HIPAA Privacy Rule: What It Requires in 2026

HIPAA Privacy Rule: What It Requires in 2026

The HIPAA Privacy Rule decides who may see a patient's health information, for what purpose, and what patients can demand in return. Most covered entities have had to comply since April 14, 2003.

It applies to health plans, health care clearinghouses and health care providers that conduct certain transactions electronically. Through contracts and direct liability, it reaches their vendors too. Three things have moved in the last two years. A court struck down most of the 2024 reproductive health rule. The penalty amounts were adjusted again in January 2026. And OCR's right of access count reached 55 in August 2026.

TL;DR

• The Privacy Rule sits at 45 CFR Part 160 and Subparts A and E of Part 164 (HHS). Business associates are directly liable for parts of it.
• It protects health information "in any form or media, whether electronic, paper, or oral" (HHS summary). The Security Rule, by contrast, covers only electronic information.
• A covered entity must act on a records request within 30 days, with one 30-day extension (45 CFR 164.524). OCR has brought 55 Right of Access enforcement actions.
• Most of the 2024 reproductive health care privacy rule was vacated on June 18, 2025. Only its Notice of Privacy Practices changes survived, minus three items, with compliance due by February 16, 2026.
• Civil penalties now run from $145 to $2,190,294 per violation, with a regulatory calendar-year cap of $2,190,294 (45 CFR 102.3). Under a 2019 enforcement policy, HHS applies lower annual caps to the three less serious tiers.

Who this is for

Privacy officers at clinics, hospitals and health plans, and founders of health tech companies that handle patient data. For a full HIPAA program, start with our HIPAA compliance guide.

What the HIPAA Privacy Rule Is

HHS describes the HIPAA Privacy Rule as setting "national standards to protect individuals' medical records and other individually identifiable health information (collectively defined as 'protected health information')" (HHS, The HIPAA Privacy Rule). It was the first federal standard of its kind. The Office for Civil Rights (OCR) at HHS enforces it.

The rule comes from the Health Insurance Portability and Accountability Act of 1996, enacted on August 21, 1996. Its final modifications were published on August 14, 2002 (HHS summary). The compliance dates are in 45 CFR 164.534:

• Health care providers, health care clearinghouses and health plans other than small health plans: April 14, 2003.
• Small health plans: April 14, 2004. HHS defines a small health plan as one "with annual receipts of not more than $5 million" (HHS summary).

Privacy Rule vs Security Rule

The difference decides which rule governs which records.

HHS states that the Security Rule "does not apply to PHI that is maintained or transmitted on paper or verbally" (HHS, Security Rule summary). See our guide to HIPAA Security Rule safeguards.

Who Must Comply With the HIPAA Privacy Rule

Covered entities

The regulation lists three kinds of covered entity in 45 CFR 160.103: "(1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter."

Two points from HHS's summary catch small practices out (HHS summary):

• Size does not matter: "Every health care provider, regardless of size, who electronically transmits health information in connection with certain transactions, is a covered entity."
• Outsourcing billing does not take you out: the rule covers a provider "whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf."

Some insurers are not health plans at all. HHS lists "entities providing only workers' compensation, automobile insurance, and property and casualty insurance."

Business associates

A business associate is a person or organization outside the covered entity's workforce that performs functions or services for it involving individually identifiable health information. Since the HITECH Act of 2009 and OCR's 2013 final rule, business associates are "directly liable for compliance with certain requirements of the HIPAA Rules" (HHS business associate fact sheet).

HHS's list of direct liabilities includes "Impermissible uses and disclosures of PHI" and failure to apply the minimum necessary standard. It also includes failure to comply with the Security Rule, and "Failure to provide breach notification to a covered entity or another business associate." The contract that binds the two sides is the business associate agreement; our HIPAA BAA guide covers its required terms.

