What the HIPAA Privacy Rule Does: Sharing, Rights, Breaches

The HIPAA Privacy Rule is a federal regulation, issued by the U.S. Department of Health and Human Services, that controls how healthcare providers, health plans, and their partners use and share your health information. It gives you the right to see and correct your records, learn who has received them, and limit certain uses of your data. The protections apply whether your information sits in an electronic system, a paper chart, or a spoken conversation.

Who Has to Follow It

The rule binds three categories of organizations, called covered entities. Health plans are the first group: insurance companies, HMOs, employer-sponsored group health plans, Medicare, and Medicaid. Healthcare clearinghouses, which translate health data between standard and nonstandard electronic formats, are the second. Healthcare providers who transmit health information electronically for transactions like billing or insurance claims are the third, and that group is broad: doctors, hospitals, clinics, psychologists, dentists, nursing homes, and pharmacies among others.¹

The rule also reaches business associates: companies and individuals that handle protected health information on behalf of a covered entity. Billing services, law firms, data analysts, cloud storage providers, and accountants typically fall into this category. Before sharing your data, the covered entity has to put a written contract in place spelling out what the associate can and cannot do with the information and requiring it to use appropriate safeguards.²

One boundary worth naming: the rule does not cover every organization that holds health information. Life insurers, most employers acting as employers, many wellness apps, and companies you share health data with directly are generally outside its scope unless they meet one of the definitions above.

What Information Is Protected

Protected health information, or PHI, is any individually identifiable health data a covered entity or business associate creates or receives. It includes information about your past, present, or future physical or mental health, the care you have received, and the payment for that care.¹

Health data becomes “individually identifiable” when it is linked to any of 18 specific identifiers listed in the rule. Those include:

Names
Geographic details smaller than a state, such as street address, city, county, or ZIP code
Dates tied to you (birth date, admission, discharge); year alone is permitted, except for ages over 89
Phone numbers, fax numbers, and email addresses
Social Security numbers, medical record numbers, and health plan beneficiary numbers
Full-face photographs and comparable images
Any other unique identifier that could reasonably be used to identify you

If even one identifier is attached, the data qualifies as PHI and gets the full protection of the rule.³

Data that has been stripped of all 18 identifiers is considered de-identified and is no longer covered. Organizations can reach that status either by removing every identifier (the Safe Harbor method) or by hiring a qualified expert to certify in writing that the risk of re-identification is very small.³

When Your Information Can Be Shared Without Your Permission

Treatment, Payment, and Operations

A covered entity does not need your written authorization to use or share your PHI for three core functions. Treatment covers providing and coordinating your care, including a doctor sending your records to a specialist. Payment covers verifying insurance, submitting claims, and collecting what you owe. Healthcare operations include quality checks, staff training, audits, and fraud detection.⁴ An entity can ask for your consent, but it isn’t required to.⁵

Public Interest and Legal Exceptions

The rule also permits sharing without your authorization in situations tied to public safety or legal process:

When a federal, state, or local law requires the disclosure
Reporting communicable diseases, adverse drug reactions, or product defects to public health authorities
Reporting suspected child abuse, elder abuse, or domestic violence to authorized agencies
Responding to court orders, warrants, or law enforcement requests to identify suspects or locate missing persons
Producing records in response to a subpoena or discovery request
Sharing data with organ procurement organizations
Disclosing information for workers’ compensation claims

Even when one of these exceptions applies, the entity is bound by the “minimum necessary” standard: it can share only what is needed to accomplish the purpose.⁶ A billing clerk verifying a charge should not see a full psychiatric history. The minimum necessary rule does not apply to disclosures made for treatment or to the individual who is the subject of the information.⁷

When Written Authorization Is Required

A covered entity generally must get your written authorization before using your PHI for marketing. Two narrow exceptions exist: face-to-face conversations (a doctor mentioning a relevant service in your visit) and promotional items of nominal value like a branded pen. If a third party is paying the entity to send the marketing, the authorization form has to say so.⁸

Selling your PHI (disclosing it in exchange for payment) also requires your written authorization. Limited exceptions apply for public health, research at a cost-based fee, treatment, payment, business-associate services, and disclosures required by law.⁹

Your Rights Over Your Records

The rule gives you enforceable rights that a covered entity has to explain in its notice of privacy practices.¹⁰

Access and Copies

You can inspect and get a copy of the PHI a covered entity keeps about you in its designated record set. The entity has 30 days to respond, and it can take a one-time 30-day extension only if it writes to you explaining the delay and the new expected date.¹¹ If the records are electronic and you ask for an electronic copy, the entity has to provide it in the format you request when that format is readily producible; otherwise, you and the entity agree on a readable alternative. A reasonable, cost-based fee for copying and mailing is allowed. Access can be denied for psychotherapy notes and for information compiled for legal proceedings.

