The two main rules of HIPAA — the Privacy Rule and the Security Rule — form the legal backbone of healthcare data protection in the United States. Enacted under the Health Insurance Portability and Accountability Act of 1996, these two rules establish exactly how covered entities and their business associates must handle protected health information (PHI). Whether you work in a hospital, a private practice, a health insurance company, or as a third-party vendor processing medical records, understanding these rules is not optional — it is a federal legal requirement.
The two main rules of HIPAA — the Privacy Rule and the Security Rule — form the legal backbone of healthcare data protection in the United States. Enacted under the Health Insurance Portability and Accountability Act of 1996, these two rules establish exactly how covered entities and their business associates must handle protected health information (PHI). Whether you work in a hospital, a private practice, a health insurance company, or as a third-party vendor processing medical records, understanding these rules is not optional — it is a federal legal requirement.
The Privacy Rule, which took effect in April 2003, is the broader of the two. It governs all forms of PHI, including verbal communications, paper records, and electronic data. The rule gives patients meaningful rights over their own health information, including the right to access their records, request corrections, and receive an accounting of disclosures. For healthcare organizations, it establishes strict limits on when and how PHI may be used or shared without a patient's written authorization.
The Security Rule, which became enforceable for most covered entities in April 2005, narrows its focus to electronic protected health information, commonly abbreviated as ePHI. While the Privacy Rule sets the policy framework, the Security Rule translates those policies into operational, technical, and administrative controls. It requires organizations to implement safeguards that ensure the confidentiality, integrity, and availability of ePHI throughout its entire lifecycle — from creation to storage to transmission to deletion.
Together, these two rules are mutually reinforcing. The Privacy Rule establishes the what: what information is protected, what uses are permitted, and what rights patients hold. The Security Rule establishes the how: how organizations must protect electronic data through documented risk analyses, workforce training programs, access controls, encryption, audit logs, and contingency planning. Neither rule alone is sufficient — full HIPAA compliance requires satisfying both simultaneously.
Violations of either rule can trigger investigations by the Office for Civil Rights (OCR) within the Department of Health and Human Services (HHS). Penalties range from $100 to $50,000 per violation, with annual caps reaching $1.9 million for repeated violations of the same provision. In egregious cases involving willful neglect or criminal intent, individuals can face federal prosecution and prison sentences of up to ten years.
Beyond legal exposure, HIPAA compliance is fundamentally about patient trust. When patients share sensitive medical information with their providers, they are placing extraordinary confidence in those organizations to keep that data private and secure. A single breach can permanently damage a healthcare organization's reputation, reduce patient volume, and trigger costly remediation efforts. Understanding the two main rules of HIPAA is therefore not just a compliance checkbox — it is a foundational commitment to ethical healthcare practice.
This guide breaks down both rules in detail, explains who must comply, outlines the specific requirements each rule imposes, and provides practical guidance for meeting those requirements in real-world healthcare settings. Whether you are preparing for a HIPAA compliance exam, implementing a new compliance program, or simply trying to understand your legal obligations, the sections that follow will give you a thorough and actionable understanding of the two pillars of HIPAA regulation.
Effective April 2003, this rule governs all forms of protected health information — paper, verbal, and electronic. It grants patients rights over their data and restricts how covered entities may use or disclose PHI without authorization.
Effective April 2005, this rule applies exclusively to electronic PHI (ePHI). It mandates administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of ePHI stored or transmitted electronically.
Though not one of the two main rules, this 2009 addition requires covered entities to notify affected individuals, HHS, and sometimes the media when unsecured PHI is breached. It works alongside both primary rules.
Covered entities — healthcare providers, health plans, and clearinghouses — must comply with both rules. Business associates who handle PHI on behalf of covered entities are also bound by these rules through signed Business Associate Agreements.
