The Privacy Rule in plain English

This is a plain-language translation of the HIPAA Privacy Rule, keeping the section structure of the official text with simplified wording. The Privacy Rule is by far the longest of the rules, so this translation is faithful but condensed: every section is here, and highly situational detail is summarized rather than reproduced. It is a study aid, not the law itself; for the exact binding language, use the linked eCFR text, which is the authority everywhere this page and the regulation could be read differently.

One correction before anything else, because most sources get it wrong. In April 2024, HHS finalized amendments adding special protections for reproductive health care information (89 FR 32976). In June 2025, a federal court vacated nearly all of those amendments nationwide (Purl v. HHS, No. 2:24-cv-00228-Z, N.D. Tex., June 18, 2025), and HHS did not appeal. The text still sits in the Code of Federal Regulations. It has no legal force. A translation that ignored that would be translating a ghost. Every affected spot below carries a vacated flag. One piece of the 2024 rule survived: the Notice of Privacy Practices changes for substance use disorder records under 42 CFR Part 2, which took effect February 2026.

164.502 Uses and disclosures: the general rules

(a) The master switch. You may use or disclose PHI only when this rule permits or requires it.

“The text still sits in the Code of Federal Regulations. It has no legal force. A translation that ignored that would be translating a ghost.”

You are PERMITTED to use or disclose PHI: (1) to the individual themselves; (2) for treatment, payment, or health care operations under 164.506; (3) incidentally to a permitted use or disclosure, if you applied minimum necessary and reasonable safeguards; (4) under a valid authorization per 164.508; (5) with the informal agreement machinery of 164.510 (family involvement, directories); and (6) under the no-authorization situations listed in 164.512 and the special provisions of 164.514(e), (f), and (g).

You are REQUIRED to disclose PHI in exactly two situations: to the individual when they exercise their access right (164.524) or accounting right (164.528), and to HHS when it investigates your compliance.

(a)(5) Prohibited uses. A health plan may not use genetic information for underwriting. You may not sell PHI without an authorization that says the disclosure results in payment to you. Vacated: the 2024 amendments added a third prohibition here, 164.502(a)(5)(iii), barring uses and disclosures to investigate or impose liability for seeking or providing lawful reproductive health care; that paragraph was vacated in Purl and is not enforceable.

(b) Minimum necessary. When using, disclosing, or requesting PHI, make reasonable efforts to limit it to the minimum needed for the purpose. It does NOT apply to: disclosures to or requests by a provider for treatment; disclosures to the individual; uses or disclosures under an authorization; disclosures to HHS; and uses or disclosures required by law.

(c) through (j), rapid fire. If you agreed to a restriction under 164.522, honor it. Properly de-identified information is no longer PHI, but a re-identification key is. Disclosures to a business associate require the written assurances of a BAA. A deceased person’s PHI stays protected for 50 years. A personal representative is generally treated as the individual; for an unemancipated minor that is usually a parent or guardian, with narrow exceptions where the minor lawfully consented to care themselves, and you may decline to treat someone as a representative where you reasonably believe abuse or endangerment. Honor confidential communication requests per 164.522(b). Do not use or disclose PHI inconsistently with your own Notice of Privacy Practices. And whistleblowers acting in good faith, and workforce crime victims making limited reports, are not violations.

164.504 Organizational requirements

(e) The BAA contents. A business associate contract must: set the permitted uses and disclosures (the associate cannot be given more than you could do yourself, except its own management and data aggregation); require appropriate safeguards including Security Rule compliance for ePHI; require reporting of improper uses, disclosures, and breaches; bind subcontractors to the same restrictions; support the individual rights (access, amendment, accounting); make books and records available to HHS; and require return or destruction of PHI at termination where feasible. You must be able to terminate for material violation, and if you know of a pattern of violations and do nothing, you are out of compliance yourself. The same requirements flow down between business associates and their subcontractors.

(f) Group health plans and plan sponsors. A plan may share PHI with the employer sponsoring it only under plan-document restrictions: administration purposes only, no employment decisions, required separation, and safeguards. Mostly not clinic territory.

(g) Multiple covered functions. An organization that is more than one kind of covered entity complies separately for each function.

164.506 Treatment, payment, and health care operations

You may use and disclose PHI for your own treatment, payment, and health care operations without an authorization. You may disclose PHI: for another provider’s treatment; to another covered entity or provider for the recipient’s payment activities; to another covered entity for its operations where you both have a relationship with the individual, the PHI pertains to it, and the purpose is quality, competence, or fraud detection; and within an organized health care arrangement for its joint operations. Consent for TPO is optional and never substitutes for a required authorization.

164.508 Authorizations

(a) When one is required. For any use or disclosure the rule does not otherwise permit. Three categories always need one: psychotherapy notes (with narrow exceptions such as the author’s own treatment use and defending against an action the individual brought); marketing (except face-to-face communications and nominal promotional gifts, and paid marketing must say who paid); and any sale of PHI.

