United StatesHIPAA Privacy Rule
45 CFR Part 164, Subpart E (Sections 164.500-164.534)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights, Security
- Audit expectation
- none
What it requires
- Do not use or disclose protected health information except as the Privacy Rule permits or requires, and limit use and disclosure to the minimum necessary.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.DP-P4
- Strip biometric identifiers, including voiceprints and full-face photographic images, before treating health data as de-identified.NIST Privacy FrameworkCT.DP-P2
- Treat health information as de-identified only if a person with appropriate statistical and scientific expertise determines, and documents, that the risk is very small that an anticipated recipient could use it to identify an individual (expert determination), or if the identifiers the Rule lists are removed and you have no actual knowledge that the remaining information could identify an individual (safe harbor) (45 CFR 164.514(b)).
- If you assign a code that lets de-identified information be re-identified, derive it from no information about the individual, use or disclose it for no other purpose, and never disclose the re-identification mechanism (45 CFR 164.514(c)).
These lines are LexLint's reading of the law's text. Also read by: HHS Office for Civil Rights (guidance, recorded ); American Hospital Association v. Becerra, No. 4:23-cv-01110-P (N.D. Tex. ) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DP-P2Data are processed to limit the identification of individuals (e.g., de-identification privacy techniques, tokenization).
- CT.DP-P4System or device configurations permit selective collection or disclosure of data elements.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Knowingly and in violation of HIPAA obtaining or disclosing individually identifiable health information, when done with intent to sell, transfer, or use it for commercial advantage, personal gain, or malicious harm, is a federal crime under 42 U.S.C. 1320d-6(b)(3): a fine of up to $250,000 and imprisonment of up to 10 years, or both.
Penalty structure
45 CFR 160.404 sets four culpability tiers per violation, adjusted for inflation annually and published at 45 CFR 102.3 (2025 figures shown): (i) no knowledge and no reasonable diligence would have revealed the violation, $145 to $73,011 per violation; (ii) reasonable cause, not willful neglect, $1,461 to $73,011; (iii) willful neglect, corrected within 30 days, $14,602 to $73,011; (iv) willful neglect, not corrected within 30 days, $73,011 up to the annual cap. Every tier is subject to a $2,190,294 annual cap for identical violations of the same administrative simplification provision in a calendar year.
- Rule
- Per violation only
- As of
- Minimum
- 145
- Currency
- USD
- Fixed cap
- 2,190,294
- Per violation unit
- Violation
- Per violation amount
- 2,190,294
Who enforces it
Enforcement body
HHS Office for Civil Rights
Enforcement record
Counts resolution agreements and civil money penalties HHS OCR's own published Resolution Agreements list dates to calendar year 2025 (25 actions), the latest complete calendar year the list covers, up from 14 in 2024; 5 more had posted for 2026 by the list's last review date of . OCR's separate Enforcement Highlights page states a cumulative program total, as of , of 152 settlements or civil money penalties totaling $144,878,972 since the Privacy Rule's 2003 compliance date; that cumulative total is not used here because it predates the 2025 and 2026 actions counted above and the two pages are not reconciled to a single running total. No per-case fine amounts are aggregated into a fines total here.
- As of
- Trend
- Rising
- Source link
- https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
- Actions per year
- 25
Settledness
A court vacated the 2024 reproductive health care amendments to the Privacy Rule (89 Fed. Reg. 32976), except part of their changes to 45 CFR 164.520, in Purl v. United States Department of Health and Human Services, No. 2:24-CV-228-Z (N.D. Tex. ).
- As of
- Case link
- https://www.govinfo.gov/content/pkg/USCOURTS-txnd-4_23-cv-01110/pdf/USCOURTS-txnd-4_23-cv-01110-0.pdf
- Guidance link
- https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html
- Case citation
- American Hospital Association v. Becerra, No. 4:23-cv-01110-P (N.D. Tex. )
- Guidance body
- HHS Office for Civil Rights
- Open questions
- Does a covered entity's tracking technology disclose "individually identifiable health information" when it connects a visitor's IP address with a visit to an unauthenticated public webpage that addresses specific health conditions or healthcare providers, a circumstance in which a court vacated the Office for Civil Rights' guidance?
What it makes you log
Who may demand the log
Data subject
What the log must hold
Event time, Access record, Consent or opt-out state
Log retention
45 CFR 164.530(j)(2): retained six years from creation or from the date the documentation last was in effect, whichever is later.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 6
Logging duty
A covered entity must document, and keep for six years under 164.530(j), the information needed to give an individual an accounting of disclosures (the date, the recipient, a description of the information and the purpose, for each disclosure that is subject to an accounting), each signed authorization, and any other action the Subpart requires to be documented. The individual may receive the accounting for the six years before the request. No audit of the record by any party is stated in the sections of the Subpart. The Subpart states no territorial hook.
- Kind
- Explicit
- As of
- Provision
- 45 CFR 164.528(d) (document the information needed for an accounting of disclosures), 164.508(b)(6) (document and retain each signed authorization) and 164.530(j) (maintain required documentation for six years)
- Trigger
- personal_data_processing
What this law does
Restricts covered entities (health plans, health care clearinghouses, and most health care providers) and their business associates from using or disclosing protected health information except as the Rule permits or requires, and conditions most non-routine disclosures on individual authorization.
Its de-identification safe harbor is the one place federal law names biometric identifiers, including voice prints and full-face photographic images, as identifiers that must be stripped before health data is treated as de-identified.
One method of de-identification is an expert determination: a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual, and documents the methods and results of the analysis.
The other method is the safe harbor: the identifiers the Rule lists, which include names, biometric identifiers and full face photographic images, are removed for the individual and for relatives, employers and household members, and the covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual.
A covered entity may assign a code to allow de-identified information to be re-identified only if the code is not derived from or related to information about the individual and cannot be translated to identify the individual, and the entity does not use or disclose the code for any other purpose or disclose the mechanism for re-identification.
How courts have read itPremium data
Our analysis of this law draws on 4 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app handles health records.
Back to the example · Lint your app
Page updated .