The HIPAA Privacy Rule is the more expansive of the two main HIPAA regulations. It was the first to be finalized by HHS and establishes national standards for the protection of individuals' medical records and other personal health information. The rule applies to covered entities — health plans, healthcare clearinghouses, and healthcare providers that transmit any health information electronically — as well as to business associates who perform services involving PHI on a covered entity's behalf.
At its core, the Privacy Rule defines what constitutes protected health information. PHI includes any information that relates to an individual's past, present, or future physical or mental health condition, the provision of healthcare to that individual, or past, present, or future payment for healthcare services. Critically, information only qualifies as PHI when it includes one or more of 18 specific identifiers — such as a person's name, address, date of birth, Social Security number, phone number, or medical record number — that could be used to identify the individual directly or indirectly.
The Privacy Rule distinguishes between permitted uses and disclosures versus those that require written patient authorization. Covered entities may use and disclose PHI without patient authorization for treatment, payment, and healthcare operations — the so-called TPO exceptions.
A hospital may share a patient's records with a consulting specialist (treatment), submit a claim to an insurer (payment), or use data for quality improvement audits (operations) without first obtaining signed consent. However, for any use or disclosure outside of these categories — such as sharing records with an employer, releasing information to a marketing company, or disclosing data for research — written patient authorization is generally required.
Patients hold substantial rights under the Privacy Rule. They have the right to inspect and obtain a copy of their own health records, typically within 30 days of a request. They can request amendments to records they believe are inaccurate or incomplete, and the covered entity must either make the correction or explain in writing why it is declining.
Patients also have the right to request restrictions on certain uses or disclosures, though covered entities are not always required to agree to such restrictions. Additionally, patients can request communications by alternative means or at alternative locations — for example, asking a provider to send appointment reminders to a work address rather than a home address.
The Privacy Rule also mandates the Minimum Necessary Standard, which requires covered entities to make reasonable efforts to use, disclose, or request only the minimum amount of PHI needed to accomplish the intended purpose. A billing department, for instance, does not need access to detailed clinical notes when processing an insurance claim — they need only the diagnosis codes and procedure codes. This principle limits internal exposure of sensitive data and reduces the risk that information will be used for purposes beyond its intended scope.
Notice of Privacy Practices (NPP) is another cornerstone requirement of the Privacy Rule. Every covered entity must develop a written NPP that describes how it uses and discloses PHI, outlines patients' rights, and explains the covered entity's legal duties with respect to health information. Healthcare providers must provide this notice to patients at the first point of service and make a good-faith effort to obtain a signed acknowledgment that the patient received it. Health plans must send the NPP to enrollees upon enrollment and every three years thereafter.
Enforcement of the Privacy Rule falls to the OCR within HHS. Individuals who believe their privacy rights have been violated may file a complaint with OCR, which then investigates and may impose civil monetary penalties. The rule also prohibits retaliation against individuals who exercise their rights or file complaints, and it prohibits covered entities from requiring individuals to waive their Privacy Rule rights as a condition of treatment or enrollment. These enforcement mechanisms give patients meaningful recourse when their rights are violated and create strong incentives for organizational compliance.
Administrative safeguards are the policies, procedures, and management practices that protect ePHI and guide workforce conduct. They represent the largest category of Security Rule requirements, covering 9 of the 18 required implementation specifications. Key requirements include conducting a formal risk analysis to identify threats and vulnerabilities to ePHI, implementing a risk management plan to reduce those risks to reasonable and appropriate levels, establishing a sanctions policy for employees who violate security policies, and designating a Security Officer responsible for developing and implementing the organization's security program.
Additional administrative safeguards address workforce training, information access management, and contingency planning. Covered entities must provide security awareness training to all workforce members — not just IT staff — and document that training was completed. They must establish procedures for authorizing access to ePHI based on job role, and they must maintain contingency plans that include data backup procedures, disaster recovery protocols, and an emergency mode operations plan to ensure continued access to critical health data during system outages or natural disasters.
