The Privacy Rule in Practice: Permitted Uses, Minimum Necessary, Patient Rights and 42 CFR Part 2

Rule versions described: the HIPAA Privacy Rule at 45 CFR Part 164, Subpart E (164.500 to 164.534), as amended by the 2013 Omnibus Rule (78 FR 5566, January 25, 2013) and the April 26, 2024 Privacy Rule amendments (89 FR 32976), as partly vacated on June 18, 2025 in Purl v. HHS; and 42 CFR Part 2 as revised by the February 16, 2024 final rule (89 FR 12472). Current eCFR and Cornell LII text read October 28, 2026. These rules change: a pending Privacy Rule final rule and a proposed right of access rule are on HHS's agenda. Check the regulator's current text before relying on any point.

Most training on the HIPAA Privacy Rule treats it as a legal topic: what a patient may demand, what a clinic may say, what the penalties are. This lesson treats it as an operations and security topic. Every permission and every right in the rule turns into something a practice manager, a health plan analyst or an IT provider has to build: a role in the electronic health record (EHR), a release-of-information queue, a field on an intake form, a flag on a chart, a script for the front desk, a report the privacy officer can pull. When OCR, the HHS Office for Civil Rights that enforces HIPAA, finds a Privacy Rule violation, the root cause is usually a workflow that nobody designed, not a rule nobody knew.

If HIPAA is new to you, start with the overview in Privacy and Data Security Laws, lesson 3: Health Privacy: HIPAA and Beyond, which covers who HIPAA binds, the basics of the access right and health data outside HIPAA. Lesson 1 of this module, Who HIPAA Covers, goes deeper on covered entities, business associates and what counts as PHI. This lesson assumes you know those terms and goes into the machinery: how disclosures are permitted, how minimum necessary shapes access control, what each patient right requires on the calendar, how the privacy official's program is supposed to run, and how 42 CFR Part 2 now fits beside HIPAA for substance use disorder records.

The Privacy Rule as a permission system

The single most useful sentence in the Privacy Rule is at 45 CFR 164.502(a): a covered entity or business associate "may not use or disclose protected health information, except as permitted or required" by the rule.¹ It is a default-deny rule, the same design principle a firewall uses. Anything not on the list of permissions is prohibited. That framing helps when someone asks, "Is there anything in HIPAA that says we can't do this?" The better question is, "Which permission lets us do it?"

Uses versus disclosures

The rule distinguishes a use (sharing, applying, examining or analyzing PHI inside the organization that holds it) from a disclosure (releasing, transferring, providing access to or divulging PHI outside that organization). The definitions are in 45 CFR 160.103.⁷ The difference matters for system design. A use is controlled mainly by internal access rights: who in the workforce can open which records. A disclosure is controlled by release workflows, interfaces and contracts: who outside the organization receives what, by which channel, under which permission, and whether it has to be logged for the patient's accounting.

Two other definitions run through the rest of this lesson. The workforce includes employees, volunteers, trainees and other people whose conduct is under the direct control of the covered entity, whether or not they are paid.⁷ A designated record set is the medical and billing records about individuals kept by a provider, the enrollment, payment, claims and case management records of a health plan, and any other records used to make decisions about individuals (45 CFR 164.501).⁸ The designated record set is what the patient's access and amendment rights reach, so knowing which systems hold it is an inventory task, not a legal abstraction.

