# HIPAA Privacy Rule — Standards and References

## Primary Legal Sources

### Federal Statutes
- **Health Insurance Portability and Accountability Act of 1996 (HIPAA)** — Pub. L. 104-191, 110 Stat. 1936, enacted August 21, 1996
- **Health Information Technology for Economic and Clinical Health (HITECH) Act** — Title XIII of Pub. L. 111-5, enacted February 17, 2009

### Code of Federal Regulations
- **45 CFR Part 160** — General Administrative Requirements (definitions, applicability, enforcement)
- **45 CFR Part 164, Subpart E** — Privacy of Individually Identifiable Health Information (§164.500-534)
- **45 CFR §160.103** — Definitions (covered entity, business associate, PHI, designated record set)
- **45 CFR §164.501** — Definitions specific to the Privacy Rule (treatment, payment, healthcare operations, marketing, psychotherapy notes)
- **45 CFR §164.502** — Uses and disclosures of PHI: general rules, minimum necessary, personal representatives
- **45 CFR §164.504** — Business associate requirements
- **45 CFR §164.506** — Uses and disclosures for TPO
- **45 CFR §164.508** — Authorization requirements
- **45 CFR §164.510** — Uses and disclosures requiring opportunity to agree or object (facility directory, persons involved in care)
- **45 CFR §164.512** — Uses and disclosures for which authorization or opportunity to object is not required (12 public interest categories)
- **45 CFR §164.514** — Other requirements: de-identification, minimum necessary implementation, limited data sets
- **45 CFR §164.520** — Notice of Privacy Practices
- **45 CFR §164.522** — Rights to request restrictions and confidential communications
- **45 CFR §164.524** — Right of access
- **45 CFR §164.526** — Right to amend
- **45 CFR §164.528** — Right to accounting of disclosures
- **45 CFR §164.530** — Administrative requirements (policies, training, safeguards, complaints, sanctions, documentation retention)

### Federal Register
- **65 FR 82462** — Standards for Privacy of Individually Identifiable Health Information; Final Rule (December 28, 2000)
- **67 FR 53182** — Modifications to the Privacy Rule (August 14, 2002)
- **78 FR 5566** — Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules (Omnibus Rule) (January 25, 2013)
- **89 FR 102536** — HIPAA Privacy Rule to Support Reproductive Health Care Privacy; Final Rule (December 23, 2024)

## OCR Guidance Documents

- **OCR Privacy Rule Summary** — "Summary of the HIPAA Privacy Rule" (revised May 2003)
- **OCR Guidance on Minimum Necessary** — FAQ and guidance on minimum necessary standard implementation
- **OCR Right of Access Initiative** — Enforcement initiative focused on individual access rights (2019-present)
- **OCR Guidance on De-Identification** — "Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the HIPAA Privacy Rule" (November 2012, updated September 2023)
- **OCR Guidance on Personal Representatives** — FAQ addressing personal representative determinations

## Enforcement References

- **OCR Breach Portal** — ocrportal.hhs.gov/ocr/breach/breach_report.jsf — publicly available database of breaches affecting 500+ individuals
- **OCR Resolution Agreements and Civil Monetary Penalties** — Published enforcement actions available at hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements
- **OCR Corrective Action Plans** — Detailed remediation requirements accompanying resolution agreements

## Industry Standards Referenced

- **NIST SP 800-66 Rev. 2** — "Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide" (February 2024)
- **NIST Cybersecurity Framework 2.0** — Voluntary framework cross-referenced with HIPAA Security Rule
- **HITRUST CSF** — Common Security Framework incorporating HIPAA requirements