Physical safeguards govern the physical access to electronic information systems and the facilities in which they reside. The Security Rule requires covered entities to implement facility access controls — policies and procedures that limit physical access to electronic information systems and the facilities that house them to authorized users only. This includes using key cards, security badges, locks, alarms, and surveillance cameras to control and monitor who enters server rooms, data centers, and workstation areas where ePHI is accessed or stored. Organizations must also document repairs and modifications to facility security systems.
Workstation use and device security are also physical safeguard requirements. Covered entities must specify the proper functions to be performed by each class of workstation, the manner in which those functions are to be performed, and the physical attributes of the surroundings of workstations that can access ePHI. Mobile device policies — governing laptops, tablets, and smartphones used to access ePHI — are increasingly critical in modern healthcare settings, particularly as telehealth and remote work have expanded dramatically. Device encryption and remote wipe capabilities are common technical implementations that address these physical security concerns.
Technical safeguards are the technology controls and related policies that protect ePHI and control access to it. Access controls are the most fundamental technical requirement: covered entities must implement technical policies that allow only authorized persons or software programs to access ePHI. This typically involves unique user IDs for system access, automatic logoff after periods of inactivity, encryption of ePHI stored on devices or transmitted over networks, and emergency access procedures that allow authorized users to access ePHI quickly during system emergencies. Multi-factor authentication has become a best practice for meeting this requirement.
Audit controls and transmission security round out the technical safeguard requirements. Covered entities must implement hardware, software, or procedural mechanisms that record and examine activity in information systems containing ePHI — these audit logs are essential both for detecting unauthorized access and for demonstrating compliance during OCR investigations. Transmission security requirements mandate that organizations guard against unauthorized access to ePHI being transmitted over electronic communications networks, which in practice means using encrypted connections such as TLS for web-based systems and secure file transfer protocols for transmitting records between organizations.
Many compliance professionals describe the Privacy Rule as the policy layer and the Security Rule as the implementation layer. The Privacy Rule tells you what must be protected and who has rights over that data. The Security Rule tells you exactly how to protect the electronic version of that data through documented controls, technical measures, and workforce procedures. You cannot achieve full HIPAA compliance by satisfying only one — both rules must be addressed simultaneously and continuously.
HIPAA enforcement is carried out primarily by the Office for Civil Rights within the Department of Health and Human Services. The OCR investigates complaints filed by individuals who believe their privacy rights have been violated, as well as compliance reviews initiated by the OCR itself — particularly following large-scale data breaches. The OCR has authority to impose civil monetary penalties and to require corrective action plans that mandate specific remediation steps over defined timelines.
The penalty structure under HIPAA is tiered based on culpability. At the lowest tier, violations where the covered entity did not know and could not have known about the violation carry fines of $100 to $50,000 per violation, with an annual maximum of $25,000 for identical violations.
Violations due to reasonable cause — where the covered entity should have known but did not act with willful neglect — carry penalties of $1,000 to $50,000, with an annual cap of $100,000. Willful neglect that is corrected within 30 days carries fines of $10,000 to $50,000, capped at $250,000 annually. Willful neglect that is not corrected carries the highest penalties: $50,000 per violation up to an annual maximum of $1.9 million.
Criminal penalties under HIPAA are available when violations involve knowingly obtaining or disclosing PHI. Basic criminal violations carry fines up to $50,000 and imprisonment up to one year. If the offense is committed under false pretenses, fines increase to $100,000 and imprisonment to five years. If the offense is committed with intent to sell, transfer, or use PHI for commercial advantage, personal gain, or malicious harm, penalties escalate to fines up to $250,000 and imprisonment up to ten years. These criminal provisions apply to individuals, not just organizations, and have resulted in real prosecutions.
Major enforcement actions highlight the seriousness with which the OCR pursues violations. In recent years, settlements have ranged from tens of thousands of dollars for small providers to tens of millions for large health systems. Common triggers for enforcement actions include failure to conduct a risk analysis, lack of an adequate risk management plan, impermissible disclosures of PHI, failure to provide patients access to their records within the required 30-day window, and insufficient safeguards against breaches. Each of these failures reflects a gap in compliance with one or both of the two main HIPAA rules.
