The Privacy Rule decides who may see health information, and for what.

The Privacy Rule is about permission. It says when a hospital, insurer or their vendor may use or share someone's health information, when it needs the person's written authorisation, and what the person can demand back. It covers paper charts and phone calls as much as databases.

Spelled out: Standards for Privacy of Individually Identifiable Health Information, 45 CFR Part 164 Subpart E.

Most everyday healthcare uses are allowed without asking: treatment, payment and healthcare operations. Almost everything else, such as most marketing or selling data, needs a signed authorisation. Even permitted uses are limited by the minimum necessary standard, so a billing clerk should not see the full clinical note. Patients get rights to receive a notice of privacy practices, to access and get a copy of their records, to ask for corrections, and to receive an accounting of certain disclosures. For a business associate the Rule matters because your BAA can only let you do what the covered entity itself could do, and your product must help the client meet access and amendment requests on time.

45 CFR 164.502 and 164.506

The general rules on uses and disclosures, and the treatment, payment and operations permission.

45 CFR 164.524

The right of access: generally a response within 30 days, with one 30-day extension.

The Notice of Privacy Practices

The document a provider gives patients explaining uses, disclosures and rights, required by 164.520.

Product requirements

Role-based views, export of a patient's records and disclosure logs are often driven by this Rule.

HIPAA Security Rule

The Security Rule covers only electronic health data and is about safeguards. The Privacy Rule covers all forms and is about who may use or share the data, and patient rights.

Breach Notification Rule

Tells you whom to notify, and when, after unsecured health data is compromised. A Privacy Rule violation can trigger it, but it is a separate subpart.

• Map each use of health data in your product to a permitted purpose or a signed authorisation.
• Design access by role so each user sees the minimum necessary for their job.
• Make sure clients can export a patient's records and correct them within the Rule's timelines.
• Keep a log of disclosures that would appear in an accounting request.

• GuideThe HIPAA Privacy RuleUses and disclosures, patient rights, and the minimum necessary idea.
• GuideWhat counts as PHI?Protected health information, the identifiers, and when data stops being PHI.
• GuideThe Breach Notification RuleWhat counts as a breach, who is told, and the clocks that run.

Sources: 45 CFR Part 160 and Part 164 Subparts A and E, including Sections 164.502, 164.506, 164.508, 164.514(d), 164.520, 164.524, 164.526 and 164.528; HHS summary of the HIPAA Privacy Rule.