Module 02 · Free · 4:55
HIPAA Privacy Rule
The Privacy Rule, Privacy Officer designation, workforce confidentiality practices, the 30-day patient access right, the two different retention clocks, and the penalty tiers for non-compliance.
The Privacy Rule sets national standards for how PHI can be used and disclosed and defines the rights patients have over their own information. This module covers the Privacy Rule's operational requirements — Privacy Officer designation, workforce confidentiality practices, patient access rights, state-varying record retention, and the penalties that apply when practices fall out of compliance.
Regulatory anchors
- 45 CFR §164.502
- 45 CFR §164.524
- 45 CFR §164.530(a)
- 45 CFR §164.530(j)
- 45 CFR §160.404
Hosted on the Patient Protect YouTube channel
HIPAA Privacy Rule Explained: Patient Rights, Record Retention & Penalties
The Privacy Rule is the part of HIPAA that governs how patient information is used, disclosed, and protected during ordinary healthcare operations. It applies to Protected Health Information in every form — a conversation at the front desk, a chart in the operatory, a printed after-visit summary, an email to a referring provider. For a workforce member, understanding the Privacy Rule is what turns compliance from a document on a shelf into behavior you can practice: what you can say and to whom, when a family member can be involved, how to handle a patient's request for their records, and what to do when the workflow makes privacy inconvenient. This module builds the recognition. The reference layer on the Patient Protect site goes deeper for the situations that need it.
Learning objectives
What the workforce should be able to do after this module.
- Define and understand the HIPAA Privacy Rule
- Learn how the Privacy Rule is implemented in a healthcare practice
- Understand patient rights under the Privacy Rule
- Recognize compliance requirements and the penalty tiers for non-compliance
Assessment: 5 knowledge-check questions per module, 80% passing standard.
Module outline
Section-by-section walkthrough.
01
What the Privacy Rule is
The Privacy Rule is a set of national standards that protects patients' medical records and other personal health information. It establishes guidelines on how PHI and ePHI can be used and disclosed, and ensures patients have rights over their health information — including access and control.
02
Assigning a HIPAA Privacy Officer
Each practice must designate a HIPAA Privacy Officer. This individual oversees compliance, maintains policies, and ensures all staff members are properly trained on HIPAA regulations. This is a required designation, not an optional role.
03
Maintaining patient confidentiality
Confidentiality must be maintained at all times. That means not discussing patient information with unauthorized individuals; avoiding the use of full patient names in public or shared spaces; and ensuring conversations about treatment are conducted in a private, secure environment. Family members are not automatically unauthorized: §164.510(b) permits involvement where the patient agrees, where the patient has previously acquiesced while the family member was involved in care, or where the patient is incapacitated and the disclosure is in their best interest in the provider's professional judgment. The disclosure is then limited to what is directly relevant. What is not a pathway is convenience.
04
Patient rights — the 30-day access standard
Patients have the right to access, review, and request changes to their medical records. Providers must act no later than 30 calendar days after the request, with one written 30-day extension available. State law can give patients faster or greater access; it cannot give a practice longer than HIPAA allows. Patient Protect holds the documentation of how a practice handled a request — it is not a patient portal and does not deliver records.
05
Record retention — HIPAA documentation and state medical records are different clocks
HIPAA requires the documentation the Privacy Rule calls for — policies, notices, authorizations, designations — to be kept six years from creation or last effective date (§164.530(j)). How long the medical record itself must be kept is state law, and it varies; minors' records commonly run longer, often measured from the age of majority. Professional-board and payer rules can add more. Check your own state rather than a national figure.
06
Penalties for non-compliance
Failure to comply with the HIPAA Privacy Rule can result in significant penalties. Two figures matter here and they are not the same figure. The codified calendar-year cap for identical violations of the same provision is $2,190,294, and the 45 CFR §102.3 table applies it at every culpability tier (2025-adjusted). But under a 2019 enforcement-discretion notice that remains in force, OCR says it applies lower annual limits to the first three tiers and reserves the full cap for willful neglect left uncorrected. So the codified ceiling is not what a practice that did not know should expect OCR to apply. What varies by tier in the codified table is the per-violation amount, from $145 up to $73,011. Proper training, consistent processes, and secure systems are the ordinary defense against those amounts.
What the Privacy Rule governs
The Privacy Rule (45 CFR Part 164, Subpart E) does three big things. First, it sets national standards for how PHI may be used and disclosed by covered entities and business associates — for treatment, payment, healthcare operations, and a defined set of other permitted uses. Second, it grants patients specific rights over their own information — access, amendment, accounting of disclosures, restrictions, and confidential communications. Third, it requires covered entities to implement administrative policies, workforce training, and physical practices that keep PHI reasonably safeguarded.
Everything in this module traces back to one of those three functions. When the front desk lowers a voice at reception, that is a physical safeguard supporting the use-and-disclosure standard. When a patient calls asking for their records, that is a patient-right standard the practice has to honor. When the practice writes a policy about who can view which records, that is an administrative requirement.