State attorneys general also have independent authority to bring civil actions under HIPAA on behalf of state residents. This creates a dual enforcement environment where organizations can face both federal OCR action and state-level prosecution for the same violation. Some states have also enacted their own health privacy laws that are more stringent than HIPAA — California's CMIA and New York's SHIELD Act, for example — and compliance with HIPAA does not automatically ensure compliance with these state laws.
The Breach Notification Rule, added to HIPAA by the HITECH Act in 2009, works alongside the two main rules to create a comprehensive enforcement framework. When a breach of unsecured PHI occurs, covered entities must notify affected individuals within 60 days of discovering the breach, notify HHS, and — for breaches affecting more than 500 residents of a state — notify prominent media outlets in that state. HHS maintains a public online database of breaches affecting 500 or more individuals, commonly called the HIPAA Wall of Shame, which has become a powerful reputational enforcement mechanism beyond formal penalties.
For compliance officers and healthcare administrators, understanding enforcement trends is as important as understanding the rules themselves. The OCR has increasingly focused enforcement on systematic failures — organizations that lack a risk analysis, have no written policies, or have never trained their workforce — rather than on isolated incidents. This enforcement philosophy underscores the importance of building a robust, documented compliance program that addresses both the Privacy Rule and the Security Rule comprehensively and continuously.
Building a practical HIPAA compliance program requires translating the abstract requirements of both main rules into concrete operational procedures. The starting point is always a comprehensive risk analysis — a systematic review of all the ways in which ePHI flows through your organization, including where it is created, received, stored, processed, and transmitted. This analysis must identify potential threats to ePHI, assess the likelihood and impact of those threats, and result in a documented risk register that leadership can use to prioritize remediation efforts.
Once the risk analysis is complete, organizations must implement a risk management plan that addresses each identified risk with specific controls. The Security Rule does not mandate any particular technology — instead, it requires that controls be reasonable and appropriate given the organization's size, capabilities, and the nature of the risks identified. A large academic medical center and a three-physician rural practice face very different threat landscapes and have very different resources, and the Security Rule explicitly accounts for this by allowing implementation to scale with organizational complexity.
Workforce training is one of the most consistently cited deficiencies in OCR enforcement actions, yet it is also one of the most straightforward requirements to address. Every member of the workforce — clinical and administrative — must receive training on HIPAA policies and procedures that is relevant to their job functions. Training should cover what constitutes PHI, what employees are and are not permitted to do with PHI, how to recognize and report potential breaches, and what the consequences of violations are. Training must be documented and should be updated whenever policies change or when new threats emerge.
Vendor management is an often-overlooked aspect of HIPAA compliance that becomes more critical as healthcare organizations rely on an expanding ecosystem of cloud services, software platforms, and outsourced business functions. Before sharing PHI with any vendor, organizations must ensure that a signed Business Associate Agreement is in place. The BAA must specify the permitted uses and disclosures of PHI, require the vendor to implement appropriate safeguards, obligate the vendor to report breaches, and establish the vendor's obligations upon termination of the relationship, including returning or destroying PHI.
Incident response planning is the practical bridge between the Security Rule's safeguard requirements and the Breach Notification Rule's response obligations. Organizations should develop and test a written incident response plan that defines how security incidents will be detected, how they will be assessed to determine whether a breach occurred, how affected individuals and regulators will be notified if required, and how the organization will remediate the root cause to prevent recurrence. Regular tabletop exercises that walk teams through simulated breach scenarios are an effective way to validate that incident response plans will function under real-world pressure.
