Most HIPAA security programmes are built around the Security Rule, yet the questions that decide whether a disclosure was lawful, who may see a record and what a patient can demand all sit in the Privacy Rule. This guide covers the HIPAA Privacy Rule at 45 CFR Part 160 and Part 164 Subpart E: who it applies to, when protected health information (PHI) may be used or disclosed, the minimum necessary standard, individual rights with their deadlines, the administrative requirements, and the Notice of Privacy Practices changes with a compliance date of 16 February 2026. It is written for privacy and security officers, compliance teams, health IT architects and anyone deploying analytics or AI agents over PHI. Status was checked on HHS and eCFR pages in November 2026. For the technical safeguards, see the HIPAA Security Rule Guide.
Source note: this page summarises the official text and the sources listed at the end. Confirm against the official text before relying on it.
Key takeaways
- Everything not permitted is prohibited. Under 45 CFR 164.502(a) a covered entity or business associate may use or disclose PHI only as the rule permits or requires, or as the individual authorises in writing.
- Minimum necessary is an access control requirement. 164.514(d)(2) requires you to identify the people or classes of people who need access, the categories of PHI each needs and any conditions, then limit access to match. That is role-based access by regulation.
- Individual rights carry hard deadlines. Access within 30 days (one 30-day extension), amendment within 60 days, an accounting of disclosures covering six years within 60 days, and documentation kept for six years.
- The notice changed in 2026. Notice of Privacy Practices updates tied to the 42 CFR Part 2 rule had a compliance date of 16 February 2026. A court vacated most of the 2024 reproductive health privacy rule, including three notice elements.
- Machines are workforce too, in effect. Service accounts, integrations, analytics pipelines and AI agents that touch PHI must fall inside a permitted purpose, a minimum necessary profile and, where a vendor is involved, a business associate agreement.
Scope: who and what is covered
The rule applies to three types of covered entity and to their business associates.
| Party | Definition in short | Common edge cases |
|---|---|---|
| Health plans | Individual and group plans that provide or pay for medical care | Employer group plans with fewer than 50 participants administered solely by the employer are excluded |
| Health care clearinghouses | Entities that convert non-standard health data to standard formats or the reverse | Billing services may be clearinghouses or business associates |
| Health care providers | Providers that transmit health information electronically in HIPAA standard transactions | Email alone does not make a provider covered; using a billing service to transmit does |
| Business associates | Perform functions or services for a covered entity involving PHI | Cloud hosts, analytics firms, tracking vendors and AI service providers handling PHI; a contract is required under 164.502(e) and 164.504(e) |
PHI is individually identifiable health information held or transmitted in any form, electronic, paper or oral, about past, present or future health, care or payment. Employment records held as an employer and records covered by FERPA are excluded. De-identified data is outside the rule. 164.514(b) offers two routes: expert determination, or the safe harbour method that removes 18 listed identifiers where the entity has no actual knowledge the remainder could identify someone. A limited data set removes 16 direct identifiers and may be used only for research, public health or health care operations under a data use agreement. See the Anonymisation and Re-identification Risk Guide.
Key obligations
Permitted and required uses and disclosures
Disclosure is required in only two cases: to the individual (or personal representative) exercising access or accounting rights, and to HHS for compliance investigations. Everything else is a permission, and each permission has conditions.
| Permission | Rule | Key condition |
|---|---|---|
| Treatment, payment and health care operations (TPO) | 164.506 | Consent optional; operations has a defined list (quality assessment, audits, fraud programmes, business planning) |
| Opportunity to agree or object | 164.510 | Facility directories, family involvement and notification |
| Incidental uses and disclosures | 164.502(a)(1)(iii) | Only where reasonable safeguards and minimum necessary are in place |
| 12 public interest purposes | 164.512(a) to (l) | Required by law, public health, abuse victims, health oversight, judicial proceedings, law enforcement, decedents, organ donation, research, serious threat, government functions, workers' compensation |
| Limited data set | 164.514(e) | Data use agreement; research, public health or operations only |
| Authorisation | 164.508 | Everything else; required for most psychotherapy notes, marketing and sale of PHI |
A valid authorisation is in plain language and names the information, the parties, an expiry and the right to revoke in writing. Treatment, payment, enrolment or eligibility generally cannot be conditioned on signing one.
Minimum necessary
164.502(b) and 164.514(d) require reasonable efforts to use, disclose and request only the minimum PHI needed. The implementation has four parts:
- Workforce access (d)(2): identify persons or classes of persons who need access, the categories of PHI each needs and any conditions, and limit access accordingly.
- Routine disclosures (d)(3): standard protocols for recurring disclosures; individual review against criteria for the rest.
- Requests (d)(4): the same discipline when you request PHI from others.
- Entire record (d)(5): no use, disclosure or request of an entire medical record unless specifically justified.