What Counts as Protected Health Information

The HIPAA Privacy Rule protects "all 'individually identifiable health information' held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral" (HHS summary). That is protected health information, or PHI.

45 CFR 160.103 excludes some records from PHI:

• education records covered by FERPA;
• employment records a covered entity holds in its role as employer;
• information about a person "who has been deceased for more than 50 years."

The employer exclusion matters in practice. A hospital's own HR file on a nurse is not PHI, even if it contains a doctor's note. The same hospital's patient chart for that nurse is.

De-identified data is outside the rule

"There are no restrictions on the use or disclosure of de-identified health information" (HHS summary). The rule gives two ways to get there, both in 45 CFR 164.514(b):

1. Expert determination. A person with appropriate knowledge of statistical and scientific methods determines that "the risk is very small" that the data could be used to identify someone. That person documents the methods and results.
2. Safe harbor. Remove 18 listed identifiers of the individual and of relatives, employers or household members, and have "no actual knowledge" that what remains could identify the person.

The 18 safe harbor identifiers are: names; geographic units smaller than a state; all date elements except year; telephone numbers; fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate or license numbers; vehicle identifiers; device identifiers; web URLs; IP addresses; biometric identifiers; full-face photographs; and any other unique identifying number, characteristic or code.

Two details trip up data teams. The first three digits of a ZIP code may stay only if the area they cover "contains more than 20,000 people." And all ages over 89 must be grouped into a single "90 or older" category.

When the HIPAA Privacy Rule Allows PHI to Be Used or Disclosed

A covered entity "may not use or disclose protected health information, except either: (1) as the Privacy Rule permits or requires; or (2) as the individual who is the subject of the information (or the individual's personal representative) authorizes in writing" (HHS summary).

Only two disclosures are required

A covered entity must disclose PHI "in only two situations": to individuals who request access to, or an accounting of, their own PHI, and to HHS during a compliance investigation, review or enforcement action. Every other disclosure the rule describes is permitted, not required.

Treatment, payment and health care operations

Under 45 CFR 164.506, "A covered entity may use or disclose protected health information for its own treatment, payment, or health care operations." No patient signature is needed. HHS notes that obtaining consent for these purposes "is optional under the Privacy Rule for all covered entities." State law can still demand more. HIPAA does not override a state privacy law that is "more stringent" than the Privacy Rule (45 CFR 160.203(b)).

The 12 public interest purposes

HHS says the rule permits disclosure "without an individual's authorization or permission, for 12 national priority purposes." They are set out in 45 CFR 164.512:

1. Required by law
2. Public health activities
3. Victims of abuse, neglect or domestic violence
4. Health oversight activities
5. Judicial and administrative proceedings
6. Law enforcement purposes
7. Decedents (coroners, medical examiners, funeral directors)
8. Cadaveric organ, eye or tissue donation
9. Research
10. Serious threat to health or safety
11. Specialized government functions
12. Workers' compensation

Each purpose has its own conditions, so a law enforcement request does not open the whole chart. These disclosures "are permitted, although not required" (HHS summary).

Everything else needs an authorization

Outside those categories, 45 CFR 164.508 requires a valid written authorization. HHS gives three examples that need one: "disclosures to a life insurer for coverage purposes, disclosures to an employer of the results of a pre-employment physical or lab test, or disclosures to a pharmaceutical firm for their own marketing purposes." Authorizations must be in plain language and state what information is disclosed, to whom, when the authorization expires, and the right to revoke it in writing. Psychotherapy notes need an authorization for any use or disclosure, with a short list of exceptions in 45 CFR 164.508(a)(2).

Minimum necessary

For most uses and disclosures, a covered entity or business associate "must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose" (45 CFR 164.502(b)). HHS adds that the whole medical record may not be used or disclosed unless the entity "can specifically justify the whole record as the amount reasonably needed for the purpose."

The standard does not apply to disclosures to a provider for treatment, to the patient, or under an authorization. It also does not apply to disclosures to HHS for enforcement, uses required by law, or uses needed to comply with the other HIPAA Administrative Simplification Rules.

