HIPAA Basics: The Privacy and Security Rules
18-minute refresher · For: All members of the healthcare workforce who access or handle patient information, including clinical, laboratory, pharmacy, billing, front-desk, IT, and administrative staff, as well as students and volunteers.
- Define protected health information (PHI) and identify covered entities and business associates.
- Describe permitted uses and disclosures and the minimum necessary standard.
- List key patient rights under the HIPAA Privacy Rule.
- Summarize administrative, physical, and technical safeguards under the Security Rule.
- Explain basic breach notification obligations and how to report a suspected privacy incident.
What HIPAA Covers
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) directed the U.S. Department of Health and Human Services (HHS) to adopt national standards for protecting health information. The HHS Office for Civil Rights (OCR) enforces the Privacy, Security, and Breach Notification Rules, found at 45 CFR Parts 160 and 164.
HIPAA applies to covered entities:
- Health plans.
- Healthcare clearinghouses.
- Healthcare providers who conduct certain financial and administrative transactions electronically, such as billing insurance.
It also applies to business associates, which are persons or organizations that perform functions or services for a covered entity involving PHI, such as billing companies, IT vendors, and transcription services. Covered entities must have a business associate agreement that requires the business associate to safeguard PHI.
Protected Health Information
Protected health information (PHI) is individually identifiable health information held or transmitted by a covered entity or business associate, in any form: electronic, paper, or oral. It relates to an individual's past, present, or future physical or mental health condition, the provision of care, or payment for care, and identifies or could reasonably identify the individual.
Examples of identifiers include names, addresses, dates related to the individual (such as birth or admission dates), telephone numbers, email addresses, Social Security numbers, medical record numbers, health plan numbers, and full-face photographs. Health information that has been properly de-identified under the Privacy Rule's Safe Harbor or Expert Determination methods is not PHI.
Electronic PHI (ePHI) is the subset of PHI covered by the Security Rule.
Uses, Disclosures, and Minimum Necessary
The Privacy Rule permits covered entities to use and disclose PHI without the patient's written authorization for treatment, payment, and healthcare operations (TPO). It also permits certain other disclosures without authorization, such as those required by law, for specified public health activities, and to avert a serious threat to health or safety, subject to conditions in the Rule.
Most other uses and disclosures, such as many marketing communications and the sale of PHI, require the patient's written authorization.
The minimum necessary standard requires reasonable efforts to use, disclose, and request only the minimum PHI needed to accomplish the purpose. It does not apply to disclosures to a provider for treatment, disclosures to the individual, or disclosures made under a valid authorization.
In daily practice, this means accessing records only when you need them for your job. Looking up a coworker, family member, neighbor, or public figure out of curiosity is a privacy violation even if you never share what you saw.
Patient Rights
The Privacy Rule gives individuals rights over their health information, including the right to:
- Receive a Notice of Privacy Practices describing how their information may be used and their rights.
- Access and obtain a copy of their PHI in a designated record set. Covered entities generally must act on a request within 30 calendar days, with one possible 30-day extension, and may charge only a reasonable, cost-based fee.
- Request an amendment of information they believe is inaccurate or incomplete.
- Receive an accounting of certain disclosures.
- Request restrictions on certain uses and disclosures. Providers must agree to a request not to disclose information to a health plan about a service paid for in full out of pocket, with limited exceptions.
- Request confidential communications, such as contact at an alternate address or phone number.
- File a complaint with the covered entity or with HHS OCR.
The Security Rule
The HIPAA Security Rule requires covered entities and business associates to ensure the confidentiality, integrity, and availability of ePHI. It is organized around three types of safeguards:
- Administrative safeguards: risk analysis and risk management, a designated security official, workforce training, sanctions policies, and contingency planning.
- Physical safeguards: facility access controls, workstation use and security, and device and media controls, including proper disposal.
- Technical safeguards: access controls such as unique user IDs, audit controls, integrity controls, person or entity authentication, and transmission security.
Everyday workforce practices that support the Security Rule include:
- Never sharing passwords or using another person's login.
- Locking or logging off workstations when you step away.
- Recognizing and reporting phishing emails.
- Using only approved, encrypted devices and messaging tools for PHI.
- Positioning screens away from public view.
HHS periodically updates HIPAA regulations; check HHS OCR resources and your organization's policies for current requirements.
Breaches and Reporting
Under the Breach Notification Rule, a breach is generally an impermissible use or disclosure that compromises the security or privacy of PHI. An impermissible use or disclosure of unsecured PHI is presumed to be a breach unless a documented risk assessment shows a low probability that the PHI has been compromised.
Covered entities must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured PHI. Breaches affecting 500 or more residents of a state or jurisdiction also require notice to prominent media outlets, and breaches of 500 or more individuals must be reported to HHS within the same 60-day window. Smaller breaches are reported to HHS annually.
As a workforce member, your responsibility is simple: report suspected privacy or security incidents promptly to your privacy or security officer, according to your organization's policy. Prompt reporting allows the organization to contain harm and meet its legal obligations. HIPAA prohibits retaliation against individuals who file complaints.
Everyday Privacy Scenarios
Common situations where privacy mistakes occur include:
- Conversations: discuss patient information in private areas when possible, and lower your voice in shared spaces. The Privacy Rule permits incidental disclosures when reasonable safeguards are in place.
- Social media: never post patient images, stories, or details, even without names, if the patient could be identified.
- Paper records: keep documents out of public view and dispose of PHI in designated shred bins.
- Family and friends: providers may share relevant information with family involved in care when the patient agrees or does not object, or when professional judgment supports it if the patient is incapacitated.