HIPAA Privacy Rule: General Rules for Uses and Disclosures (45 CFR 164.502)
The general rules covered entities follow for any use or disclosure of protected health information, including the minimum necessary standard and treatment, payment, and operations exceptions.
Primary source
45 CFR 164.502 — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
45 CFR 164.502 sets the baseline rule for protected health information: a covered entity may not use or disclose PHI except as the Privacy Rule permits or requires. Permitted uses fall into a short list: to the individual, for treatment, payment, or health care operations (TPO), incident to a permitted use, pursuant to a valid authorization, or under one of the public-interest exceptions in 164.512.
The minimum necessary standard applies to most uses and disclosures: a covered entity must limit PHI to the amount reasonably needed for the purpose. Treatment disclosures to other providers are exempt from this standard, as are disclosures to the individual, disclosures required by law, and disclosures pursuant to a valid authorization.
The section also governs disclosures to business associates (requires a written contract under 164.504(e)), to personal representatives, and during practice transitions. It is the structural section of the Privacy Rule — most other Privacy Rule provisions reference 164.502 as their authorizing baseline.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Minimum Necessary Standard (45 CFR 164.502(b))Covered entities must make reasonable efforts to limit PHI uses, disclosures, and requests to the minimum necessary for the intended purpose, with specific carve-outs for treatment and a few other categories.
- RegulationHIPAA Right of Access (45 CFR 164.524)Individuals have a right to inspect and obtain copies of their PHI in a designated record set, in the form and format requested when readily producible, within 30 days.
- RegulationHIPAA Treatment, Payment, and Operations (45 CFR 164.506)Covered entities may use and disclose PHI for treatment, payment, and health care operations without authorization, subject to limits and notice requirements.
- RegulationHIPAA Incidental Disclosures (45 CFR 164.502(a)(1)(iii))Incidental disclosures that occur as a by-product of an otherwise permitted use or disclosure are not violations, provided reasonable safeguards and minimum necessary policies are applied.
- ComplianceAccounting of Disclosures (45 CFR § 164.528): Tracker + ProcedureA 2026 HIPAA Accounting of Disclosures procedure citing 45 CFR § 164.528 — the six-year lookback, what to log, exclusions, and a copy-ready tracker template.
- SRAHIPAA Security Rule vs Privacy Rule: A Plain-English MapWhat the Security Rule at 45 CFR Part 164 Subpart C does, what the Privacy Rule at Subpart E does, where they overlap, and which rule the SRA actually answers to.
- GlossaryAccounting of DisclosuresThe HIPAA right of an individual to receive a list of disclosures of their PHI made by a covered entity over the prior six years.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.