HIPAA Privacy Rule (for Professionals)
ARCHIVED 2023-05-09, DATE APPROXIMATE · VERSION 20230509_rev01 · COMPARED WITH 20220105_rev01
Full text changes — 20220105_rev01 to 20230509_rev01
COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED
| 1 | Starting January 1, 2022, there are new patient protections against surprise medical bills. Learn more at [cms.gov/nosurprises](https://www.cms.gov/nosurprises). | |
| 2 | ||
| 3 | - [HIPAA for Individuals](https://hhs.gov/hipaa/for-individuals/index.html) | |
| 4 | - [Filing a Complaint](https://hhs.gov/hipaa/filing-a-complaint/index.html) | |
| 5 | - [HIPAA for Professionals](https://hhs.gov/hipaa/for-professionals/index.html) | |
| 6 | - [Newsroom](https://hhs.gov/hipaa/newsroom/index.html) | |
| 7 | ||
| 8 | - Text Resize [A]() [A]() [A]() | |
| 9 | ||
| 10 | ||
| 11 | ## Left Nav: /hipaa/for-professionals | |
| 12 | ||
| 13 | - [HIPAA for Professionals](https://hhs.gov/hipaa/for-professionals/index.html) | |
| 14 | - [Regulatory Initiatives](https://hhs.gov/hipaa/for-professionals/regulatory-initiatives/index.html) | |
| 15 | - [Privacy](https://hhs.gov/hipaa/for-professionals/privacy/index.html) [has sub items, about Privacy]() | |
| 16 | - [Summary of the Privacy Rule](https://hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html) | |
| 17 | - [Guidance](https://hhs.gov/hipaa/for-professionals/privacy/guidance/index.html) | |
| 18 | - [Combined Text of All Rules](https://hhs.gov/hipaa/for-professionals/privacy/laws-regulations/combined-regulation-text/index.html) | |
| 19 | - [HIPAA Related Links](https://hhs.gov/hipaa/for-professionals/privacy/guidance/related-links/index.html) | |
| 20 | - [Security](https://hhs.gov/hipaa/for-professionals/security/index.html) [has sub items, about Security]() | |
| 21 | - [Cyber Security Guidance](https://hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity/index.html) | |
| 22 | - [Summary of the Security Rule](https://hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html) | |
| 23 | - [Breach Notification](https://hhs.gov/hipaa/for-professionals/breach-notification/index.html) [has sub items, about Breach Notification]() | |
| 24 | - [Breach Reporting](https://hhs.gov/hipaa/for-professionals/breach-notification/breach-reporting/index.html) | |
| 25 | - [Guidance](https://hhs.gov/hipaa/for-professionals/breach-notification/guidance/index.html) | |
| 26 | - [Reports to Congress](https://hhs.gov/hipaa/for-professionals/breach-notification/reports-congress/index.html) | |
| 27 | - [Regulation History](https://hhs.gov/hipaa/for-professionals/breach-notification/laws-regulations/index.html) | |
| 28 | - [Compliance & Enforcement](https://hhs.gov/hipaa/for-professionals/compliance-enforcement/index.html) [has sub items, about Compliance & Enforcement]() | |
| 29 | - [Enforcement Rule](https://hhs.gov/hipaa/for-professionals/special-topics/enforcement-rule/index.html) | |
| 30 | - [Enforcement Process](https://hhs.gov/hipaa/for-professionals/compliance-enforcement/enforcement-process/index.html) | |
| 31 | - [Enforcement Data](https://hhs.gov/hipaa/for-professionals/compliance-enforcement/data/index.html) | |
| 32 | - [Resolution Agreements](https://hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html) | |
| 33 | - [Case Examples](https://hhs.gov/hipaa/for-professionals/compliance-enforcement/examples/index.html) | |
| 34 | - [Audit](https://hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/index.html) | |
| 35 | - [Reports to Congress](https://hhs.gov/hipaa/for-professionals/compliance-enforcement/reports-congress/index.html) | |
| 36 | - [State Attorneys General](https://hhs.gov/hipaa/for-professionals/compliance-enforcement/state-attorneys-general/index.html) | |
| 37 | - [Special Topics](https://hhs.gov/hipaa/for-professionals/special-topics/index.html) [has sub items, about Special Topics]() | |
| 38 | - [HIPAA and COVID-19](https://hhs.gov/hipaa/for-professionals/special-topics/hipaa-covid19/index.html) | |
| 39 | - [HIPAA and FERPA](https://hhs.gov/hipaa/for-professionals/special-topics/ferpa-hipaa/index.html) | |
| 40 | - [Mental Health & Substance Use Disorders](https://hhs.gov/hipaa/for-professionals/special-topics/mental-health/index.html) | |
| 41 | - [Research](https://hhs.gov/hipaa/for-professionals/special-topics/research/index.html) | |
| 42 | - [Public Health](https://hhs.gov/hipaa/for-professionals/special-topics/public-health/index.html) | |
| 43 | - [Emergency Response](https://hhs.gov/hipaa/for-professionals/special-topics/emergency-preparedness/index.html) | |