The permissions, in order

Section 164.502(a)(1) lists what a covered entity is permitted to do. It may use or disclose PHI:

1. to the individual who is the subject of the information;
2. for its own treatment, payment or health care operations, as set out in 164.506;
3. incident to an otherwise permitted use or disclosure, if it has applied reasonable safeguards and minimum necessary;
4. under a valid authorization (164.508);
5. with the individual's agreement, or after a chance to object, in the situations in 164.510 (facility directories, family and friends involved in care, notification and disaster relief);
6. for the public interest purposes in 164.512, without authorization and without a chance to object;
7. as part of a limited data set under a data use agreement (164.514(e)).¹

Disclosure is required in only two situations: to the individual when they exercise the right of access or the right to an accounting, and to the HHS Secretary when HHS is investigating or reviewing compliance (164.502(a)(2)). Business associates have parallel duties: they must disclose to HHS and, as their contract requires, help the covered entity meet patients' access requests.¹ Then there are uses that are prohibited even with permission elsewhere in the rule, most notably a health plan's use of genetic information for underwriting (164.502(a)(5)(i)), and uses that require an authorization no matter how routine they feel to the business, such as most marketing and any sale of PHI (164.508(a)(3) and (4)).⁹

Treatment, payment and health care operations

Section 164.506 is the workhorse of the Privacy Rule. It lets a covered entity use and disclose PHI for its own treatment, payment and health care operations, usually shortened to TPO, without asking the patient.¹⁰ That is why a clinic does not need a signed form to send a referral, bill an insurer or run a quality review. Each of the three terms is defined in 164.501, and the definitions are broader than their everyday meaning.⁸

Treatment

Treatment means providing, coordinating or managing health care and related services by one or more providers, including coordination with a third party, consultation between providers, and referrals.⁸ A hospitalist calling a patient's primary care doctor, a clinic faxing (or, better, securely sending) records to a specialist, a pharmacist calling a prescriber to question a dose: all treatment. Two features matter for operations. First, a provider may disclose PHI for the treatment activities of another provider (164.506(c)(2)), so a clinic may send records to a new specialist the patient is seeing even if the clinic itself is no longer treating them.¹⁰ Second, disclosures to a provider for treatment are exempt from minimum necessary (164.502(b)(2)(i)), a deliberate choice so clinicians are not second-guessed about what another clinician needs.¹

Payment

Payment covers a provider's and a health plan's activities to obtain or provide reimbursement: eligibility and coverage checks, billing, claims management, collection, medical necessity review, utilization review, preauthorization and the like.⁸ A covered entity may disclose PHI for the payment activities of another covered entity or provider (164.506(c)(3)), so an ambulance company may get the hospital's facesheet to bill for the transport. Payment is not exempt from minimum necessary. A billing office that sends the whole chart to a payer to support one line item is a common, avoidable over-disclosure.

Health care operations

Health care operations is the broadest category: quality assessment and improvement, case management and care coordination, reviewing the competence of professionals, training programs, accreditation and licensing, underwriting and other insurance activities (subject to the genetic information ban), medical review, legal services and auditing functions including fraud and abuse detection and compliance programs, business planning and development, and business management and general administration, including customer service and resolving internal grievances.⁸ A compliance audit of who looked at which chart is itself a health care operation. So is the privacy officer's investigation of a complaint.

Disclosures for another covered entity's operations are narrower. Section 164.506(c)(4) allows them only if both entities have or had a relationship with the patient, the PHI pertains to that relationship, and the purpose is one of the listed quality, competence, training, accreditation or fraud and abuse activities.¹⁰ Members of an organized health care arrangement (OHCA), such as a hospital and its independent medical staff, may share PHI for the joint operations of the arrangement (164.506(c)(5)).

Consent is optional under HIPAA, but not under every other law

Section 164.506(b) says a covered entity may obtain a patient's consent for TPO, but it is not required, and a consent form under HIPAA does not substitute for an authorization where one is needed.¹⁰ Many organizations still have patients sign a general consent at registration because state law, accreditation standards or other federal laws require one. The most important of those other federal laws for this lesson is 42 CFR Part 2, which until the 2024 rule required patient consent for nearly every disclosure of SUD treatment records, including for treatment and payment. That is covered in depth in the Part 2 section below. State laws, including Idaho's, can add their own confidentiality rules for particular kinds of records; those state rules apply where they are more protective than HIPAA, because HIPAA preempts only contrary and less protective state law (45 CFR 160.203).¹¹

