Last verified: October 2026, against 45 CFR Part 164 Subpart E on eCFR and HHS's Federal Register notices. General information, not legal advice — confirm with your compliance officer or attorney.
The HIPAA Privacy Rule sets when a practice may use or share patient information, what rights patients have over it, and what paperwork proves you follow the rules. It lives in 45 CFR Part 160 and Part 164, Subparts A and E, and runs to dozens of sections. This page organizes it around the decisions a small practice makes every day, with extra attention to the parts that touch marketing and your website.
In short: The HIPAA Privacy Rule lets practices use and share PHI for treatment, payment and operations without asking, requires written authorization for most other purposes, including marketing, gives patients rights to access and amend their records, and requires a posted Notice of Privacy Practices, a privacy official, training and six years of records.
What the Privacy Rule covers
The rule protects PHI, explained in what is PHI, held by covered entities and their business associates, in any form. Its starting point is 164.502(a) (opens in a new tab): "A covered entity or business associate may not use or disclose protected health information, except as permitted or required" by the rule. Everything else is a list of permissions, conditions and rights.
Two disclosures are required, not optional: to a patient exercising their access or accounting rights, and to HHS during an investigation. If you're not sure whether your practice is covered at all, start with who HIPAA applies to.
Permitted uses: treatment, payment and operations
Under 164.506 (opens in a new tab), a practice may use or disclose PHI for its own treatment, payment and health care operations without the patient's authorization. Operations, defined in 164.501 (opens in a new tab), includes quality improvement, staff training, audits, business planning and general administration.
Other permissions require no authorization but come with conditions:
- Opportunity to agree or object (164.510): facility directories and sharing with family members involved in care.
- Public interest purposes (164.512 (opens in a new tab)): disclosures required by law, public health reporting, abuse reporting, health oversight, court orders, certain law enforcement requests, research with a waiver, averting a serious threat, and workers' compensation, among others.
- Incidental disclosures, like a name overheard in the waiting room, if you've applied reasonable safeguards and minimum necessary.
Minimum necessary applies to most of these, but not to disclosures to another provider for treatment.
Patient rights: access, amendment, restrictions, communications
| Right | What the practice must do | Deadline | Rule |
|---|---|---|---|
| Access and copies | Provide records in the form requested if readily producible, including electronic copies; send to a designated third party on written request | 30 days, one 30-day extension | 164.524 (opens in a new tab) |
| Amendment | Accept or deny in writing | 60 days, one 30-day extension | 164.526 (opens in a new tab) |
| Restrictions | Consider requests; must agree not to tell a health plan about a service paid in full out of pocket | No fixed deadline | 164.522(a) (opens in a new tab) |
| Confidential communications | Accommodate reasonable requests for another address or channel, without asking why | No fixed deadline | 164.522(b) |
| Accounting of disclosures | List certain disclosures from the prior six years | 60 days, one 30-day extension | 164.528 (opens in a new tab) |
On fees, 164.524(c)(4) allows only "a reasonable, cost-based fee" covering labor for copying, supplies, postage and an agreed summary. Searching and retrieval aren't on that list.
A pending change: a 2021 HHS proposal would shorten the access deadline "to no later than 15 calendar days (from the current 30 days)" (86 FR 6446 (opens in a new tab)). HHS held a tribal consultation (opens in a new tab) on that proposal in February 2026, so as of October 2026 it is still a proposal and 30 days remains the rule.
The Notice of Privacy Practices, including on your website
164.520 (opens in a new tab) requires a plain-language notice that opens with a prescribed header ("THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED…") and explains your uses, disclosures and patients' rights. A provider with direct treatment relationships must:
- give it no later than the first service delivery, including electronic delivery such as a telehealth visit;
- make a good-faith effort to get a written acknowledgment;
- post it "in a clear and prominent location" in the office; and
- if it "maintains a web site that provides information about the covered entity's customer services or benefits," "prominently post its notice on the web site and make the notice available electronically through the web site."
Website redesigns are where that last requirement gets lost. Check that the link survives in your footer.
Recent amendments need care. In April 2024, HHS published a reproductive health care privacy rule (opens in a new tab) that also changed the notice, with a notice compliance date of February 16, 2026. On June 18, 2025, a federal court in Texas, in Purl v. HHS (opens in a new tab), vacated that rule's changes to Parts 160 and 164 except its notice changes, which stand apart from three reproductive-health provisions the court also vacated. The surviving notice changes mainly concern substance use disorder records covered by 42 CFR Part 2. If you receive Part 2 records, have counsel confirm your notice is current.
Marketing, fundraising and sale of PHI
- Marketing. "A communication about a product or service that encourages recipients of the communication to purchase or use the product or service" (164.501). Telling your own patients about your own services is generally excluded, unless a third party pays you to send it. Using PHI for marketing otherwise needs authorization.
- Fundraising. A practice may use limited data, such as demographics, dates of service, treating physician and outcome, to raise funds for itself without authorization, but only if its notice says so, and every communication must offer a clear opt-out (164.514(f) (opens in a new tab)).
- Sale of PHI. Disclosing PHI in exchange for payment is prohibited without authorization, with exceptions such as treatment, payment and a vendor being paid for its services.
The details, including review replies, pixels and email newsletters, are in our HIPAA marketing rules. A free marketing audit checks whether your current website shares data with ad platforms.
Administrative requirements for a small practice
164.530 (opens in a new tab) is the to-do list: designate a privacy official and a complaints contact, train the workforce, keep "appropriate administrative, technical, and physical safeguards," offer a complaint process, apply sanctions, mitigate harm from violations, never retaliate or require patients to waive their rights, keep written policies, and retain documentation for six years. The electronic side of safeguarding is spelled out in the Security Rule.
Medfy's part is the website and patient data it handles: HIPAA-compliant forms, patient information stored in separate, encrypted HIPAA databases in the US or Canada, and a BAA signed with every practice before any patient data flows. See how Medfy handles patient data.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
What does the HIPAA Privacy Rule protect?
Protected health information: identifiable information about a person's health, care or payment for care held by a covered entity or its business associates, in any form, whether electronic, paper or spoken. The rule limits when that information may be used or shared, gives patients rights over it, and requires practices to have policies, training and a privacy notice. De-identified data falls outside it. Confirm specific situations with your compliance officer or attorney.
Does our website need a Notice of Privacy Practices?
Yes, if your practice is a covered entity and maintains a website that provides information about its services. Under 45 CFR 164.520(c)(3)(i), you must prominently post the notice on the website and make it available electronically there. A footer link labeled 'Notice of Privacy Practices' on every page is a common way to meet it. Have your compliance officer or attorney review the notice's content.
How fast must a practice answer a records request?
Within 30 days of receiving it, under 45 CFR 164.524. If you can't, you may take one extension of up to 30 more days, but only by telling the patient in writing, within the first 30 days, why and when you'll finish. A 2021 HHS proposal would shorten this to 15 days; it was still not final in October 2026. Confirm your process with your compliance officer or attorney.
How is the Privacy Rule different from the Security Rule?
The Privacy Rule sets who may use or see PHI, for what purposes, and what rights patients have, and it covers PHI in every form. The Security Rule sets the administrative, physical and technical safeguards for electronic PHI only, such as risk analysis, access controls and encryption decisions. A practice needs both: the Privacy Rule decides what's allowed, the Security Rule protects the data while it's stored and sent.