Documentation is the final and perhaps most practically important compliance discipline. The Security Rule requires covered entities to document all policies, procedures, risk analyses, training records, Business Associate Agreements, and security incident responses, and to retain those documents for at least six years from the date of creation or the date they were last in effect, whichever is later. During an OCR investigation or audit, documentation is the primary evidence that compliance efforts actually occurred. An organization that has implemented excellent security controls but failed to document them will face the same scrutiny as one that implemented nothing at all.
Ongoing monitoring and periodic review complete the compliance lifecycle. HIPAA compliance is not a one-time project — it is a continuous program that must evolve as the organization's operations change, as new technologies are adopted, as the threat landscape shifts, and as the regulatory environment is updated.
Annual reviews of policies, procedures, and risk analyses are generally considered a minimum standard, with more frequent reviews triggered by significant operational changes, security incidents, or regulatory updates. Organizations that embed HIPAA compliance into their operational culture — rather than treating it as a periodic audit exercise — are far better positioned to maintain sustainable compliance over time.
For healthcare professionals preparing for HIPAA compliance certification exams or workplace training assessments, a structured approach to studying both main rules will significantly improve comprehension and retention. Begin by mastering the definitions: know what constitutes PHI, understand the 18 specific identifiers that can make health information identifiable, and clearly distinguish between covered entities and business associates. These definitional foundations underpin virtually every other HIPAA concept you will encounter.
Next, focus on the permitted uses and disclosures framework under the Privacy Rule. Memorize the treatment, payment, and operations exceptions and be able to apply them to realistic scenarios. Practice distinguishing between situations where a written authorization is required and situations where it is not. Exam questions frequently present clinical or administrative scenarios and ask you to identify whether the proposed use or disclosure is permissible — strong scenario-based practice is the most effective preparation for these questions.
For the Security Rule, organize your study around the three safeguard categories: administrative, physical, and technical. Within each category, understand which implementation specifications are required versus addressable. Required specifications must be implemented — there is no alternative. Addressable specifications must be implemented if they are reasonable and appropriate for the organization; if they are not, the organization must document why and implement an equivalent alternative measure. This distinction is frequently tested and is often misunderstood by exam candidates who assume addressable means optional.
Practice questions are an indispensable preparation tool. Working through realistic HIPAA scenarios forces you to apply regulatory text to practical situations in the same way that real compliance decisions require. Focus especially on questions that present edge cases — situations where multiple rules may apply simultaneously, or where the permissibility of a disclosure depends on subtle factual distinctions. These edge cases are precisely what examiners use to separate candidates who have memorized rules from those who have genuinely internalized the compliance framework.
Time management matters on HIPAA certification exams. Most exams allow approximately one minute per question, which means you cannot spend excessive time analyzing each scenario. Practice answering questions under timed conditions so that your decision-making process becomes efficient and reliable. When you encounter a difficult question, use a process of elimination: identify which answer choices are clearly wrong before weighing the remaining options. Many HIPAA exam questions are designed so that two answers are clearly incorrect, one is plausible but technically wrong, and one is unambiguously correct — recognizing this structure helps you allocate your reasoning time effectively.
Review enforcement case studies as part of your preparation. The OCR publishes summaries of resolved enforcement actions on the HHS website, and these case studies are invaluable for understanding how the two main HIPAA rules apply in real-world situations. Each case study identifies the violation, explains the root cause, describes the corrective action required, and states the penalty amount. Reading 20 to 30 of these case studies will give you a vivid, concrete understanding of what compliance failures look like and why they happen — knowledge that translates directly into better exam performance and better real-world compliance judgment.
Finally, do not underestimate the value of teaching what you have learned to others. Explaining the Privacy Rule's Minimum Necessary Standard to a colleague, or walking through the three Security Rule safeguard categories with a fellow student, forces you to identify gaps in your own understanding and strengthens your ability to recall and apply concepts under exam pressure. HIPAA compliance knowledge is most durable when it is deeply integrated into your professional mental model rather than stored as a list of memorized facts — and teaching accelerates that integration faster than almost any other study technique.