| 44 | - [Health Information Technology](https://hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/index.html) | |
| 45 | - [Health Apps](https://hhs.gov/hipaa/for-professionals/special-topics/health-apps/index.html) | |
| 46 | - [Patient Safety](https://hhs.gov/hipaa/for-professionals/patient-safety/index.html) [has sub items, about Patient Safety]() | |
| 47 | - [Statute & Rule](https://hhs.gov/hipaa/for-professionals/patient-safety/statute-and-rule/index.html) | |
| 48 | - [PSQIA Statute](https://hhs.gov/hipaa/for-professionals/patient-safety/patient-safety-quality-improvement-act-2005/index.html) | |
| 49 | - [Patient Safety Rule](https://hhs.gov/hipaa/for-professionals/patient-safety/patient-safety-rule/index.html) | |
| 50 | - [Enforcement](https://hhs.gov/hipaa/for-professionals/patient-safety/enforcement/index.html) | |
| 51 | - [Guidance](https://hhs.gov/hipaa/for-professionals/patient-safety/guidance/index.html) | |
| 52 | - [Covered Entities & Business Associates](https://hhs.gov/hipaa/for-professionals/covered-entities/index.html) [has sub items, about Covered Entities & Business Associates]() | |
| 53 | - [Business Associate Contracts](https://hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html) | |
| 54 | - [Business Associates](https://hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html) | |
| 55 | - [Training & Resources](https://hhs.gov/hipaa/for-professionals/training/index.html) | |
| 56 | - [FAQs for Professionals](https://hhs.gov/hipaa/for-professionals/faq/index.html) | |
| 57 | - [Other Administrative Simplification Rules](https://hhs.gov/hipaa/for-professionals/other-administration-simplification-rules/index.html) | |
| 58 | ||
| 59 | 1 | The HIPAA Privacy Rule establishes national standards to protect individuals' medical records and other individually identifiable health information (collectively defined as "protected health information") and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically. The Rule requires appropriate safeguards to protect the privacy of protected health information and sets limits and conditions on the uses and disclosures that may be made of such information without an individual's authorization. The Rule also gives individuals rights over their protected health information, including rights to examine and obtain a copy of their health records, to direct a covered entity to transmit to a third party an electronic copy of their protected health information in an electronic health record, and to request corrections. |
| 60 | 2 | |
| 61 | The Privacy Rule is located at 45 CFR [Part 160](http://www.access.gpo.gov/nara/cfr/waisidx_07/45cfr160_07.html) and Subparts A and E of [Part 164](http://www.access.gpo.gov/nara/cfr/waisidx_07/45cfr164_07.html). | |
| 3 | The Privacy Rule is located at 45 CFR [Part 160](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160) and Subparts A and E of [Part 164](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164). | |
| 62 | 4 | |
| 63 | 5 | [Click here to view the combined regulation text](https://hhs.gov/hipaa/for-professionals/privacy/laws-regulations/combined-regulation-text/index.html) of all HIPAA Administrative Simplification Regulations found at 45 CFR 160, 162, and 164. |
| 64 | 6 | |
| 65 | 7 | ## Privacy Rule History |
| 66 | 8 | |
| 67 | 9 | - March 10, 2021 - [Extension of Comment Period for Modifications to the HIPAA Privacy Rule to Support, and Remove Barriers to, Coordinated Care and Individual Engagement - Proposed Rule](https://www.govinfo.gov/content/pkg/FR-2021-03-10/pdf/2021-05021.pdf) |
| 87 | 29 | |
| 88 | 30 | ## Other Privacy Rule Notices |
| 89 | 31 | |
| 90 | 32 | - March 20, 2003 - Notice of Addresses for Submission of HIPAA Health Information Privacy Complaints ([PDF](https://hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/noticeaddresssubmission.pdf)) |
| 91 | 33 | - March 11, 2003 - [Notice of Address for Submission of Requests for Preemption Exception Determinations](https://hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/notice.txt) ([PDF](https://hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/notice.pdf)) |
| 92 | 34 | - December 28, 2000 - [Statement of Delegation of Authority to the Office for Civil Rights](https://hhs.gov/hipaa/for-professionals/privacy/delegation-of-authority/index.html) ([PDF](https://hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/fedreg.pdf)) |
| 93 | ||
| 94 | Content created by Office for Civil Rights (OCR) | |
| 95 | Content last reviewed December 7, 2021 |