The Privacy Rule, enforced by the U.S. Department of Health and Human Services (HHS), establishes national standards to protect individuals’ medical records and other personal health information.
It applies to:
-
Covered entities (providers, plans, clearinghouses)
-
Business associates (vendors who handle PHI on behalf of covered entities)
What Does the Privacy Rule Do?
-
Limits who can access PHI: Only those with a legitimate need should access it.
-
Defines when information can be shared: There are specific situations where PHI can be disclosed without patient authorization.
-
Gives patients control: Patients have rights to see and control their own health information.
Types of Information Protected:
-
Paper, electronic, and oral forms of PHI
-
Information such as past, present, or future health conditions, treatments, and payments
Example: If a receptionist sees a chart on the printer and leaves it out where others can see — that’s a potential privacy violation.