HIPAA rules
The Privacy Rule, read from the vendor's side of the table.
The Privacy Rule (45 CFR Part 164, Subpart E) decides when protected health information may be used or shared, and what patients can demand. Most of it is written for providers and plans. A software company feels it through the contract: you may do only what your customer could do, and you must help it honour patient rights on time.
Back to HIPAA services01 · Who it binds
Two kinds of organisation, two kinds of duty
Covered entities own the rule; business associates inherit part of it.
Covered entity
Health plans, clearinghouses, billing providers
- Bound by the whole Privacy Rule
- Owes patients the notice and the individual rights
- Decides the purposes for which PHI is used
Business associate
Vendors acting for them
- May use PHI only as its business associate agreement allows
- Directly liable for uses the agreement does not permit
- Must pass PHI on only under the same terms to its own subcontractors
A covered entity can also be a business associate of another one, for example a hospital that runs billing for a smaller clinic.
02 · Uses and disclosures
Four lanes for using and sharing PHI
If an activity fits none of the lanes, it is not allowed.
The rule starts from a default of no. A use or disclosure is lawful only if a specific provision permits or requires it. In practice those provisions fall into four lanes.
- Treatment, payment and operationsThe everyday work of care, billing and running the organisation, including quality review and training. No patient permission needed.
- With the person's agreementFacility directories and sharing with family involved in care, where the person had a chance to agree or object.
- Public-interest purposesDefined cases such as public health reporting, health oversight, court orders, certain law enforcement requests, serious threats to safety and some research. Each has its own conditions.
- Written authorisationEverything else. Marketing, any sale of PHI and most uses of psychotherapy notes need a signed authorisation that meets the rule's content list.
Two disclosures are mandatory, not optional: to the individual when they ask for their own records, and to HHS when it investigates.
03 · Minimum necessary
Minimum necessary, turned into product decisions
Limit what each role, report and request can reach.
For most uses outside treatment, the organisation must make reasonable efforts to limit PHI to the least amount needed. The standard does not apply to disclosures for treatment, to the individual, under an authorisation, to HHS, or where law requires them. For a vendor, it shows up in three places.
- Role design. Support staff see the fields needed to fix a ticket, not the full chart.
- Routine exports. A standard report pulls a fixed, reviewed set of columns.
- One-off requests. Non-routine requests are reviewed against written criteria before data leaves.
04 · Patient rights
Each right, and what the organisation owes
The covered entity answers the patient; the vendor must make it possible.
| Right | What the organisation must do | Where a vendor comes in |
|---|---|---|
| Access to records | Act within 30 days, extendable once by 30 days with written reasons; give the form requested if readily producible; charge only a reasonable cost-based fee | Export a patient's records quickly in a usable electronic format |
| Amendment | Act within 60 days, extendable once by 30; if denied, explain and let the person file a statement of disagreement | Let the customer append or correct records and keep the history |
| Accounting of disclosures | List certain disclosures from the past six years, excluding treatment, payment and operations; answer within 60 days, extendable once by 30 | Log disclosures you make so the customer can include them |
| Request restrictions | Consider requests; must agree when a patient paid in full out of pocket and asks that a health plan not be told | Support flags that stop data flowing to named recipients |
| Confidential communications | Accommodate reasonable requests for a different address or channel | Store and honour alternate contact preferences |
| Notice of privacy practices | Give a plain-language notice of uses, rights and complaint routes; post it and keep it current | Rarely the vendor's job, unless you run the patient-facing app |
05 · Admin duties
The administrative requirements
The people and paperwork that prove the rule is followed.
- PR.1Privacy officialA named person owns privacy policies, plus a contact for complaints.
- PR.2Workforce trainingEveryone who touches PHI is trained on the policies their job needs, with records kept.
- PR.3SafeguardsAdministrative, technical and physical measures against misuse, on paper and in speech as well as in systems.
- PR.4Complaints processA route to complain, with no retaliation against those who use it.
- PR.5SanctionsWritten, applied consequences for staff who break the policies.
- PR.6MitigationSteps to reduce harm when a misuse becomes known.
- PR.7Policies and documentationWritten policies, kept for six years from creation or last effect, whichever is later.
Illustrative: a scheduling startup
A three-person team sells booking software to dental clinics. It is a business associate. Its realistic Privacy Rule workload is a use-and-disclosure section in each agreement it honours, a records export for access requests, a disclosure log, role-limited support access, training records and a named privacy lead. The notice of privacy practices stays with each clinic.
Sources: 45 CFR 160.103 (definitions); 45 CFR 164.502 to 164.514 (uses, disclosures, authorisations, minimum necessary); 45 CFR 164.520 to 164.528 (notice and individual rights); 45 CFR 164.530 (administrative requirements); HHS summary of the HIPAA Privacy Rule.
Privacy Rule questions
Can we use customer PHI to improve our product?
Only if the agreement allows it and the purpose fits the rule.
A business associate may use PHI only as its agreement permits, and the agreement cannot allow anything the covered entity itself could not do. Some purposes, such as your own management and administration or creating de-identified data, can be written in. Without that wording, product analytics on PHI is a disclosure the rule does not permit.
Do we need patient consent for treatment and billing data?
No, those fall under treatment, payment and operations.
The rule lets covered entities use and share PHI for treatment, payment and health care operations without asking. Some state laws are stricter, so check them for sensitive categories.
Who answers a patient who asks us for their records?
Usually the covered entity, with your help.
The right of access runs against the covered entity. Your agreement will say how fast you must hand records to it, or whether you respond to the patient directly. The 30-day clock belongs to your customer, so a slow export eats its time.
Does the Privacy Rule apply to paper and conversations?
Yes, all forms of PHI.
Unlike the Security Rule, which covers only electronic PHI, the Privacy Rule covers PHI in any form. Printed reports and calls with clinic staff are in scope.
Turn the Privacy Rule into product settings.
We review how your roles, exports and logs support minimum necessary and patient rights. Counsel should confirm how the rule applies to your agreements.