Patient Rights Under the HIPAA Privacy Rule

Each right below comes with a deadline or a firm rule.

The right of access

Under 45 CFR 164.524, the entity "must act on a request for access no later than 30 days after receipt of the request". It "may extend the time for such actions by no more than 30 days" if it tells the patient why. Fees are limited to a "reasonable, cost-based fee". That fee may cover only copying labor, supplies, postage and, if the patient agrees to one, preparing a summary.

A worked example shows how the clock runs. A request received on March 2 must be acted on by April 1. If the entity sends a written reason for the delay and a new date within those 30 days, the limit moves to May 1. There is no second extension.

Handing the job to a records vendor does not move the duty. In March 2025, OCR fined Oregon Health & Science University $200,000 in its 53rd right of access action. OCR's then Acting Director, Anthony Archeval, said: "A covered entity's responsibility to provide timely access continues, even when a covered entity contracts with a business associate to respond to HIPAA right of access requests" (HHS press release).

A real case: the 55th action. On August 27, 2026, OCR announced a settlement with Azul Vision. It is an optometry and ophthalmology provider with 31 clinics in California. A patient "did not receive access to her health information until January 2025, almost two years after her initial request, and after OCR initiated this investigation." Azul Vision paid $50,000 and agreed to a corrective action plan that OCR will monitor for two years. OCR Director Paula M. Stannard said: "It should not be necessary for OCR to initiate a right of access investigation before a covered entity will provide an individual with access to their requested records" (HHS press release). The lesson for any practice: track every access request with a received date and a due date.

Amendment and accounting

A covered entity must act on an amendment request within 60 days, extendable once by 30 days (45 CFR 164.526). The accounting of disclosures covers "the six years prior to the date on which the accounting is requested". It must be provided within 60 days, and the first one in any 12-month period is free (45 CFR 164.528). Disclosures for treatment, payment and operations, to the patient, under an authorization, or in a limited data set do not need to be listed.

Restrictions: the out-of-pocket exception

A covered entity "is under no obligation to agree to requests for restrictions", HHS says. There is one firm exception in 45 CFR 164.522. Say a patient paid in full, out of pocket, for an item or service. If the patient asks, the entity must not disclose it to a health plan for payment or operations. Front-desk and billing teams need to know this rule, because a claim sent by default breaks it.

The Notice of Privacy Practices

Patients have "a right to adequate notice of the uses and disclosures of protected health information" (45 CFR 164.520). The notice must also be available "on any web site it maintains for customer service or benefits information" (HHS summary). The 2024 rule's changes to this notice are the only part of that rule that survived in court, as the next section explains.

The 2024 Reproductive Health Rule and the June 2025 Court Ruling

On April 22, 2024, OCR issued a final rule titled "HIPAA Privacy Rule to Support Reproductive Health Care Privacy" (HHS). It was published on April 26, 2024 at 89 FR 32976 and took effect on June 25, 2024 (Federal Register). Most of it had a compliance date of December 23, 2024. The Notice of Privacy Practices changes had a later date, February 16, 2026. That date lined up with the 42 CFR Part 2 rule on substance use disorder records.

On June 18, 2025, the U.S. District Court for the Northern District of Texas ruled in Purl v. HHS (No. 2:24-cv-00228-Z). Judge Matthew J. Kacsmaryk granted the plaintiffs' motion for summary judgment. The order reads: "The HIPAA Privacy Rule to Support Reproductive Health Care Privacy at 89 Fed. Reg. 32976 is VACATED except its modifications to 45 C.F.R. Section 164.520. But the provisions at 45 C.F.R. Section 164.520(b)(1)(ii)(F), (G), and (H) are VACATED" (court record on govinfo).

