Privacy Rule vs Security Rule
The Privacy Rule governs who may use or disclose protected health information and for what purpose. The Security Rule governs how electronic PHI is technically and administratively protected. They are different rules with different scopes and organizations regularly conflate them.
| Privacy Rule | Security Rule | |
|---|---|---|
| Covers | All PHI — paper, oral, electronic | Electronic PHI only |
| Asks | Who may use or disclose it, and why | How is it protected |
| Includes | Patient rights, notices, authorisations | Administrative, physical, technical safeguards |
| Business associates | Partly | Fully |
See the 18 safeguard standards for the Security Rule side.
Permitted uses and disclosures
The Privacy Rule works by default prohibition: PHI may not be used or disclosed unless the Rule permits it or the individual authorises it.
Permitted without authorisation: to the individual themselves; for treatment, payment and healthcare operations; with an opportunity to agree or object in limited circumstances; incidental to a permitted use; for twelve specified public interest purposes including public health, law enforcement and judicial proceedings; and as a limited data set for research or public health with a data use agreement.
Requires authorisation: most marketing, any sale of PHI, and psychotherapy notes with narrow exceptions.
Treatment, payment and healthcare operations is the workhorse category and the one most often stretched. Using PHI to improve your product is not automatically healthcare operations.
The minimum necessary standard
When using or disclosing PHI, limit it to the minimum necessary to accomplish the purpose. It does not apply to disclosures to the individual, for treatment, under an authorisation, or as required by law.
In practice this is a systems requirement rather than a policy one. Role-based access that gives every support agent full record access fails minimum necessary regardless of what the policy says, and it is one of the more common findings against software companies.
Patient rights
| Right | What it means | Whose obligation |
|---|---|---|
| Access | A copy of their records, generally within 30 days | Covered entity, with BA support |
| Amendment | Request correction of inaccurate PHI | Covered entity |
| Accounting of disclosures | A list of certain disclosures made | Covered entity, with BA records |
| Restriction | Request limits on use and disclosure | Covered entity |
| Confidential communications | Be contacted by alternative means | Covered entity |
| Notice of Privacy Practices | Be told how PHI is used | Covered entity only |
Right of access is the enforcement hotspot. OCR has run a dedicated initiative on it and settlements are numerous. If you are a business associate, your practical obligation is being able to produce records fast enough for your customer to meet their deadline.
What applies to business associates
Business associates get a narrower slice of the Privacy Rule than covered entities. You are bound by the use and disclosure limits in your BAA, you must not use PHI beyond what the agreement permits, and you must support your customer in meeting patient rights.
You do not issue a Notice of Privacy Practices, and most patient-facing duties remain the covered entity's. See HIPAA for SaaS companies and what a BAA must contain.
FAQs
What is the HIPAA Privacy Rule?
The rule governing who may use or disclose protected health information and for what purposes. It covers PHI in all forms — paper, oral and electronic — and establishes patient rights including access, amendment and an accounting of disclosures. It is distinct from the Security Rule, which governs how electronic PHI is protected.
What is the difference between the Privacy Rule and the Security Rule?
The Privacy Rule is about who may see PHI and why, and covers all forms of it. The Security Rule is about how electronic PHI is protected, through administrative, physical and technical safeguards. Business associates are fully subject to the Security Rule and only partly to the Privacy Rule.
What is the minimum necessary standard?
A requirement to limit use and disclosure of PHI to the minimum needed to accomplish the purpose. It does not apply to disclosures to the individual, for treatment, under an authorisation, or as required by law. In practice it is satisfied through role-based access rather than through policy language.
Do business associates have to comply with the Privacy Rule?
Partly. Business associates are bound by the use and disclosure limits in their BAA, must not use PHI beyond what it permits, and must support the covered entity in meeting patient rights. They do not issue a Notice of Privacy Practices, and most patient-facing duties remain with the covered entity.
What is HIPAA right of access?
The patient's right to obtain a copy of their own records, generally within 30 days and for a reasonable cost-based fee. OCR has run a dedicated enforcement initiative on it and settlements are numerous, which makes it the patient right most likely to generate an investigation.
Where to go next
See the HIPAA risk assessment, the Security Rule safeguards, or HIPAA consulting.