A hospital receptionist in Texas accidentally faxed 277 patient records to a local newspaper instead of the pharmacy down the street. That single misdial triggered a federal investigation, a six-figure settlement, and a lesson that every covered entity should have already learned. The thing that made it a federal matter — and not just an embarrassing mistake — was the HIPAA Privacy Rule. So what is the Privacy Rule responsible for protecting, exactly? It safeguards every piece of individually identifiable health information that a covered entity or business associate creates, receives, stores, or transmits. And the scope of that protection is far wider than most people realize.
What Is the Privacy Rule Responsible for Protecting? A Direct Answer
The HIPAA Privacy Rule protects protected health information (PHI) — any information about a patient's health condition, the healthcare services they received, or how those services were paid for, when that information can be linked back to an individual. This includes names, dates of birth, Social Security numbers, medical record numbers, health plan beneficiary numbers, and even photographs.
PHI doesn't have to be digital. It can be a printed lab result sitting on a desk, a verbal conversation in a hallway, or an electronic health record in a cloud-based EHR system. If it identifies a person and relates to their health or healthcare, the Privacy Rule covers it.
The rule is codified at 45 CFR Part 164, Subpart E, and it applies to covered entities — health plans, healthcare clearinghouses, and healthcare providers who transmit any health information electronically — along with their business associates.
The 18 Identifiers That Make Health Data "Protected"
I've walked into compliance audits where the privacy officer couldn't name more than five of the 18 HIPAA identifiers. That's a problem. HHS specifically lists 18 categories of identifiers that, when connected to health information, transform ordinary data into PHI:
- Names
- Geographic data smaller than a state
- Dates (except year) related to an individual — birth, admission, discharge, death
- Phone numbers
- Fax numbers
- Email addresses
- Social Security numbers
- Medical record numbers
- Health plan beneficiary numbers
- Account numbers
- Certificate/license numbers
- Vehicle identifiers and serial numbers
- Device identifiers and serial numbers
- Web URLs
- IP addresses
- Biometric identifiers (fingerprints, voiceprints)
- Full-face photographs and comparable images
- Any other unique identifying number, characteristic, or code
Strip all 18 from a dataset and you have de-identified information. The Privacy Rule no longer applies. But miss even one — a ZIP code, a date of birth — and you're still holding PHI, and you're still bound by every requirement the rule imposes.
It's Not Just About Data — It's About Patient Rights
Here's the part that surprises most organizations: what is the Privacy Rule responsible for protecting extends far beyond locking down files. The rule creates an entire framework of patient rights. These aren't suggestions. They're enforceable mandates.
The Right to Access Their Own Records
Patients can request copies of their PHI, and covered entities must respond within 30 days. In 2023, OCR settled with Optum Medical Care for $160,000 after the organization failed to provide a patient timely access to their records. OCR has made right-of-access cases a top enforcement priority.
The Right to Request Corrections
If a patient spots an error in their medical record, they have the right to request an amendment. Your organization must act on it or provide a written denial with a clear reason.
The Right to an Accounting of Disclosures
Patients can ask who has seen their PHI and why. Most organizations I've audited have no system in place to track this. That's a liability waiting to detonate.
The Right to Request Restrictions
A patient can ask you to limit how you use or share their PHI. You don't always have to agree — but if a patient pays out of pocket in full and asks you not to share information with their health plan, you must comply. No exceptions.
How Covered Entities Must Protect PHI Under the Privacy Rule
The Privacy Rule doesn't just say "protect PHI" and walk away. It lays out specific obligations that every covered entity and business associate must follow.
The Minimum Necessary Standard
When using or disclosing PHI, your workforce should access only the minimum amount of information needed to do the job. A billing clerk doesn't need to read psychiatric notes. A front-desk scheduler doesn't need to see lab results. I've seen organizations grant blanket access to entire EHR systems. That's a minimum necessary violation sitting in plain sight.
Notice of Privacy Practices
Every covered entity must give patients a clear, written explanation of how their PHI will be used and what their rights are. This Notice of Privacy Practices (NPP) must be provided at the first point of service. It's not a formality — it's a regulatory requirement.