HHS describes what is left: "The remaining modifications to the NPP requirements are undisturbed and remain in effect." It adds: "Compliance with the remaining NPP modifications is required by February 16, 2026" (HHS). Those surviving changes include the notice language on substance use disorder records received from Part 2 programs, such as the limits on using them in proceedings against the patient.

HHS's pages, last reviewed June 27, 2025, say "HHS will determine next steps after a thorough review of the court's decision." As of November 2, 2026, no later Federal Register document on this rule has been published.

Proposed Changes That Are Still Pending

Two rulemakings affect HIPAA compliance planning, and neither is final as of November 2, 2026.

The 2021 HIPAA Privacy Rule proposal. It was published on January 21, 2021. Among other changes, it would shorten the access deadline "to no later than 15 calendar days (from the current 30 days) with the opportunity for an extension of no more than 15 calendar days" (Federal Register). It is not dead. On January 14, 2026, HHS announced a Tribal consultation, held February 6, 2026, as the Department "develops modifications to the HIPAA Privacy Rule" (Federal Register). Until a final rule appears, 30 days is the legal limit. A team that already works to a 15-day target would not need to redesign its process if that proposal becomes final.

The Security Rule proposal. Published on January 6, 2025, with comments closed on March 7, 2025 (Federal Register). It would change the Security Rule, not the Privacy Rule. No final rule has been published.

Administrative Requirements: The Paperwork the Rule Demands

45 CFR 164.530 turns the HIPAA Privacy Rule into a program. A covered entity must:

• Designate a privacy official "responsible for the development and implementation of the policies and procedures of the entity", plus a contact person for complaints.
• Train the workforce on its privacy policies "as necessary and appropriate for the members of the workforce to carry out their functions." See our HIPAA training requirements guide.
• Keep safeguards in place: "appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information." HHS's examples include shredding paper records and locking files (HHS summary).
• Run a complaint process and document complaints and their outcome.
• Apply sanctions to workforce members who break the policies.
• Mitigate harm from a known improper use or disclosure, "to the extent practicable."
• Not retaliate, and never require a patient to waive their rights "as a condition for obtaining treatment, payment, and enrollment or benefits eligibility."
• Retain documentation "for six years from the date of its creation or the date when it last was in effect, whichever is later."

For templates, see our HIPAA documentation templates.

Penalties for HIPAA Privacy Rule Violations

Civil money penalties are tiered by culpability and adjusted for inflation each year. The current amounts in 45 CFR 102.3 come from the adjustment published on January 28, 2026. They apply to penalties assessed from that date, for violations on or after November 2, 2015 (Federal Register).

Two caveats. First, HHS's Privacy Rule summary page still shows the 2022 amounts, so do not copy figures from it. Second, HHS has used enforcement discretion since 2019. It applies these annual caps, which are lower for the first three tiers: "$25,000 for no knowledge, $100,000 for reasonable cause, $250,000 for corrected willful neglect, and $1,500,000 for uncorrected willful neglect", adjusted for inflation (Federal Register, April 30, 2019). HHS also notes that "certain violations of the Privacy Rule may be subject to criminal prosecution." Our HIPAA violation penalties guide covers the enforcement record in more depth.

When a privacy failure becomes a breach of unsecured PHI, the Breach Notification Rule adds its own clock. Individuals must be notified "without unreasonable delay and in no case later than 60 calendar days after discovery" (45 CFR 164.404). Media notice is also required when more than 500 residents of a state are affected. See what counts as a HIPAA breach.

What This Means for a Privacy Officer

The work this rule creates is weekly, not annual. Access requests arrive with a 30-day clock. Notices need updating when the rule changes, as the February 2026 deadline showed. Each new vendor that touches PHI needs a business associate agreement first. A program run as a one-time policy binder falls behind on all three.

A Short HIPAA Privacy Rule Checklist

Use this to check a program against the rule, not as a substitute for legal advice.

