HIPAA Privacy Rights: Who Must Comply and How to File a Complaint
You think your health information was shared without permission, or you work somewhere that handles patient data and want to get the rules right. Either way, understanding HIPAA privacy rights can feel harder than it should. HIPAA often sounds like a vague label rather than a set of rules you can actually read.
HIPAA is not a single document. It is a statute built out through detailed federal rules, and each rule does a different job. This post explains the framework in plain language so patients, families and health care workers can see how it fits together.
HIPAA and the HITECH Act: where the rules come from
HIPAA was enacted in 1996. The HITECH Act followed in 2009 and built on HIPAA's framework. Together, they are the foundation for the federal health privacy rules most people have in mind when they say "HIPAA."
Knowing that HIPAA is a statute plus detailed regulations helps you find the right answer faster. When a question comes up, the next step is to figure out which rule speaks to it. That simple habit keeps you from relying on guesses or workplace rumors.
Who must follow HIPAA? Covered entities and business associates
HIPAA does not apply to everyone who handles health information. It applies to covered entities and their business associates. That distinction is often the first question in any HIPAA issue.
The guide explains who counts as a covered entity or a business associate. Practice managers and organizations that work with patient data will find this section helpful when they review their own responsibilities. Patients can use the same framework to understand whether the organization involved in their concern is subject to HIPAA at all.
What is protected health information?
HIPAA protects a specific category of data called protected health information, often shortened to PHI. Not every piece of health-related information automatically falls into that category.
The guide explains what counts as protected health information. Understanding the term helps you tell whether a disclosure is the kind HIPAA is designed to address.
For patients, this is often the key question after a worrying disclosure. For staff, it shapes everyday choices about what can be discussed, sent or stored. In both cases, a clear definition turns a vague concern into a question you can actually answer.
HIPAA privacy rights and the three main rules
Most HIPAA questions trace back to one of three main rules. Each has its own place in the federal regulations and its own purpose.
The Privacy Rule governs how protected health information may be used and shared. The Security Rule addresses safeguarding that information. The Breach Notification Rule covers what happens after a breach.
Privacy Rule: 45 C.F.R. Part 164, Subpart E
Security Rule: 45 C.F.R. Part 164, Subpart C
Breach Notification Rule: 45 C.F.R. §§ 164.400-414
HIPAA Security Rule basics and the breach notification rule
For organizations that handle patient data, the Security Rule and the Breach Notification Rule shape day-to-day practices. For patients, these rules explain what should happen when information is not properly protected.
The guide explains both rules in plain language, along with how the HITECH Act fits in. A clear understanding of both helps staff respond calmly and consistently when a problem comes up. It also helps patients know what questions to ask.
Know which rule applies to the question in front of you.
Keep written records of what happened and when.
Review internal policies with the rules in mind.
Confirm current requirements, since rules can be updated.
How to file a HIPAA complaint
If you believe your rights were violated, you have somewhere to turn. Complaints go to the HHS Office for Civil Rights, and the guide walks through the complaint process so you know what to expect.
Before you file, gather what you know: who was involved, what information was shared and when you learned about it. Clear notes make it easier to describe the situation accurately.
This post and the guide are legal information, not legal advice, and no outcome is promised. If you have questions about your own situation or your organization's duties, talk with a licensed attorney. The guide gives you a plain-language overview of the rules first.
Frequently asked questions
Who has to follow HIPAA?
HIPAA applies to covered entities and their business associates, not to everyone who handles health information. That is why the first question in many HIPAA issues is whether the person or organization involved is covered. The guide explains who counts as a covered entity or business associate and what counts as protected health information under the federal rules.
How do you file a HIPAA complaint?
Complaints about possible HIPAA violations go to the HHS Office for Civil Rights. The guide walks through how to file a complaint so you know where to turn if you believe your rights were violated. Gathering clear notes about what happened, who was involved and when you learned about it can make the complaint easier to prepare.
Is HIPAA one law or several rules?
HIPAA is a statute from 1996 that has been built out through detailed federal rules, and the HITECH Act of 2009 added to that framework. The main rules are the Privacy Rule, the Security Rule and the Breach Notification Rule. The guide explains each one and where it appears in the federal regulations, so you can read the actual rules.
Get the full guide
Get HIPAA Privacy Rights and Data Protection from STACKED LEGAL for a clear, plain-language view of federal health privacy rights and duties. It is available in paperback and eBook. Read HIPAA Privacy Rights and Data Protection.
Related guides
Legal information, not legal advice. Laws change, and every situation is different. For advice about your situation, talk to a licensed attorney.