The "minimum necessary" idea
The Privacy Rule requires covered entities to make reasonable efforts to limit the use, disclosure, and request of PHI to the minimum necessary to accomplish the intended purpose. It applies to workforce access (who inside the practice sees what), to disclosures the practice makes, and to requests the practice sends to other covered entities.
Minimum-necessary does not apply to disclosures to or requests by a treating provider (treatment purposes are broad), to the individual patient themselves, when the patient has authorized the disclosure, to disclosures required by law, to disclosures to HHS for enforcement, or to uses and disclosures required for compliance with the Administrative Simplification rules — the six exceptions at §164.502(b)(2). Outside those, it applies.
In practice this shows up as role-based access to the EHR (a hygienist sees the chart, not the billing detail unless needed), as workflows that filter what goes into a referral packet, and as policies about which staff can pull which reports.
Patient rights the workforce actually encounters
The Privacy Rule creates several patient rights, but four of them come up in ordinary front-of-house work often enough that every workforce member should recognize them.
Right of access (§164.524) — a patient has the right to inspect and receive a copy of their own PHI held in a designated record set. The default deadline is 30 days from the request, with a possible 30-day extension if the practice notifies the patient in writing. The patient can request the copy in a specific format (electronic, printed) and the practice must accommodate if it is readily producible. Fee limits apply; the practice cannot charge search or retrieval fees.
Right to request amendment (§164.526) — a patient can ask the practice to correct information they believe is incorrect. The practice can deny in limited circumstances but must document its decision and let the patient submit a statement of disagreement that travels with the record.
Right to an accounting of disclosures (§164.528) — a patient can request a list of certain disclosures the practice has made in the prior six years (with exceptions for treatment, payment, and healthcare operations disclosures, and disclosures the patient authorized).
Right to request confidential communications (§164.522(b)) — a patient can ask that communications reach them by an alternate means or at an alternate location (a mobile number instead of a home phone, a P.O. box instead of a home address). A covered provider must accommodate reasonable requests without requiring the patient to explain why.
The Privacy Officer and workforce responsibilities
Every covered entity must designate a Privacy Officer responsible for the development and implementation of the entity's privacy policies and procedures (§164.530(a)). In a small practice this is often the practice owner, office manager, or another senior staff member — the designation itself has to exist in writing.
The Privacy Officer's job is not to police every interaction — it is to make sure policies exist, staff are trained, complaints have a place to go, and violations are handled consistently. Workforce members interact with the Privacy Officer when they have a question about whether a disclosure is permitted, when they need to report a possible incident, or when a patient has a complaint the practice needs to route.
The rule expects the practice to sanction workforce members who violate its policies. In practice that means a written sanction policy, applied consistently. HHS does not prescribe specific penalties, but a documented and applied policy is one of the things OCR examines during an audit.
Permitted use vs. authorization required
The Privacy Rule distinguishes between disclosures a covered entity may make without patient authorization (broadly, treatment / payment / healthcare operations plus a defined list of public-interest categories) and disclosures that require the patient's written authorization. A few common ones:
| Situation | Category | Authorization required? |
|---|---|---|
| Sending the chart to a specialist the patient is being referred to | Treatment | No |
| Submitting a claim to the patient's insurance plan | Payment | No |
| Sharing PHI with the practice's shredding vendor under BAA | Healthcare operations (with BAA) | No |
| Selling a patient list to a marketing company | Marketing / sale of PHI | Yes — written authorization |
| Using a patient testimonial in an advertisement | Marketing use | Yes — written authorization |
| Releasing records to a life insurance company | Third-party non-treatment / non-payment | Yes — written authorization |
In practice
Privacy Rule situations that come up in every practice
These are ordinary front-of-office and treatment-area situations. Each raises a Privacy Rule consideration a workforce member should recognize on the spot.
A patient's adult daughter calls the practice asking about her father's next appointment.
Unless the father has documented consent for the practice to share information with the daughter — or the practice can reasonably infer consent from prior interactions — the workforce member should not confirm or discuss anything about the father's care. "I can leave a message for the patient to call you back" is a safe response.
A patient hands the front desk a sticky note asking that the practice not leave voicemails on their home phone and to text a mobile number instead.
This is a request for confidential communications under §164.522(b). Reasonable requests must be accommodated without requiring the patient to explain why. Document the preference in the patient's record and make sure downstream systems respect it (appointment reminders, follow-up calls, etc.).
A hygienist overhears the practice manager tell a friend that a mutual acquaintance is being seen for a specific condition.
This is a Privacy Rule violation regardless of whether the friend is a healthcare worker. The disclosure was not for treatment, payment, or operations. The hygienist should report through the practice's designated channel — that is why a documented complaint / reporting workflow exists.
A patient asks the front desk for a copy of their imaging from the last 5 years, on a USB drive.
