, and reporting certain injuries required by law.13eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
Even when a disclosure is allowed, the minimum necessary standard requires reasonable efforts to limit what is shared to only what the specific purpose needs. If a billing department only needs the diagnosis code and date of service, that is all it should get. The standard has exceptions for treatment sharing between providers, disclosures you authorize yourself, and disclosures required by law.
Stronger Protection for Therapy Notes and Marketing
Psychotherapy notes, the therapist’s personal session notes kept separate from the rest of the chart, cannot be disclosed for almost any purpose without your written authorization. The narrow exceptions cover the therapist’s own use for your treatment, a supervised training program, and the provider’s defense in a legal action you brought.14eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required A provider cannot make your treatment conditional on signing that authorization.
Marketing communications also require your written authorization, with only two exceptions: face-to-face conversations and small promotional gifts of nominal value. If a third party is paying to send you the communication, the authorization has to disclose that arrangement.14eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
If the Rule Is Broken
You Have to Be Told About Breaches
When a covered entity discovers that unsecured PHI has been accessed or disclosed in violation of the rule, it has to notify every affected individual in writing within 60 calendar days of discovering the breach.15eCFR. 45 CFR 164.404 – Notification to Individuals The clock starts on the first day the entity knew, or reasonably should have known, that the breach happened. If 500 or more people are affected, the entity also has to notify HHS at the same time and alert prominent media outlets in the area.16eCFR. Subpart D – Notification in the Case of Breach of Unsecured Protected Health Information Smaller breaches get logged and reported to HHS in an annual batch. If the entity cannot reach you because your contact information is out of date, it has to post a notice on its website for at least 90 days and keep a toll-free number active for the same period.
How to File a Complaint
If you believe a covered entity or a business associate has violated your privacy rights, you can file a complaint with the HHS Office for Civil Rights. The complaint has to be filed within 180 days of when you learned about the violation, though OCR can extend that deadline for good cause.17HHS.gov. How to File a Health Information Privacy or Security Complaint You can file online through the OCR Complaint Portal, by email at OCRComplaint@hhs.gov, or by mailing a written complaint to the HHS Office for Civil Rights in Washington, D.C.18HHS.gov. How to File a Civil Rights Complaint Filing is free, and you do not need a lawyer. OCR investigates, and its findings can lead to voluntary compliance agreements, corrective action plans, or referrals for civil or criminal penalties.
Civil penalties follow a four-tier structure keyed to how aware the violator was and whether the problem was fixed, with amounts adjusted annually for inflation and a per-violation ceiling that reaches into the millions.19Federal Register. Annual Civil Monetary Penalties Inflation Adjustment Because a single breach can involve thousands of individual violations, settlements for systemic failures routinely run into seven figures. Criminal penalties apply when someone knowingly obtains or discloses PHI in violation of the rule, and the maximums increase when the violation involves false pretenses or an intent to sell health data or use it for commercial gain or malicious harm.20Office of the Law Revision Counsel. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
State Law Can Give You More
The Privacy Rule is a floor, not a ceiling. When a state law gives you stronger privacy protection or greater rights over your health data, that state law survives and covered entities have to follow both. A state law counts as more stringent if it limits disclosures the federal rule would allow or grants access rights the federal rule does not.21HHS.gov. Preemption of State Law HIPAA only overrides a state law when following both at once is genuinely impossible or when the state rule blocks HIPAA’s core administrative goals.
In practice, this means your actual protections may be broader than the federal baseline described here. States handle mental health records, substance use treatment data, genetic information, and reproductive health records very differently. If you are dealing with a sensitive record, check whether your state adds anything on top before you rely on the federal rule alone.