(b) and (c) What makes it valid. A specific and meaningful description of the information; who may disclose; who may receive; the purpose; an expiration date or event; and a dated signature. Plus three statements: the right to revoke in writing, whether treatment or payment can be conditioned on signing (generally it cannot), and the redisclosure warning. Plain language, and the individual gets a copy. Defective if expired, incomplete, revoked, improperly compounded, or known to be materially false.

Vacated note: the 2024 amendments also created 164.509, a required attestation before certain disclosures of PHI potentially related to reproductive health care. Section 164.509 was vacated in its entirety in Purl. There is no attestation requirement in force, and a form demanding one has no current legal basis.

164.510 The agree-or-object situations

Two situations where verbal agreement is enough, after giving the individual a chance to object:

(a) Facility directories. A provider may keep name, location, general condition, and religious affiliation in a directory, shared with clergy or with people who ask by name, unless the individual objects. Emergencies get a best-interest exception with a later chance to object.

(b) Family and others involved in care. You may share with a family member, friend, or person the individual identifies the PHI directly relevant to that person’s involvement in care or payment, and may notify family of location, condition, or death. If the individual is present and capable: get agreement, give a chance to object, or reasonably infer no objection. If not present or incapacitated: professional judgment about their best interest, sharing only what is relevant, for example letting someone pick up materials or supplies. Disaster relief organizations get a coordination pathway. After death, you may share with those who were involved in care, unless it conflicts with a known prior preference.

For an ABA clinic this section is daily life: the grandparent at pickup, the aunt asking how the session went. The rule’s answer is narrower than habit: relevant-to-involvement sharing with the people the parent has brought into the circle, not open updates to anyone in the hallway.

164.512 The no-authorization situations

Twelve situations where PHI may move without authorization and without a chance to object, each with its own conditions. Condensed:

(a) Required by law, limited to what the law requires. (b) Public health: disease and vital-event reporting, child abuse and neglect reports to authorized authorities, FDA product safety, communicable disease exposure notification, limited workplace surveillance, and school immunization proof with documented parental agreement. (c) Victims of abuse, neglect, or domestic violence: reports to authorized agencies where required by law, agreed to, or necessary to prevent serious harm, generally with prompt notice to the individual unless that would endanger them. Vacated note: the 2024 addition at (c)(3), a reproductive-health limit on this provision, was vacated. (d) Health oversight: audits, investigations, licensure, and inspections of the health care system by oversight agencies. (e) Judicial and administrative proceedings: court orders, limited to what the order authorizes; subpoenas without an order only with satisfactory assurances of notice to the individual or a protective order. (f) Law enforcement: legal process; limited identifying information to locate a suspect or missing person (a short list, and never DNA or dental records for that purpose); victims, with agreement or under conditions; decedents where crime is suspected; crime on your premises; and crime reporting during off-site emergencies. (g) Decedents: coroners, medical examiners, funeral directors. (h) Organ and tissue donation. (i) Research: IRB or privacy board waiver, reviews preparatory to research, and decedent research, all with documentation. (j) To avert a serious and imminent threat: good-faith disclosure to someone able to prevent or lessen the threat, including the target; a presumption of good faith; and the admission-during-treatment limits. (k) Specialized government functions: military, national security, protective services, corrections, and the narrow NICS reporting lane. (l) Workers’ compensation, as authorized by those laws.

164.514 De-identification, minimum necessary detail, and the rest

(a) and (b) De-identification. Two accepted methods: an expert determination that re-identification risk is very small, documented; or the safe harbor, removing all eighteen listed identifier categories (names, geography smaller than state with a ZIP3 exception, all dates except year and all ages over 89, phone, fax, email, SSN, MRN, plan and account numbers, certificates, vehicle and device identifiers, URLs, IPs, biometrics, full-face photos, and any other unique identifier) with no actual knowledge the remainder could identify someone.

(c) Re-identification keys are themselves PHI and may not be disclosed or reverse-engineered.

(d) Minimum necessary, operationalized. Identify which roles need which categories of PHI and limit access accordingly; standard protocols for routine disclosures and case-by-case review for the rest; limit your own requests the same way; and do not use, disclose, or request an entire medical record unless specifically justified.

(e) Limited data sets. Strip sixteen direct identifiers but keep dates, town, state, and ZIP; usable only for research, public health, or operations, under a data use agreement binding the recipient to safeguards and no re-identification.

(f) Fundraising. Limited categories may be used to raise funds for yourself, only if your NPP says so, every solicitation has a clear opt-out, and opt-outs are honored.

(g) Underwriting PHI received for underwriting may be used only for that purpose, and never genetic information.

