Does the Privacy Rule apply to every healthcare provider?

It applies to providers that transmit health information electronically in connection with a HIPAA standard transaction, such as billing a health plan electronically. Most practices that bill insurance meet that test.

Can a practice share information with a patient’s family?

Often, yes. If the patient is present and does not object, or if in professional judgment it is in their interest, a provider may share information relevant to the family member’s involvement in care (45 CFR 164.510(b)).

How long do we have to answer a records request?

30 calendar days from receipt, with one extension of up to 30 more days if you tell the patient in writing why and when they will get it (45 CFR 164.524(b)).

The HIPAA Privacy Rule

The Privacy Rule (45 CFR Part 164, Subpart E) sets the national standards for when protected health information can be used and disclosed, and gives patients rights over their own records.

Last reviewed against the Code of Federal Regulations (45 CFR Parts 160 and 164) and HHS OCR guidance linked on this page on October 22, 2026.

The short answer

A covered entity may use and disclose PHI for treatment, payment, and healthcare operations without the patient’s authorization, and for a defined list of public-interest purposes. Most other uses need the patient’s written authorization. Patients have rights to see and get copies of their records, ask for corrections, and get an accounting of certain disclosures.

Who and what it covers

Covered entities: health plans, healthcare clearinghouses, and healthcare providers that transmit health information electronically in connection with standard transactions such as claims (45 CFR 160.103 (opens in a new tab)).
Business associates that handle PHI for them, through their agreements.
Protected health information (PHI): individually identifiable health information held or transmitted by a covered entity or business associate, in any form — electronic, paper, or oral. Employment records held as an employer are excluded.

When PHI can be used or shared

Treatment, payment, and healthcare operations — no authorization needed.
Required by law and public-interest purposes listed in 45 CFR 164.512, such as public health reporting, health oversight, certain law enforcement requests, and judicial proceedings, each with its own conditions.
Opportunity to agree or object for things like facility directories and sharing with family involved in care.
Everything else — for example most marketing and any sale of PHI — needs the patient’s written authorization (45 CFR 164.508).

The minimum necessary standard

When PHI is used or disclosed, covered entities must make reasonable efforts to limit it to the minimum necessary for the purpose (45 CFR 164.502(b) and 164.514(d)). The standard does not apply to disclosures to a provider for treatment, to the patient, under an authorization, or as required by law. In practice it means role-based access: the front desk sees what scheduling needs, not the whole chart.

Patient rights under the Privacy Rule

Patient rights under the Privacy Rule
Right	Regulation	In practice
Notice of privacy practices	164.520	Patients get a notice explaining how their PHI is used and their rights.
Access to records	164.524	Respond within 30 days of the request, with one 30-day extension if needed. Fees are limited to a reasonable, cost-based amount.
Amendment	164.526	Patients can ask for a correction; denials must be in writing.
Accounting of disclosures	164.528	A list of certain disclosures made in the prior six years.
Request restrictions	164.522(a)	Must agree not to send PHI to a health plan for an item paid in full out of pocket, if the patient asks.
Confidential communications	164.522(b)	Accommodate reasonable requests to be contacted another way or at another address.

Summary only; each right has conditions and exceptions in the cited section.

Administrative requirements

Under 45 CFR 164.530 (opens in a new tab), a covered entity must designate a privacy official and a contact person for complaints; train its workforce; put administrative, technical, and physical safeguards in place; have a complaint process and sanctions for workforce violations; mitigate harmful effects of improper disclosures; not retaliate against people who exercise their rights; and keep its policies and required documentation for six years.

Common questions

Does the Privacy Rule apply to every healthcare provider?: It applies to providers that transmit health information electronically in connection with a HIPAA standard transaction, such as billing a health plan electronically. Most practices that bill insurance meet that test.
Can a practice share information with a patient’s family?: Often, yes. If the patient is present and does not object, or if in professional judgment it is in their interest, a provider may share information relevant to the family member’s involvement in care (45 CFR 164.510(b)).
How long do we have to answer a records request?: 30 calendar days from receipt, with one extension of up to 30 more days if you tell the patient in writing why and when they will get it (45 CFR 164.524(b)).

Sources

Summary of the HIPAA Privacy Rule (opens in a new tab) — HHS Office for Civil Rights
45 CFR § 160.103 — Definitions (business associate, covered entity, PHI) (opens in a new tab) — Electronic Code of Federal Regulations
45 CFR § 164.524 — Access of individuals to PHI (opens in a new tab) — Electronic Code of Federal Regulations
45 CFR § 164.530 — Administrative requirements (opens in a new tab) — Electronic Code of Federal Regulations
45 CFR § 164.520 — Notice of privacy practices (opens in a new tab) — Electronic Code of Federal Regulations

Questions about this page

Ask about anything explained here, or tell us if a citation is out of date. We can point you to the HHS source; we cannot advise on your organisation’s obligations. Do not send protected health information through this form.

Get in touch