A hospital receptionist in Texas printed out a patient's medication list and handed it to the patient's ex-spouse. No malice — she thought she was being helpful. That single sheet of paper triggered an OCR investigation, a corrective action plan, and a six-figure settlement. If you're asking what is the Privacy Rule for HIPAA, understand this: the rule exists precisely because well-meaning people make devastating mistakes with protected health information every single day.

I've spent years helping covered entities — from solo dental practices to multi-state health systems — understand and implement the Privacy Rule. What surprises most people is how broad it actually is and how quickly a minor lapse turns into a federal enforcement action.

What Is the Privacy Rule for HIPAA, Exactly?

The HIPAA Privacy Rule is a federal regulation published by the U.S. Department of Health and Human Services (HHS). It establishes national standards for the protection of individually identifiable health information, known as protected health information (PHI).

The rule governs how covered entities — health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically — use, disclose, and safeguard PHI. It also extends to their business associates.

You can read the full regulatory text at HHS.gov's Privacy Rule page. But let me translate that legalese into what it actually means for your daily operations.

The Core Principle You Need to Memorize

The Privacy Rule operates on a concept called the "minimum necessary" standard. When your staff uses or discloses PHI, they should access only the minimum amount of information needed to accomplish the task. Not the full chart. Not the entire claims history. Just what's required.

This single principle trips up more organizations than any other part of the rule. I've seen billing departments pull entire patient records when they only needed a diagnosis code. I've seen nurses share full medical histories during shift handoffs when a focused summary would suffice.

Who Must Follow the Privacy Rule?

Three categories of organizations qualify as covered entities under HIPAA:

  • Healthcare providers — doctors, clinics, hospitals, pharmacies, dentists, psychologists, and any provider who transmits health information electronically in connection with a HIPAA-covered transaction.
  • Health plans — health insurance companies, HMOs, employer-sponsored health plans, Medicare, and Medicaid.
  • Healthcare clearinghouses — entities that process nonstandard health information into standard formats.

But here's the part most people overlook: business associates are also bound by the Privacy Rule. That IT vendor who manages your EHR? The shredding company that handles your paper records? The billing service you outsource to? They all need a signed Business Associate Agreement (BAA), and they all face direct liability under the HITECH Act.

The Six Rights Your Patients Actually Have

The Privacy Rule isn't just about restricting disclosures. It grants patients specific, enforceable rights over their own health information. Your organization must honor every one of them.

1. Right to Access Their Records

Patients can request copies of their PHI. You must provide it within 30 days. OCR has made this a top enforcement priority — they launched a Right of Access Initiative that has produced over 45 enforcement actions and counting.

2. Right to Request Amendments

If a patient believes their record contains an error, they can request a correction. You can deny the request, but you must explain why in writing.

3. Right to an Accounting of Disclosures

Patients can ask for a log of who received their PHI and why. This doesn't include disclosures for treatment, payment, or healthcare operations — but it does include everything else.

4. Right to Request Restrictions

A patient can ask you to limit how you use or share their PHI. You're generally not required to agree, with one exception: if a patient pays out of pocket in full, they can restrict disclosure to their health plan.

5. Right to Confidential Communications

Patients can request that you contact them only at a specific number or address. A domestic violence survivor, for example, might need communications sent to a P.O. box instead of a shared home address.

6. Right to Receive a Notice of Privacy Practices

Your organization must provide a clear, written notice explaining how you use and disclose PHI. This isn't a formality — it's a legal obligation.

When You Can Disclose PHI Without Patient Authorization

The Privacy Rule allows disclosures without patient authorization in specific, limited circumstances. These are called permissible uses and disclosures, and they include:

  • Treatment, payment, and healthcare operations (TPO)
  • Public health activities (disease reporting, FDA-related disclosures)
  • Victims of abuse, neglect, or domestic violence
  • Health oversight activities
  • Judicial and administrative proceedings
  • Law enforcement purposes under specific conditions
  • Averting a serious threat to health or safety
  • Workers' compensation

Outside these categories, you need a valid, written authorization from the patient. Marketing communications and the sale of PHI always require authorization — no exceptions.

The $5.1 Million Lesson From Memorial Healthcare System

If you want to see what happens when the Privacy Rule gets ignored at scale, look at Memorial Healthcare System. In 2017, OCR settled with them for $5.5 million after employees accessed PHI of 115,143 individuals without authorization. The root cause? Inadequate access controls and a failure to regularly review who had access to what.

This wasn't a hacking incident. It was an insider access problem — the kind that festers when organizations treat the Privacy Rule as a box to check instead of an operational discipline.

Contrast that with the enforcement action against Cignet Health of Prince George's County, Maryland, which received a $4.3 million civil money penalty in 2011 — largely because they refused to provide 41 patients access to their own medical records. That's the Right of Access in action.

Privacy Rule vs. Security Rule: Know the Difference

People conflate these constantly. Here's the distinction:

  • The Privacy Rule governs who can access PHI, under what circumstances, and what rights patients have. It applies to PHI in any form — electronic, paper, or oral.
  • The Security Rule governs how you protect ePHI (electronic PHI) specifically. It requires administrative, physical, and technical safeguards.

Think of the Privacy Rule as the "who and when." The Security Rule is the "how." You need both. One without the other leaves a gap that OCR will find.

What Happens When You Violate the Privacy Rule

OCR enforces the Privacy Rule through investigations, corrective action plans, and civil monetary penalties. The penalty tiers range from $137 per violation (for unknowing violations) up to roughly $2.1 million per violation category per year.

But the financial penalty is rarely the worst part. I've watched organizations endure two-year corrective action plans that consume staff hours, mandate external monitoring, and grind operations to a halt. The reputational damage alone has shuttered small practices.

And under the HIPAA Breach Notification Rule, if a Privacy Rule violation results in a breach of unsecured PHI affecting 500 or more individuals, you must notify HHS, affected patients, and the media. That's the kind of headline no marketing budget can undo.

How to Actually Comply: Five Things That Work

Train Everyone — Not Just Clinicians

The Privacy Rule applies to your entire workforce: employees, volunteers, trainees, and anyone under your direct control. Front desk staff, janitorial crews, IT personnel — they all handle or encounter PHI. HHS requires workforce training as a Privacy Rule administrative requirement. If you haven't invested in structured workforce training, explore the HIPAA training catalog at HIPAACertify to get your full team covered.

Conduct a PHI Inventory

You can't protect what you haven't mapped. Document every location where PHI lives — paper files, EHR systems, email, fax machines, portable devices, even whiteboards in nurse stations.

Implement Role-Based Access Controls

The minimum necessary standard demands it. Your billing staff shouldn't see psychotherapy notes. Your front desk shouldn't access surgical records. Configure your systems to enforce this automatically.

Audit Regularly

Memorial Healthcare's $5.5 million settlement happened because nobody checked access logs. Run quarterly audits. Look for patterns — repeated access to records of VIP patients, celebrity patients, or co-workers.

Update Your Notice of Privacy Practices

When was the last time you revised yours? If it still references pre-2013 regulations, you're overdue. Every patient interaction starts with this document. Make it current, clear, and accurate.

Your Next Step

Understanding what is the Privacy Rule for HIPAA is the foundation — but knowledge without action is just liability waiting to happen. If your workforce training is outdated or incomplete, your organization is exposed. Start with a comprehensive training program through the HIPAACertify training catalog and build compliance into your daily operations, not just your policy binder.

The Privacy Rule isn't going away. OCR's enforcement budget keeps growing. The question isn't whether your organization will face scrutiny — it's whether you'll be ready when it arrives.