What The Privacy Rule Covers

The Privacy Rule, enforced by the U.S. Department of Health and Human Services (HHS), establishes national standards to protect individuals’ medical records and other personal health information.

It applies to:

  • Covered entities (providers, plans, clearinghouses)

  • Business associates (vendors who handle PHI on behalf of covered entities)

What Does the Privacy Rule Do?

  • Limits who can access PHI: Only those with a legitimate need should access it.

  • Defines when information can be shared: There are specific situations where PHI can be disclosed without patient authorization.

  • Gives patients control: Patients have rights to see and control their own health information.

Types of Information Protected:

  • Paper, electronic, and oral forms of PHI

  • Information such as past, present, or future health conditions, treatments, and payments

Example: If a receptionist sees a chart on the printer and leaves it out where others can see — that’s a potential privacy violation.

PreviousNext