Handles health records, in the United States

45 CFR Part 164, Subpart E (Sections 164.500-164.534) · Read the law's page

• Do not use or disclose protected health information except as the Privacy Rule permits or requires, and limit use and disclosure to the minimum necessary.
• Strip biometric identifiers, including voiceprints and full-face photographic images, before treating health data as de-identified.
• Treat health information as de-identified only if a person with appropriate statistical and scientific expertise determines, and documents, that the risk is very small that an anticipated recipient could use it to identify an individual (expert determination), or if the identifiers the Rule lists are removed and you have no actual knowledge that the remaining information could identify an individual (safe harbor) (45 CFR 164.514(b)).
• If you assign a code that lets de-identified information be re-identified, derive it from no information about the individual, use or disclose it for no other purpose, and never disclose the re-identification mechanism (45 CFR 164.514(c)).

HIPAA Privacy Rule, 45 CFR 164.514(a)-(c) · Read the law's page

• Treat health information as not individually identifiable by expert determination only if a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods determines that the risk is very small that an anticipated recipient could use the information, alone or in combination with other reasonably available information, to identify an individual, and documents the methods and results of the analysis that justify the determination (45 CFR 164.514(b)(1)).
• Treat health information as not individually identifiable by the safe harbor only if you remove the identifiers 45 CFR 164.514(b)(2)(i) lists for the individual and for relatives, employers and household members, and you have no actual knowledge that the information could be used alone or in combination with other information to identify an individual (45 CFR 164.514(b)(2)).
• If you assign a code or other means of record identification so that you can re-identify de-identified information, derive it from no information about the individual, make sure it cannot otherwise be translated to identify the individual, use or disclose it for no other purpose, and never disclose the mechanism for re-identification (45 CFR 164.514(c)).

45 CFR Part 164, Subpart C (Sections 164.302-164.318) · Read the law's page

• It reaches you if you are a covered entity, meaning a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a transaction the HIPAA rules cover, or a business associate, meaning a person that creates, receives, maintains, or transmits protected health information on a covered entity's behalf for a function or activity the HIPAA rules regulate, or that provides a covered entity legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services involving disclosure of protected health information to that person, including a subcontractor of a business associate and a person that offers a personal health record to individuals on a covered entity's behalf. Its duties attach to electronic protected health information, and you are reached by declaring that you are a HIPAA covered entity or business associate.
• Ensure the confidentiality, integrity, and availability of all electronic protected health information you create, receive, maintain, or transmit; protect it against reasonably anticipated threats or hazards to its security or integrity and against reasonably anticipated uses or disclosures the Privacy Rule does not permit or require; and ensure that your workforce complies with the Security Rule (45 CFR 164.306(a)).
• Choose security measures that let you reasonably and appropriately implement each standard and implementation specification, taking into account your size, complexity, and capabilities, your technical infrastructure and hardware and software security capabilities, the cost of the measures, and the probability and criticality of potential risks to electronic protected health information (45 CFR 164.306(b)).
• Implement every required implementation specification. For each addressable one, such as a mechanism to encrypt and decrypt electronic protected health information (45 CFR 164.312(a)(2)(iv)) and encryption of transmitted electronic protected health information whenever deemed appropriate (45 CFR 164.312(e)(2)(ii)), assess whether it is a reasonable and appropriate safeguard in your environment; implement it if it is, and if it is not, document why and implement an equivalent alternative measure if reasonable and appropriate (45 CFR 164.306(d)).
• Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of the electronic protected health information you hold, and implement security measures sufficient to reduce those risks and vulnerabilities to a reasonable and appropriate level (45 CFR 164.308(a)(1)).
• Identify the security official responsible for developing and implementing your security policies and procedures, apply sanctions to workforce members who fail to comply with them, regularly review records of information system activity such as audit logs, access reports, and security incident tracking reports, and run a security awareness and training program for all members of your workforce, including management (45 CFR 164.308(a)(1) to (5)).
• Implement policies and procedures to ensure that your workforce members have appropriate access to electronic protected health information and that those who do not have access cannot obtain it, and policies and procedures for authorizing access that are consistent with the Privacy Rule (45 CFR 164.308(a)(3) and (4)).
• Identify and respond to suspected or known security incidents, mitigate their harmful effects to the extent practicable, and document the incidents and their outcomes (45 CFR 164.308(a)(6)).
• Establish and implement a data backup plan, a disaster recovery plan, and an emergency mode operation plan, and perform a periodic technical and nontechnical evaluation of whether your security policies and procedures meet the Security Rule (45 CFR 164.308(a)(7) and (8)).
• Limit physical access to your electronic information systems and the facilities that house them, specify the proper use of each workstation that can access electronic protected health information and physically safeguard it, and govern the receipt, removal, and movement of hardware and electronic media that contain it, including its final disposition and its removal from media before the media are re-used (45 CFR 164.310).
• Allow access to electronic protected health information only to persons or software programs that have been granted access rights, assign each user a unique name or number, establish procedures for obtaining the information in an emergency, record and examine activity in the information systems that contain it, protect it from improper alteration or destruction, verify that a person or entity seeking access is the one claimed, and guard against unauthorized access to it while it is transmitted over an electronic communications network (45 CFR 164.312).
• If you are a covered entity, obtain satisfactory assurances from each business associate that it will appropriately safeguard electronic protected health information, and if you are a business associate, obtain them from each subcontractor, documented in a written contract or other arrangement that requires the business associate to comply with the Security Rule, to hold its subcontractors to the same, and to report to the covered entity any security incident of which it becomes aware, including breaches of unsecured protected health information (45 CFR 164.308(b) and 164.314(a)).
• Keep your security policies and procedures, and a record of every action, activity, or assessment the Security Rule requires to be documented, in written form (which may be electronic); retain that documentation for 6 years from the date of its creation or the date it last was in effect, whichever is later; make it available to the people responsible for the procedures; review it periodically and update it in response to environmental or operational changes; and review and modify your security measures as needed (45 CFR 164.316 and 164.306(e)).

