HIPAA Rules: Privacy Rule

The Privacy Rule standards address the use and disclosure of individuals’ health information—called “protected health information” by organizations subject to the Privacy Rule — called “covered entities,” as well as standards for individuals’ privacy rights to understand and control how their health information is used.

A primary goal of the Privacy Rule is to ensure that an individual’s health information is properly protected while allowing the flow of health information needed to provide and promote high-quality health care and to protect the public’s health and well-being. The Rule strikes a balance that permits important uses of information while protecting the privacy of people who seek care and healing. Given that the healthcare marketplace is diverse, the Rule is designed to be flexible and comprehensive to cover the variety of uses and disclosures that need to be addressed.

The HIPAA Privacy Rule establishes national standards for protecting patient medical records and other protected health information (PHI) and the use and disclosure of PHI. Healthcare clearinghouses, providers, and plans that carry out specific medical transactions electronically are subject to the HIPAA Privacy Rule.

The HIPAA Privacy Rule places restrictions and requirements on using and disclosing personal health information without patient consent. It also mandates proper protections to preserve the privacy of such information. Patients also have rights to their health information under the Privacy Rule, including the ability to inspect, acquire a copy of, and ask for corrections to their records.

The initial Act of 1996, its later additions and revisions, including the HIPAA Privacy Rule, and any connected laws must all be complied with by businesses wishing to establish and maintain HIPAA compliance.