Workforce Training
The Privacy Rule requires that every member of your workforce — including volunteers and trainees — receives training on your PHI policies and procedures. Not once. On an ongoing basis. If you haven't structured this training properly, our HIPAA training catalog gives you a turnkey way to get every role in your organization covered.
Business Associate Agreements
If you share PHI with a vendor — a cloud hosting company, a billing service, a shredding company — you need a signed Business Associate Agreement (BAA). Without one, you've violated the Privacy Rule before any breach even occurs.
The $5.1 Million Mistake: When Privacy Rule Protections Fail
In 2017, Memorial Healthcare System paid $5.5 million to settle Privacy Rule violations after employees at an affiliated physician practice accessed the ePHI of 115,143 individuals without authorization. The PHI had been accessed over the course of a year, and Memorial didn't have adequate audit controls or access restrictions in place.
That wasn't a sophisticated cyberattack. It was an insider access problem — the exact kind the Privacy Rule's minimum necessary and workforce training requirements are designed to prevent. I've talked to compliance officers at health systems who say they assumed their EHR vendor handled access controls. The Privacy Rule doesn't care about your assumptions. It cares about your documentation and your outcomes.
Where the Privacy Rule Ends and the Security Rule Begins
People conflate these two constantly, so let me draw the line clearly. The Privacy Rule governs the use and disclosure of PHI in all forms — paper, oral, and electronic. The Security Rule focuses specifically on the technical, administrative, and physical safeguards required to protect ePHI.
Think of it this way: the Privacy Rule says who can see PHI and under what circumstances. The Security Rule says how to lock the digital door. You need both. Failing at either gets you on OCR's enforcement page.
Permitted Uses and Disclosures — What the Privacy Rule Allows
The Privacy Rule doesn't lock PHI in a vault and throw away the key. It permits — and sometimes requires — disclosure in specific situations:
- Treatment, Payment, and Healthcare Operations (TPO): No patient authorization is needed to share PHI for these core functions.
- Public Health Activities: Reporting communicable diseases, adverse drug reactions, or vital statistics.
- Law Enforcement: Limited disclosures for court orders, subpoenas, or reporting certain injuries.
- Research: Only with an IRB or privacy board waiver, or with proper de-identification.
- When Required by Law: Workers' compensation, FDA reporting, abuse reporting.
Outside of these categories, you need valid written authorization from the patient. Marketing, most fundraising communications, and the sale of PHI all require authorization — no shortcuts.
Your Staff Is the Biggest Risk to PHI — Train Them Like It
In my experience, nine out of ten Privacy Rule violations trace back to a workforce member who either didn't know the rules or didn't take them seriously. A nurse sharing a patient story on social media. A receptionist confirming a patient's appointment to an unauthorized caller. A physician texting PHI on a personal phone.
The Privacy Rule places the training burden squarely on the covered entity. You can't blame the employee if you never trained them. And "we covered it at orientation three years ago" doesn't meet the ongoing training requirement. Build a structured, role-based training program that you can document and prove. If you need a starting point, explore the HIPAA compliance courses in our training catalog to build a program that actually holds up under OCR scrutiny.
What Happens When You Violate the Privacy Rule
OCR enforces the Privacy Rule with a tiered penalty structure that scales based on your level of culpability:
- Tier 1 — Did Not Know: $137 to $68,928 per violation
- Tier 2 — Reasonable Cause: $1,379 to $68,928 per violation
- Tier 3 — Willful Neglect, Corrected: $13,785 to $68,928 per violation
- Tier 4 — Willful Neglect, Not Corrected: $68,928 per violation, up to $2,067,813 per year for identical provisions
These numbers are adjusted annually for inflation. Beyond financial penalties, OCR can impose corrective action plans that dictate your internal operations for years. And if HHS refers a case for criminal prosecution, individuals — not just organizations — can face prison time.
Make the Privacy Rule Work for You, Not Against You
Understanding what is the Privacy Rule responsible for protecting is step one. Step two is operationalizing that knowledge across every department, every vendor relationship, and every member of your workforce. PHI isn't just data. It's a person's most sensitive information — and the federal government treats it that way.
Start with a gap analysis. Map where PHI lives in your organization. Train your people with structured HIPAA training that's documented and current. And audit your business associate agreements before OCR does it for you. The Privacy Rule isn't going anywhere — and neither are the penalties for ignoring it.