It does not apply to disclosures for treatment, to the individual, under an authorisation, to HHS, as required by law, or as needed for HIPAA transaction compliance.
Individual rights
| Right | Rule | Deadline and key detail |
|---|---|---|
| Notice of Privacy Practices | 164.520 | Required header; providers make a good-faith effort to obtain written acknowledgement |
| Access and copies | 164.524 | Act within 30 days, one 30-day extension with written reasons; form and format requested if readily producible; copy to a third party on signed written direction; cost-based fee limited to labour, supplies, postage and an agreed summary |
| Amendment | 164.526 | Act within 60 days, one 30-day extension; written denial with right to submit a statement of disagreement |
| Accounting of disclosures | 164.528 | Disclosures in the prior six years; act within 60 days, one 30-day extension; first accounting in 12 months free; TPO, authorised and several other categories excluded |
| Request restrictions | 164.522(a) | Entity need not agree, but must comply once it does, except for emergency treatment |
| Confidential communications | 164.522(b) | Providers and plans must accommodate reasonable requests for alternative means or locations |
Access denials split into unreviewable grounds (psychotherapy notes, information compiled for legal proceedings, certain correctional, research and Privacy Act cases) and reviewable grounds, where a licensed health care professional judges access likely to endanger life or physical safety or cause substantial harm. Reviewable denials go to a second licensed professional on request. For handling and identity verification of requests, see the DSAR Guide: Handling Data Subject Requests.
Administrative requirements
164.530 requires a privacy official and complaint contact, workforce training, sanctions, mitigation of harmful effects, reasonable administrative, technical and physical safeguards, a complaint process, no retaliation or required waiver of rights, written policies and procedures, and documentation kept for six years from creation or last effective date. State laws that are contrary are generally pre-empted, except where they are more protective of privacy (45 CFR 160.203). See the Health Data Privacy Beyond HIPAA Guide (My Health My Data).
Timeline and current status
| Date | Event | Status as of November 2026 |
|---|---|---|
| 14 April 2003 | Original compliance date (small health plans 14 April 2004) | In force |
| 16 February 2024 | 42 CFR Part 2 final rule published (announced 8 February 2024) | Compliance date 16 February 2026 |
| 26 April 2024 | Reproductive health care privacy final rule (89 FR 32976), including Notice of Privacy Practices revisions | Most of the rule vacated on 18 June 2025 in Purl v. HHS (N.D. Tex.) |
| 20 June 2024 | Court vacates part of the OCR online tracking technologies bulletin (AHA v. Becerra) | Remainder of the bulletin still posted |
| 16 February 2026 | Compliance date for the remaining Notice of Privacy Practices modifications | In force |
The 2026 notice changes
HHS states that the Purl court vacated the notice elements at 164.520(b)(1)(ii)(F), (G) and (H), which described prohibited reproductive health disclosures, attestations and a redisclosure statement, and that the remaining notice modifications stand, with compliance required by 16 February 2026. When we checked in November 2026 the unofficial eCFR compilation still displayed (F) to (H), so rely on HHS's statement rather than the eCFR text for those elements. The remaining changes align the notice with Part 2. A notice must now reflect more stringent law such as 42 CFR Part 2, and entities that receive or maintain Part 2 substance use disorder records must state that those records cannot be used against the individual in civil, criminal, administrative or legislative proceedings without written consent or a court order, and must offer a clear opt-out before using Part 2 records for fundraising. The Part 2 rule also allows a single patient consent for all future treatment, payment and operations uses, applies HIPAA breach notification to Part 2 records, and replaces Part 2's own criminal penalties with HIPAA's enforcement authorities. HHS has said it will decide next steps on the vacated rule, so watch for further rulemaking.
Enforcement and penalties
The HHS Office for Civil Rights (OCR) enforces civil penalties and the Department of Justice prosecutes criminal offences.
- Civil money penalties: tiered by knowledge and wilful neglect. HHS's Privacy Rule summary lists the 2022 inflation-adjusted range as $127 to $63,973 per violation, with an annual cap of $25,000 to $1,919,173 for identical violations; amounts are adjusted annually under 45 CFR 102.3, so check the current figures. No penalty applies where the failure was not due to wilful neglect and was corrected within 30 days of knowledge.
- Criminal penalties (42 U.S.C. 1320d-6): knowingly obtaining or disclosing PHI, up to $50,000 and one year; under false pretences, up to $100,000 and five years; for commercial advantage, personal gain or malicious harm, up to $250,000 and ten years.
Unpermitted disclosures are presumed to be breaches unless a risk assessment shows a low probability of compromise, which links every Privacy Rule failure to the HIPAA Breach Notification Rule Guide.
What it means for AI agents and non-human identities
The Privacy Rule does not mention software, but every rule above applies when the user of PHI is a service account, integration or AI agent.
