United States. Health data. Regulation
HIPAA Privacy RuleHIPAA Privacy Rule (45 C.F.R. Part 160 and Part 164 Subparts A and E)
Partly verified
Medium confidence.dpo_required Yes = mandatory privacy official. A care-coordination Privacy Rule final rule was at OMB in 2026 (per DWT, July 2026); check whether published. Vacatur of the 2024 reproductive health rule is from established knowledge.
§1Summary
- Synopsis
Sets national standards for use and disclosure of protected health information by health plans, clearinghouses and most providers (covered entities) and their business associates. Grants individuals rights of access, amendment and an accounting of disclosures.
- Key themes
- Unique features
Sector- and entity-based rather than data-based: identical health data held outside a covered entity/business associate falls outside HIPAA.
- SaaS relevance
SaaS providers that create, receive, maintain or transmit PHI for a covered entity are business associates and must sign BAAs and comply directly.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- See HIPAA Breach Notification Rule
- DPO
- Yes
- Cross-border transfers
- None (no transfer restriction)
- Maximum penalty
- Tiered civil penalties per violation with an annual cap per requirement of roughly $2.1m (inflation-adjusted); criminal fines up to $250,000 and 10 years
§3Dates
- Key dates
- Adopted
- In force
- HIPAA enacted 1996-08-21; Privacy Rule compliance 2003-04-14 (small plans 2004); HITECH Omnibus Rule compliance 2013-09-23; 2024 reproductive health amendments vacated by a federal court in 2025.
§4Text and authority
- Text
- Authoritative text ecfr.gov
- Authority
- HHS Office for Civil Rights (OCR)
§5Where it applies
- Domestic law of
- United States
- Also applies in
- Alabama
- Alaska
- Arizona
- Arkansas
- California
- Colorado
- Connecticut
- Delaware
- District of Columbia
- Florida
- Georgia
- Guam
- Hawaii
- Idaho
- Illinois
- Indiana
- Iowa
- Kansas
- Kentucky
- Louisiana
- Maine
- Maryland
- Massachusetts
- Michigan
- Minnesota
- Mississippi
- Missouri
- Montana
- Nebraska
- Nevada
- New Hampshire
- New Jersey
- New Mexico
- New York
- North Carolina
- North Dakota
- Ohio
- Oklahoma
- Oregon
- Pennsylvania
- Puerto Rico
- Rhode Island
- South Carolina
- South Dakota
- Tennessee
- Texas
- US Virgin Islands
- Utah
- Vermont
- Virginia
- Washington
- West Virginia
- Wisconsin
- Wyoming
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.dpo_required Yes = mandatory privacy official. A care-coordination Privacy Rule final rule was at OMB in 2026 (per DWT, July 2026); check whether published. Vacatur of the 2024 reproductive health rule is from established knowledge.