Amendments

If your record contains an error, you can ask the entity to correct it. The entity can refuse in limited situations, including when it determines the existing record is accurate and complete or when it didn’t create the information.¹² If your request is denied, you can submit a written disagreement that becomes part of the record.

Accounting of Disclosures

You can request a list of who has received your PHI over the past six years. The accounting covers disclosures made outside of routine treatment, payment, and operations, and it must include the date, recipient, description of the information, and purpose. Disclosures you authorized, incidental disclosures, and certain national-security or law-enforcement disclosures are excluded.¹³

Restrictions and Confidential Communications

You can ask an entity to limit how it uses or shares your PHI for treatment, payment, or operations. The entity generally doesn’t have to agree, with one important exception: if you pay for a service entirely out of pocket, the provider must honor your request to withhold that information from your health plan.¹⁴

You can also ask to receive communications through alternative means, such as appointment reminders sent to your work email or calls to a specific phone number. Healthcare providers have to accommodate reasonable requests without asking why.¹⁴

If Your Information Is Breached

When a covered entity discovers that unsecured PHI has been improperly accessed, used, or disclosed, it has to notify every affected individual without unreasonable delay and no later than 60 calendar days after discovery. The notice has to describe what happened, what types of information were involved, what you can do to protect yourself, and what the entity is doing to investigate and prevent further breaches.¹⁵

A breach affecting more than 500 residents of a single state or jurisdiction also triggers notification of prominent local media within the same 60-day window, plus a separate notice to HHS. Smaller breaches can be logged and reported to HHS within 60 days after the end of the calendar year.¹⁶

How to File a Complaint

If you think a covered entity or business associate violated your privacy rights, you can file a complaint with the HHS Office for Civil Rights through its online Complaint Portal. The deadline is 180 days from when you learned about the alleged violation, though OCR can extend it for good cause.¹⁷

HIPAA does not give you a private right of action. You cannot sue in federal court to enforce the Privacy Rule directly; only HHS, through OCR, has that authority. State privacy or negligence laws may give you a claim if a provider’s improper disclosure caused you harm, but any lawsuit would rest on state law rather than HIPAA itself.

Penalties the Government Can Impose

OCR enforces the Privacy Rule with civil monetary penalties tiered by the violator’s level of awareness. The 2025 figures, adjusted annually for inflation, are:

Did not know: $145 to $73,011 per violation, annual cap of $2,190,294
Reasonable cause (not willful neglect): the same range, with penalties toward the upper end
Willful neglect, corrected within 30 days: minimum of $73,011 per violation
Willful neglect, not corrected: $73,011 to $2,190,294 per violation, annual cap of $2,190,294¹⁸

Individuals who knowingly obtain or disclose PHI in violation of the law can also face federal criminal charges brought by the Department of Justice. A knowing violation carries up to $50,000 in fines and one year in prison. A violation under false pretenses carries up to $100,000 and five years. A violation with intent to sell the data or cause harm carries up to $250,000 and ten years.¹⁹

1
eCFR. 45 CFR 160.103 – Definitions
2
eCFR. 45 CFR 164.504 – Uses and Disclosures: Organizational Requirements
3
U.S. Department of Health & Human Services. Guidance Regarding Methods for De-identification of PHI
4
eCFR. 45 CFR 164.501 – Definitions
5
eCFR. 45 CFR 164.506 – Uses and Disclosures to Carry Out Treatment, Payment, or Health Care Operations
6
HHS.gov. Minimum Necessary Requirement
7
eCFR. 45 CFR 164.512 – Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required
8
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
9
eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information: General Rules
10
eCFR. 45 CFR 164.520 – Notice of Privacy Practices for Protected Health Information
11
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
12
eCFR. 45 CFR 164.526 – Amendment of Protected Health Information
13
eCFR. 45 CFR 164.528 – Accounting of Disclosures of Protected Health Information
14
eCFR. 45 CFR 164.522 – Rights to Request Privacy Protection for Protected Health Information
15
eCFR. 45 CFR 164.404 – Notification to Individuals
16
eCFR. 45 CFR Part 164, Subpart D – Notification in the Case of Breach
17
HHS.gov. How to File a Health Information Privacy or Security Complaint
18
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
19
Office of the Law Revision Counsel. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information