This is a §164.524 access request. The practice has 30 days (with a possible 30-day extension in writing). If the imaging is readily producible on a USB drive, that format has to be accommodated. Fees are limited to labor and supply cost of the copy — no search or retrieval fees.
A staff member is filling in at reception and starts talking to a patient about their upcoming procedure at the check-in counter, in front of other patients waiting to be seen.
Reasonable safeguards under the Privacy Rule mean holding conversations that reveal specific clinical information out of earshot of unrelated parties. Move the conversation to a private consult area, or provide a written summary the patient can review privately. The rule does not require perfect isolation — it requires the reasonable step that fits the setting.
Sample knowledge check
A representative question from this module.
Sample question · 5 per module in the live series
A patient calls your practice and asks for a copy of her medical records. Under the HIPAA Privacy Rule, what is the standard timeframe within which the practice must provide access?
- A.Within 24 hours of the request.
- B.Within 30 days of the request, although the timeframe may vary by state.
- C.Within 6 months of the request.
- D.The practice is not required to provide patients with access to their own records.
Show explanation
Correct answer: B. The Privacy Rule requires providers to act no later than 30 calendar days after the request, with one written 30-day extension available. State law survives only where it is more protective — it can require faster access, but it cannot give a practice longer than HIPAA allows.
Common questions
Follow-up questions this module tends to raise.
Can staff discuss a patient with another employee?
Yes, when the discussion serves treatment, payment, or healthcare operations and is limited to what the other employee needs to know. A hygienist and a dentist reviewing a shared patient's chart before the visit is a routine, permitted use. Two workforce members gossiping about a patient over lunch is not.
Can family members receive information about a patient?
In general, only with the patient's consent, unless the patient is a minor and the person is a parent or legal guardian, unless the patient has previously agreed or acquiesced when the family member was involved in care, or unless the patient is incapacitated and the disclosure is in their best interest based on the provider's professional judgment. Even then, the disclosure is limited to what is directly relevant to that person's involvement in the patient's care.
Can a patient's name be said at the front desk?
Yes — the Privacy Rule specifically permits incidental disclosures that occur as a byproduct of an otherwise permitted use, as long as the practice has applied reasonable safeguards. Calling a patient's first name to bring them back for care is such a disclosure. What the rule does not permit is compounding it — announcing the reason for the visit, the procedure they are here for, or the medication they are picking up.
What should staff do if a patient asks for their records?
Route the request to the Privacy Officer or the designated records custodian, log the request with the date, confirm the format the patient wants, and produce a copy within 30 days (with a possible 30-day extension in writing). The patient cannot be charged search or retrieval fees; the practice can charge for the labor and supply cost of the copy and any postage. Denials are only permitted in limited circumstances — do not deny without escalating.
Does the Privacy Rule prohibit texting a patient?
No. The Privacy Rule permits a covered provider to use the communication method a patient requests, provided the provider explains the risks of unencrypted communication and documents the patient's decision. What the rule does not permit is an ungoverned channel with no record — texting a patient from a personal phone with no acknowledgment on file, no policy, and no way to produce the message later is not defensible. The Security Rule dimension of this (workforce devices, encryption) is covered in Module 3.
Primary sources and further reading
Where the content on this page comes from.
- 45 CFR Part 164, Subpart E — Privacy Rule
The full text of the Privacy Rule.
- OCR — Individual Right of Access
HHS guidance on how the right-of-access standard works in practice, including the fee limits.
- Patient Protect — HIPAA Privacy Rule reference
Deep reference layer covering permitted disclosures, patient rights, and minimum-necessary in operational detail.
- OCR — Sharing Information with Family and Friends
Federal guidance on when family involvement in care is permitted without written authorization.
Continue learning
Where to go next.
Related Patient Protect resources
HIPAA Privacy Rule reference
The deeper reference layer for permitted disclosures, minimum necessary, and the full set of patient rights.
HIPAA Security Rule training (next module)
How the Privacy Rule's disclosure standards translate into technical safeguards for electronic information.
HIPAA training documentation OCR asks for
What OCR expects to see if it audits your training program.
HIPAA glossary
Every Privacy Rule term with regulatory citations.
Up to 50independent practices receive one year of complete HIPAA Foundations training — free.
Selected offices receive all 19 modules, 95 knowledge checks, administrator tracking, and QR-verifiable Certificates of Completion for up to 25 personnel. No hidden conversion. No public review required. Applications close November 30.
See the initiativeModule 02 of the HIPAA Foundations series
Every learner. Every module. One office price.
When you are ready to train the whole practice, the complete 19-module HIPAA Foundations series unlocks for up to 25 personnel at $39/office/month — with per-learner assessment scores, verifiable Certificates of Completion, and workforce-wide tracking.
Free tools stay free — no account needed. The 14-day platform trial asks for a card for identity verification; no charge before day 14, cancel any time.