LibGuides: Medical and Health Data Privacy: HIPAA and Beyond: Federal Laws

Introduction

The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically. The Rule requires appropriate safeguards to protect the privacy of personal health information, and sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization. The Rule also gives patients rights over their health information, including rights to examine and obtain a copy of their health records, and to request corrections.

Chart for civil penalties

Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties
4/30/19 HHS will enforce lighter penalties than the chart below.

Credit: HIPAA for Lawyers Slideshow by Kim Stanger.

Chart for Criminal penalties

Credit: HIPAA for Lawyers Slideshow by Kim Stanger.

Agency Guidance

HIPAA Guidance Materials
From HHS.gov
Joint Guidance on the Application of the Family Educational Rights and Privacy Act (FERPA) And the Health Insurance Portability and Accountability Act of 1996 (HIPAA) To Student Health Records
From HHS and Dept. of Ed.

US Code

42 U.S. Code § 1320d–6
Wrongful disclosure of individually identifiable health information.

CFR

HIPAA Privacy Rule
Combined Regulation Text of All Rules from U.S. Department of Health and Human Services Office for Civil Rights as of 2013.
42 CFR Part 2
CONFIDENTIALITY OF SUBSTANCE USE DISORDER PATIENT RECORDS
45 CFR Part 160
GENERAL ADMINISTRATIVE REQUIREMENTS
45 CFR Part 164
SECURITY AND PRIVACY
45 CFR § 164.502(g)
When state law allows a teen to consent to medical or mental health care, the parent does not have the right to a teen's medical records.
45 CFR 164.508
Uses and disclosures for which an patient authorization is required, including disclosure of psychotherapy notes.
45 CFR Parts 170, 171
Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm
Transparency, and Information Sharing

Proposed Regulations

HIPAA Privacy Rule Notice of Proposed Rulemaking to Support Reproductive Health Care Privacy Fact Sheet
4/12/23

Medical and Health Data Privacy: HIPAA and Beyond: Federal Laws