- Permitted purpose first: an agent summarising records for clinicians is treatment; the same agent reused for marketing or model training on identifiable data needs an authorisation, de-identification or another permission. Record the purpose per agent.
- Minimum necessary per identity: give each agent or pipeline a defined category of PHI under 164.514(d)(2), not a database-wide read role, and never the entire record without justification under (d)(5).
- Business associates: a model or tool provider that creates, receives, maintains or transmits PHI for you is a business associate whether or not a contract exists. OCR's tracking technologies bulletin applies the same logic to tracking vendors on authenticated pages, and says cookie banners are not HIPAA authorisations. See the HIPAA Business Associate Agreements Guide.
- Accounting and audit: disclosures an agent makes outside TPO (for example to a public health portal) are accountable under 164.528. Log recipient, date, data and purpose at the agent level.
- Rights fulfilment: PHI copied into vector stores and agent memory may fall within the designated record set or affect amendment. Map where it goes.
An AI agent reaching non-public health statistics is shown in the OpenAI Agent Medicare Portal Breach 2026 (an Australian case, not HIPAA, but the access pattern is the same). See also the AI Agent Authorisation Guide and the AI Security in Healthcare Guide.
Compliance steps
- Map PHI flows. List systems, vendors, integrations and agents that create, receive or send PHI, with the permission each flow relies on.
- Build minimum necessary profiles. Define role and identity classes, the PHI categories each needs, and implement them in the EHR, data platform and API gateways. Pilot with one department, compare access logs with the profile, then enforce.
- Close business associate gaps. Match every vendor touching PHI to a signed agreement; where a vendor will not sign, de-identify first or stop the flow.
- Update the notice. Confirm your notice carries the Part 2 related elements in force since 16 February 2026 and does not rely on vacated elements; record distribution and acknowledgement.
- Operationalise rights. A tracked workflow for access, amendment and accounting with the 30 and 60 day clocks, identity verification and fee rules.
- Train, sanction, document. Role-based training, a sanctions policy applied consistently, six-year retention of policies and decisions.
- Review annually and on change. New AI use cases, new vendors and rule changes trigger a review. Roll back a failed access change by restoring the previous role mapping while keeping access logging on.
Measures and failure patterns
| Measure | Why it matters |
|---|---|
| Share of access requests completed within 30 days | Right of access is a frequent OCR enforcement theme |
| Identities (human and non-human) with access beyond their minimum necessary profile | Direct test of 164.514(d)(2) |
| PHI-handling vendors without a signed business associate agreement | Each one is an unpermitted disclosure risk |
| Accountable disclosures logged with all four 164.528 fields | An accounting you cannot produce is a violation |
| Inappropriate access alerts (snooping on staff or VIP records) investigated within a set time | Shows minimum necessary is monitored, not just configured |
- Tracking pixels on patient portals: third-party scripts on authenticated pages sending PHI to vendors with no agreement.
- Broad EHR roles: every clinician can open every record, so minimum necessary rests on trust and audits only.
- Treating access requests as records requests: slow, paper-only responses and fees outside the cost-based components.
- Stale notice: the Notice of Privacy Practices not updated for the February 2026 changes.
- Shadow AI: staff pasting PHI into consumer AI tools without a business associate agreement.
Framework anchors: NIST SP 800-53 AC-6 Least Privilege and the PT family for PII processing, CSF 2.0 PR.AA-05 for access permissions and ISO/IEC 27001:2022 Annex A 5.34 Privacy and protection of PII. These are related controls, not equivalents. See the NIST SP 800-53 PT PII Processing and Transparency guide and the Healthcare Cyber Regulation Map.
Practitioner checklist
- Document the permission relied on for every PHI flow, including agent and integration flows.
- Define minimum necessary profiles by role and by non-human identity, and enforce them in systems.
- Hold a signed business associate agreement for every vendor that handles PHI, including AI and tracking vendors.
- Confirm the Notice of Privacy Practices reflects the changes in force since 16 February 2026.
- Run access, amendment and accounting requests on tracked 30 and 60 day clocks.
- Log accountable disclosures with date, recipient, description and purpose.
- Monitor inappropriate record access and apply sanctions consistently.
- Keep policies, notices, authorisations and decisions for six years.
Standards and references
- eCFR: 45 CFR Part 164 Subpart E, Privacy of Individually Identifiable Health Information
- HHS: Summary of the HIPAA Privacy Rule
- HHS: HIPAA Privacy Rule Final Rule to Support Reproductive Health Care Privacy, Fact Sheet
- HHS: Fact Sheet, 42 CFR Part 2 Final Rule
- HHS: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
- HHS: HIPAA Regulatory Initiatives
Related NHI Mgmt Group resources: HIPAA Security Rule Guide · HIPAA Breach Notification Rule Guide · HIPAA Business Associate Agreements Guide · Healthcare Identity Security Guide. This guide summarises the HIPAA Privacy Rule and is not legal advice.