HIPAA Privacy Rule
The federal regulation at 45 CFR Part 164 Subpart E that governs the use and disclosure of PHI.
1 min read · Last reviewed May 23, 2026
At a glance
- Category
- HIPAA & Privacy
- Primary sources
- 3
- Workspace handoff
- compliance binder →
Where this comes up
Privacy officers and practice managers handle this — patient rights requests, accounting of disclosures, BAA reviews with new vendors, breach risk assessments after an incident, and OCR responses when a complaint lands. The 60-day breach-notification clock starts at discovery, not at investigation close.
Full definition
What it is in practice
The Privacy Rule at 45 CFR 164.500 et seq. sets the federal floor for how covered entities and business associates may use and disclose PHI. It establishes patient rights (access, amendment, accounting of disclosures), restricts use to treatment / payment / operations and a narrow set of permitted purposes, and requires a Notice of Privacy Practices.
How it shows up in your practice
Every workforce member needs Privacy Rule training. Every disclosure outside treatment, payment, and operations needs either an authorization or a permitted-purpose justification. State laws may add stricter rules — HIPAA preempts only when state law is less protective.
Sources
- HHS — HIPAA Privacy Rulehttps://www.hhs.gov/hipaa/for-professionals/privacy/index.html
- 45 CFR 164.502 — Uses and disclosures of PHIhttps://www.ecfr.gov/current/title-45/section-164.502
- 45 CFR 164.530 — Privacy Rule administrative requirementshttps://www.ecfr.gov/current/title-45/section-164.530
Adopt your Privacy Rule policies in the Compliance Binder
Open compliance binder →Related terms
- HIPAA & PrivacyHIPAA Security RuleThe federal regulation at 45 CFR Part 164 Subpart C that requires safeguards for ePHI.
- HIPAA & PrivacyMinimum Necessary RuleThe HIPAA standard requiring covered entities to limit PHI uses, disclosures, and requests to the minimum necessary to accomplish the intended purpose.
- HIPAA & PrivacyNotice of Privacy PracticesThe written notice covered entities must provide to patients describing how PHI may be used and disclosed and patient rights regarding PHI.
- HIPAA & PrivacyAuthorization for DisclosureA written authorization signed by the individual permitting a covered entity to use or disclose PHI for a purpose not otherwise permitted by the Privacy Rule.
- HIPAA & PrivacyTreatment, Payment, and Operations (TPO)The three categories of permitted PHI use and disclosure that do not require patient authorization.
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- GlossaryAuthorization for DisclosureA written authorization signed by the individual permitting a covered entity to use or disclose PHI for a purpose not otherwise permitted by the Privacy Rule.
- GlossaryMinimum Necessary RuleThe HIPAA standard requiring covered entities to limit PHI uses, disclosures, and requests to the minimum necessary to accomplish the intended purpose.
- GlossaryNotice of Privacy PracticesThe written notice covered entities must provide to patients describing how PHI may be used and disclosed and patient rights regarding PHI.
- GlossaryTreatment, Payment, and Operations (TPO)The three categories of permitted PHI use and disclosure that do not require patient authorization.
- SRAHIPAA Security Rule vs Privacy Rule: A Plain-English MapWhat the Security Rule at 45 CFR Part 164 Subpart C does, what the Privacy Rule at Subpart E does, where they overlap, and which rule the SRA actually answers to.
- ComplianceBreach Risk Assessment: The 4-Factor Analysis Required by 45 CFR 164.402After a possible PHI incident, the four-factor breach risk assessment at 45 CFR 164.402 determines whether you notify. Do it in writing, do it on the record.
- RegulationHITECH Electronic Copy Right and Sale-of-PHI ProhibitionTwo HITECH-era patient-rights expansions: the right to an electronic copy of EHR-resident PHI and the general prohibition on remuneration for PHI absent authorization.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
This glossary entry is a research aid for billing and compliance staff. It does not provide legal, medical, or financial advice and does not replace counsel. References cited link to primary sources at HHS, OCR, CMS, eCFR, NIST, and the relevant payer or industry body.