• ☐ A named privacy official and complaint contact
• ☐ A current Notice of Privacy Practices with the February 2026 Part 2 changes, and none of the vacated items
• ☐ An access request log with received and due dates, with a 30-day maximum (15-day target)
• ☐ A written cost-based fee schedule for copies
• ☐ A process for the out-of-pocket restriction, wired into billing
• ☐ Minimum necessary rules for routine disclosures and role-based access
• ☐ An authorization form with every required element
• ☐ Signed business associate agreements with every vendor that touches PHI
• ☐ Workforce training records and a sanctions policy
• ☐ Six-year retention for all required documentation

Frequently Asked Questions

What is the HIPAA Privacy Rule in simple terms?

It is the federal rule that controls who may use or share a patient's health information, and why. It also gives patients rights over that information, such as getting a copy of their records.

How long does a provider have to answer a records request?

30 days from receipt, under 45 CFR 164.524. One 30-day extension is allowed if the patient gets a written reason and a new date within the first 30 days. A 2021 proposal would cut that to 15 days, but it is not final.

Do I need a patient's permission to share PHI for treatment or billing?

No. The rule permits use and disclosure for treatment, payment and health care operations without written permission, and HHS calls consent for these purposes optional. State law can be stricter.

Is the 2024 reproductive health privacy rule still in effect?

Mostly no. A federal court vacated it on June 18, 2025, except for its changes to the Notice of Privacy Practices, and even there it struck three provisions. The surviving notice changes had to be in place by February 16, 2026.

Can a covered entity refuse a patient's request to restrict disclosures?

Usually yes, because there is no duty to agree. The exception covers an item or service the patient paid for in full out of pocket. If asked, the entity must agree not to disclose it to a health plan for payment or operations.

Sources

1. HHS, The HIPAA Privacy Rule, accessed 2026-11-02
2. HHS, Summary of the HIPAA Privacy Rule, accessed 2026-11-02
3. HHS, Business associates direct liability fact sheet, accessed 2026-11-02
4. HHS, Summary of the HIPAA Security Rule, accessed 2026-11-02
5. HHS, HIPAA and reproductive health, accessed 2026-11-02
6. eCFR, 45 CFR 160.103, 160.203, 164.502, 164.506, 164.508, 164.512, 164.514, 164.520, 164.522, 164.524, 164.526, 164.528, 164.530, 164.534, 164.404, accessed 2026-11-02 (edition current to 2026-10-29)
7. eCFR, 45 CFR 102.3, accessed 2026-11-02
8. Federal Register, Annual Civil Monetary Penalties Inflation Adjustment, January 28, 2026, accessed 2026-11-02
9. Federal Register, Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties, April 30, 2019, accessed 2026-11-02
10. Federal Register, HIPAA Privacy Rule to Support Reproductive Health Care Privacy, April 26, 2024, accessed 2026-11-02
11. govinfo, Purl v. HHS, No. 2:24-cv-00228-Z (N.D. Tex.), order of June 18, 2025, accessed 2026-11-02
12. Federal Register, Proposed Modifications to the HIPAA Privacy Rule, January 21, 2021, accessed 2026-11-02
13. Federal Register, Tribal Consultation on Proposed Modifications to the HIPAA Privacy Rule, January 14, 2026, accessed 2026-11-02
14. Federal Register, HIPAA Security Rule proposed rule, January 6, 2025, accessed 2026-11-02
15. HHS, OCR settlement with Azul Vision, August 27, 2026, accessed 2026-11-02
16. HHS, OCR penalty against Oregon Health & Science University, March 6, 2025, accessed 2026-11-02

Last reviewed: 2026-11-02. This article was prepared by the Security Compliance Guide Editorial Team. We use AI to draft initial summaries of publicly available cybersecurity compliance documentation, then verify every claim against primary sources before publication. We are not licensed auditors, attorneys, or compliance consultants. For binding decisions, consult a qualified professional. See our editorial standards for full sourcing rules.