45 CFR Part 164, Subpart D (Sections 164.400-164.414) · Read the law's page

• Notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information.
• Notify the Secretary of Health and Human Services of a breach of unsecured protected health information involving 500 or more individuals contemporaneously with the notice to affected individuals.
• Notify the Secretary of Health and Human Services, for breaches of unsecured protected health information involving fewer than 500 individuals that were discovered during a calendar year, not later than 60 days after the end of that calendar year.
• For a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, notify prominent media outlets serving that State or jurisdiction without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
• If you are a business associate, notify the covered entity of a breach of unsecured protected health information without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.

16 CFR Part 318 · Read the law's page

• If you are a vendor of personal health records (an entity that offers or maintains an electronic record of health information that can draw information from multiple sources and is managed, shared and controlled by or primarily for the individual) or a PHR related entity, notify each affected individual who is a citizen or resident of the United States, in plain language and without unreasonable delay, no later than 60 calendar days after you discover a breach of security of unsecured PHR identifiable health information.
• A breach of security is treated as discovered on the first day on which it is known, or reasonably should have been known, to you; the knowledge of any employee, officer or other agent, other than the person committing the breach, counts as yours.
• Send the individual notice in writing to the individual's last known address: by electronic mail (email combined with a text message, within-application message or electronic banner, written clearly and conspicuously) if the individual has specified electronic mail as the primary method of communication, and otherwise by first-class mail; if the individual is deceased, send it to the next of kin if the individual gave contact information and authorization to contact them.
• If, after reasonable efforts, contact information for ten or more individuals is insufficient or out of date, give substitute notice reasonably calculated to reach them, by a conspicuous posting for 90 days on the home page of your website or in major print or broadcast media (including media where the affected individuals likely reside), with a toll-free number that stays active for at least 90 days where an individual can learn whether their information may have been included; where you judge a case urgent because of possible imminent misuse, you may also notify by telephone or other means.
• Notify the Federal Trade Commission as its website instructs: at the same time as the individual notices for a breach affecting 500 or more individuals; for a breach affecting fewer than 500 individuals you may keep a log and submit it no later than 60 calendar days after the end of the calendar year.
• Notify prominent media outlets serving a State or jurisdiction, without unreasonable delay and in no case later than 60 calendar days after you discover the breach, when the unsecured PHR identifiable health information of 500 or more of its residents is, or is reasonably believed to have been, acquired during the breach.
• Say in each notice, in plain language, what happened (the dates of the breach and of its discovery, and the third parties that acquired the information if known), the types of information involved, the steps individuals should take, what you are doing to investigate and mitigate, and how to reach you through two or more of a toll-free telephone number, email address, website, within-application contact or postal address.
• If you are a third party service provider, notify the official designated in a written contract by the vendor of personal health records or PHR related entity you serve (or else a senior official of that vendor or entity), without unreasonable delay and in no case later than 60 calendar days after you discover the breach; identify each customer of that vendor or entity whose unsecured PHR identifiable health information has been, or is reasonably believed to have been, acquired during the breach; and obtain acknowledgment that the notice was received.
• If you are a vendor of personal health records or a PHR related entity, tell each third party service provider that you are a vendor or PHR related entity subject to this rule; a third party service provider that accesses unsecured PHR identifiable health information in providing services does not thereby become a PHR related entity.
• Delay a notice, notification or posting when a law enforcement official determines that it would impede a criminal investigation or cause damage to national security, because the rule says it shall be delayed, and keep the evidence that every notice was made as required, because the burden of demonstrating it rests on you.
• HIPAA-covered entities, and any other entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity, are outside this rule.

42 U.S.C. 300jj-52; 45 CFR Part 171 · Read the law's page

• If you are a health IT developer of certified health IT, a health information network or exchange, or a health care provider, do not engage in a practice that is likely to interfere with access, exchange, or use of electronic health information unless a law requires it or an exception in 45 CFR Part 171, Subpart B, C or D applies (42 U.S.C. 300jj-52(a); 45 CFR 171.103).
• Do not implement health IT in a way likely to restrict the access, exchange, or use of electronic health information with respect to exporting complete information sets or transitioning between health IT systems (42 U.S.C. 300jj-52(a)(2)(C)(i)).
• To rely on an exception, meet all applicable requirements and conditions of that exception at all relevant times (45 CFR 171.200, 171.300 and 171.400).

42 CFR Part 2, as amended by the 2024 final rule (89 FR 12472) · Read the law's page

• Use or disclose a record that identifies a patient as having or having had a substance use disorder only as 42 CFR Part 2 permits, limited to the information necessary for the purpose, and never in a civil, criminal, administrative or legislative proceeding unless the Part permits it (sections 2.12(a) and 2.13(a)).
• Obtain a written consent that carries the elements in section 2.31(a) before a use or disclosure that needs one, and send each consented disclosure with the written statement of the Federal confidentiality rules, because a general authorization for release of information does not permit further use or redisclosure (sections 2.31 and 2.32).
• Keep formal policies and procedures that protect patient identifying information, and handle a breach of unsecured records as a HIPAA covered entity would (section 2.16).