HIPAA Privacy Rule (for Professionals)

20211001_rev01 · COMPARED WITH 20210116_rev01 · ARCHIVE SNAPSHOT, DATE APPROXIMATE

Full text changes — 20210116_rev01 to 20211001_rev01

1## The HIPAA Privacy Rule
2
31The HIPAA Privacy Rule establishes national standards to protect individuals' medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically. The Rule requires appropriate safeguards to protect the privacy of personal health information, and sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization. The Rule also gives patients rights over their health information, including rights to examine and obtain a copy of their health records, and to request corrections.
42
53The Privacy Rule is located at 45 CFR [Part 160](http://www.access.gpo.gov/nara/cfr/waisidx_07/45cfr160_07.html) and Subparts A and E of [Part 164](http://www.access.gpo.gov/nara/cfr/waisidx_07/45cfr164_07.html).
64
75[Click here to view the combined regulation text](https://hhs.gov/hipaa/for-professionals/privacy/laws-regulations/combined-regulation-text/index.html) of all HIPAA Administrative Simplification Regulations found at 45 CFR 160, 162, and 164.
86
1614- April 23, 2013 - [HIPAA Privacy Rule and NICS - Advance Notice of Proposed Rulemaking](https://www.govinfo.gov/content/pkg/FR-2013-04-23/pdf/2013-09602.pdf)
1715- January 25, 2013 - [Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health (HITECH) Act and the Genetic Information Nondiscrimination Act, and Other Modifications - Final Rule](https://www.govinfo.gov/content/pkg/FR-2013-01-25/pdf/2013-01073.pdf) (The "Omnibus HIPAA Final Rule")
1816- September 14, 2011 - [Patients' Access to Test Reports Under the HIPAA Privacy Rule and CLIA Program - Proposed Rule](https://www.govinfo.gov/content/pkg/FR-2011-09-14/pdf/2011-23525.pdf)
1917- May 31, 2011 - HIPAA Privacy Rule Accounting of Disclosures Under the HITECH Act - Proposed Rule ([https://www.govinfo.gov/content/pkg/FR-2011-05-31/pdf/2011-13297.pdf](https://www.govinfo.gov/content/pkg/FR-2011-05-31/pdf/2011-13297.pdf))
2018- July 14, 2010 - [Modifications to the HIPAA Privacy, Security, and Enforcement Rules under the HITECH Act - Proposed Rule](https://www.govinfo.gov/content/pkg/FR-2010-07-14/pdf/2010-16718.pdf)
2119- May 3, 2010 - HIPAA Privacy Rule Accounting of Disclosures Under the HITECH Act - Request for Information ([https://www.govinfo.gov/content/pkg/FR-2010-05-03/pdf/2010-10054.pdf](https://www.govinfo.gov/content/pkg/FR-2010-05-03/pdf/2010-10054.pdf))
22- October 7, 2009 - [HIPAA Privacy Rule; Modifications Under the Genetic Information Nondiscrimination Act - Proposed Rule](https://hhs.gov/sites/default/files/ocr/privacy/hipaa/understanding/special/genetic/ginanprm.pdf)
20- October 7, 2009 - [HIPAA Privacy Rule; Modifications Under the Genetic Information Nondiscrimination Act - Proposed Rule](https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/understanding/special/genetic/ginanprm.pdf)
2321- August 14, 2002 - [Modifications to the HIPAA Privacy Rule - Final Rule](https://hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/privruletxt.txt) ([PDF](https://hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/privrulepd.pdf))
2422- March 27, 2002 - [Modifications to the HIPAA Privacy Rule - Proposed Rule](https://hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/propmods.txt) ([PDF](https://hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/2002proposedmods.pdf))
2523- February 28, 2001 - [Request for Comments on December 28, 2000, Final HIPAA Privacy Rule](https://hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/comment.txt) ([PDF](https://www.gpo.gov/fdsys/pkg/FR-2001-02-28/pdf/01-4811.pdf))
2624- February 26, 2001 - [Correction of Effective and Compliance Dates of the Final HIPAA Privacy Rule](https://hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/dates.txt) ([PDF](https://hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/dates.pdf))
2725- December 29, 2000 - [Technical Corrections to the Final HIPAA Privacy Rule](https://hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/pvcfix01.txt) ([PDF](https://hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/pvcfix01.pdf))
2826- December 28, 2000 - HIPAA Privacy Rule - Final Rule ([PDF](https://hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/prdecember2000all8parts.pdf))
3432
3533## Other Privacy Rule Notices
3634
3735- March 20, 2003 - Notice of Addresses for Submission of HIPAA Health Information Privacy Complaints ([PDF](https://hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/noticeaddresssubmission.pdf))
3836- March 11, 2003 - [Notice of Address for Submission of Requests for Preemption Exception Determinations](https://hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/notice.txt) ([PDF](https://hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/notice.pdf))
3937- December 28, 2000 - [Statement of Delegation of Authority to the Office for Civil Rights](https://hhs.gov/hipaa/for-professionals/privacy/delegation-of-authority/index.html) ([PDF](https://hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/privacyrule/fedreg.pdf))
40
41Content created by Office for Civil Rights (OCR)
42Content last reviewed on December 10, 2020