(h) Verification. Before disclosing, verify the identity and authority of a requester you do not know: documents reasonable on their face, badges and letterhead for officials, and professional judgment in the 164.510 situations.

164.520 Notice of Privacy Practices

Individuals have a right to adequate notice of your uses and disclosures, their rights, and your duties. Required content: the prescribed header; a description with examples of TPO uses; the other purposes you may use PHI without authorization; a statement that other uses require authorization, revocable; the fundraising opt-out and other separate statements where applicable; the individual rights; your legal duties, including breach notification; how to complain to you and to HHS, with no retaliation; a contact; and an effective date.

Vacated note: the 2024 amendments required NPP statements about the reproductive health prohibition and attestation, 164.520(b)(1)(ii)(F) through (H); those were vacated in Purl and are not required. The surviving 2024 change: NPPs must address 42 CFR Part 2 substance use disorder records, effective February 2026, which matters to you only if you hold Part 2 records.

Delivery: providers with a direct treatment relationship give the notice no later than first service, make a good-faith effort to obtain written acknowledgment, post it, and keep copies; plans distribute at enrollment with reminders; websites carry it; email delivery with agreement.

164.522 Restrictions and confidential communications

(a) Restriction requests. Individuals may request restrictions on TPO uses and family disclosures. You generally do not have to agree, but if you do, the restriction binds you except in emergencies. One restriction you MUST honor: no disclosure to a health plan for payment or operations where the individual paid for the item or service in full, out of pocket, and no law requires the disclosure. The self-pay family that asks you not to tell the insurer has a legal right, not a favor to ask.

(b) Confidential communications. Providers must accommodate reasonable requests to be contacted by alternative means or at alternative locations, and may not demand a reason. Health plans must accommodate where the individual states disclosure could endanger them. In a clinic this is the parent who asks that nothing go to the home address or the shared voicemail; build the intake field for it.

164.524 The right of access

Individuals may inspect and obtain a copy of their PHI in a designated record set for as long as you maintain it, except psychotherapy notes and litigation-compiled information.

Mechanics: you may require a written request; act within 30 days, one 30-day extension with written notice and a date; provide in the form and format requested if readily producible, including an electronic copy of electronically held PHI; send to a designated third party on a signed written request; and charge only a reasonable, cost-based fee for copying labor, supplies, postage, and an agreed summary. Never a retrieval fee.

Denials: a few grounds carry no review (the exceptions above, certain inmate and research situations, confidential sources); the reviewable grounds are professional judgments about endangerment, and a denial on those grounds gets review by a licensed professional not involved in the original decision. Deny only the part you may withhold, give the rest, and provide a plain-language written denial with complaint rights.

This is the most enforced individual right in HIPAA, the subject of OCR’s longest-running enforcement initiative, and in ABA it collides with a common myth: session notes are almost never psychotherapy notes, so the exclusion almost never applies. When a parent asks for the records, the 30-day clock is real and the data goes with it.

164.526 The right to amend

Individuals may ask you to amend their PHI in a designated record set. You may deny if you did not create it (unless the originator is unavailable), it is not in the designated record set, it would not be available for inspection, or it is accurate and complete. Act within 60 days, one 30-day extension with written notice. If you accept: make the amendment, tell the individual, and make reasonable efforts to notify persons they identify and others who hold and may rely on it. If you deny: a plain-language written denial, the right to file a statement of disagreement, your optional rebuttal with a copy to them, and the whole exchange travels with future disclosures of the record.

164.528 The accounting of disclosures

Individuals may request an accounting of disclosures of their PHI made in the six years before the request, EXCEPT disclosures: for TPO; to the individual; incident to permitted uses; under an authorization; for directories and involved persons; for national security or corrections; and as part of a limited data set. The accounting lists date, recipient, what was disclosed, and purpose; the first in any 12 months is free; oversight and law enforcement can obtain temporary suspensions. Because TPO is excluded, the accounting in practice captures the 164.512 disclosures: the subpoenas, the reports, the public health filings. Keep the log as you go; it cannot be reconstructed later.

164.530 The administrative requirements

The machinery behind everything above, and all of it required: designate a privacy official responsible for the policies and a contact for complaints; train all workforce members on your policies, new members within a reasonable time, and retrain on material changes, documented; maintain administrative, technical, and physical safeguards for PHI in all forms, including limiting incidental disclosures; provide a complaint process and document complaints and dispositions; apply and document sanctions against workforce members who violate your policies (mirrored by the Security Rule’s sanction requirement); mitigate, to the extent practicable, harmful effects of violations you learn of; no retaliation against anyone exercising rights or complaining; no requiring waiver of rights as a condition of treatment or enrollment; maintain written policies and procedures; and keep the documentation six years from creation or last effective date.

If the Security Rule’s documentation standard is where paper programs go to die, this section is its Privacy Rule twin: every obligation above generates a record, and the records are what an investigator asks for.