HIPAA Privacy Rule Overview

The HIPAA Privacy Rule protects a patient's fundamental right to privacy and confidentiality.

You are considered a covered entity if you are a healthcare provider, health plan, or healthcare clearinghouse that transmits health information electronically.

Protected Health Information (PHI) is anything that connects a patient to their health information.

PHI includes all health information, except PHI in oral form.

You are permitted to use/disclose PHI for treatment, payment, and healthcare operations.

Authorization must be obtained for any use/disclosure of PHI for marketing purposes.

The Privacy Rule gives patients the right to take action if their privacy is violated.

After signing an authorization, the patient can revoke it.

In general, disclosure of PHI must be limited to the least amount needed to get the job done.

If you need help understanding the rules, the Department of Health and Human Services is required to provide assistance.