The HIPAA Privacy Rule decides who may see, use or share a patient's health information, whether it is on paper, on a screen or spoken aloud. Staff meet it at check-in, on phone calls, when a patient asks for records and in internal messages. This entry explains those moments in plain English and points to the official sources.
What the HIPAA Privacy Rule is
The HIPAA Privacy Rule is the federal regulation that limits how clinics, health plans and their business associates may use and share patients' protected health information. It also gives patients rights over their health information, including the right to access and get copies of their records.
The rule protects protected health information (PHI) held by covered entities. For most outpatient practices, that means a practice that bills insurance electronically is a covered entity. The rule also reaches the business associates that handle PHI on the practice's behalf. It does not apply to every health app or every organization that handles health data.
In practice at a clinic or small practice
At the front desk, the rule shows up in small, repeated habits:
- Confirming a caller's identity before discussing an appointment.
- Keeping sign-in sheets and monitors out of view of the waiting room.
- Routing a patient's request for records to the person who handles access requests.
Some check-in conversation will be overheard. That can count as an incidental disclosure, and it is permitted when the practice has reasonable safeguards in place, such as lowered voices and screen positioning.
Nurses and office managers may share PHI for treatment, payment and health care operations without a separate patient authorization. Examples include sending a referral, submitting a claim or reviewing a scheduling backlog. Outside treatment, they share only what the task needs, which is the minimum necessary standard. A billing question needs the claim details, not the full chart. Staff may talk with a family member involved in the patient's care when the patient agrees or does not object.
Internal messages count too. A staff chat or text that mentions a patient is still a use or disclosure of PHI within the workforce. Practices typically set a written policy that covers:
- which approved tools staff may use for work messages
- what may go in a message, and what belongs only in the clinical record
- what to do when a message is sent to the wrong person
Personal texting apps and group chats usually fall outside that policy.
Patients receive a Notice of Privacy Practices, generally at the first visit, that explains how the practice uses their information.
Not to be confused with
| Term | How it differs from the Privacy Rule |
|---|---|
| HIPAA Security Rule | Covers only electronic PHI and requires administrative, physical and technical safeguards such as access controls and audit controls. The Privacy Rule governs who may see or share PHI in any form, including paper and spoken. |
| Notice of Privacy Practices | The document a practice gives patients that describes how it uses their information. It is one requirement under the Privacy Rule, not the rule itself. |
The Privacy Rule does not require specific technologies such as encryption. Technical safeguards fall under the Security Rule.
What the rules say
- Primary source: HHS Office for Civil Rights, Standards for Privacy of Individually Identifiable Health Information, codified at 45 CFR Part 160 and Part 164 Subparts A and E.
- Enforcement: The HHS Office for Civil Rights (OCR) enforces the rule. Civil money penalties are tiered by level of culpability, and the amounts are adjusted for inflation.
- Business associates: A vendor that handles PHI for a practice must sign a business associate agreement. Business associates are directly liable for certain Privacy Rule requirements.
- Recent amendments: In 2024, HHS amended the rule to address reproductive health care privacy. Those changes have been challenged in court, so confirm their current legal status with your privacy officer before relying on them.
This entry is a plain-English summary, not legal advice. Your practice's privacy officer is responsible for how the rule applies to your workflows.
Related reading
- HIPAA Security Rule: the companion rule for electronic PHI.
- Minimum necessary standard: the standard staff apply most often.
- Security, HIPAA and BAA
- Healthcare operations glossary
Where Chanty fits. chanty.health is published by Chanty, a team chat for clinic staff with a signed BAA from the Business plan. If your team still coordinates in personal group chats, see how HIPAA-compliant staff chat works or start free.