What TPO means for system design

Because TPO needs no patient permission, the controls around it are almost entirely internal: role-based access, interface configuration, and policy on what may be sent, to whom, by which channel. A practical design check is to list every outbound flow of PHI from your systems (claims to the clearinghouse, referrals to specialists, immunization data to the state registry, lab orders, the patient portal, the health information exchange, the cloud backup) and label each with its permission: treatment, payment, operations, required by law, public health, business associate, authorization. Any flow that cannot be labeled is either a business associate relationship missing a contract (see lesson 6) or a disclosure that is not permitted. The same inventory feeds the Security Rule risk analysis described in lesson 4.

Family, friends and the facility directory

Section 164.510 covers the situations where the patient gets a chance to agree or object, informally and often orally.¹² They are some of the most frequent decisions front-line staff make, and some of the most misunderstood.

• Facility directory (164.510(a)). A hospital may list a patient's name, location in the facility, general condition (described in terms like "fair" or "stable") and religious affiliation, and may give all but religion to anyone who asks for the patient by name. Clergy may get the religion too. The patient must be told and given a chance to restrict or opt out; in an emergency, the hospital may list them and offer the choice when practicable.
• People involved in care or payment (164.510(b)). A provider may share information directly relevant to a family member's, relative's, friend's or other identified person's involvement in the patient's care or payment for care. If the patient is present and capable, the provider gets agreement, gives a chance to object, or reasonably infers from the circumstances that the patient does not object (a spouse in the exam room, for example). If the patient is absent or incapacitated, the provider uses professional judgment about the patient's best interests.
• Notification and disaster relief. A covered entity may use or disclose PHI to notify family of a patient's location, general condition or death, and may coordinate with disaster relief organizations.
• Deceased patients. A covered entity may disclose to family and others involved in the patient's care before death the PHI relevant to that involvement, unless doing so is inconsistent with the patient's known prior wishes.¹²

Operationally, these permissions need two things: a place in the record to capture the patient's stated preferences (who may be told what, and any opt-out from the directory), and front-desk and nursing scripts that check that place before speaking. A common failure is a preference that lives in a paper note or one nurse's memory and not where the next shift or the call center can see it.

The 12 public interest permissions in 164.512

Section 164.512 lets a covered entity use or disclose PHI without authorization and without giving the patient a chance to object for what HHS's summary of the rule calls "12 national priority purposes."¹³ These are the disclosures that surprise patients most, and the ones where front-line staff most need a defined process, because each permission comes with conditions. A disclosure that meets the purpose but skips a condition is not permitted. The 2024 reproductive health rule added conditions to several of these paragraphs; most of those additions were vacated in June 2025 (see below), so the conditions in the table are the long-standing ones.¹⁴

Two cross-cutting rules apply to most of these. Minimum necessary applies to all of them except disclosures required by law (164.502(b)(2)(v)), and the covered entity must verify the identity and authority of a person requesting PHI if it does not already know them (164.514(h)).² Most 164.512 disclosures are also accountable, meaning they must be logged so the patient can get an accounting of them on request (see the accounting section below). That logging requirement is the one most often missed, because these disclosures happen by phone, fax and portal upload outside the normal release-of-information system.

A request desk for outside requests

Organizations that handle 164.512 requests well usually route them all to one place, often the health information management (HIM) or release-of-information team, rather than letting each department answer subpoenas, police calls and agency letters on its own. A workable process looks like this:

1. Log the request on arrival: who asked, when, by what channel, what they want, for which patient, and what authority they cite.
2. Verify identity and authority under 164.514(h): a badge or official letterhead for a public official, a court seal for an order, a written statement of legal authority where needed.
3. Match the request to one specific permission in 164.512 (or to an authorization), and check that paragraph's conditions, including the assurances needed for a subpoena without a court order.
4. Check for records with special protection before release: psychotherapy notes, Part 2 SUD records (which need a court order meeting Part 2's own rules for most proceedings and law enforcement uses), and state-protected categories.
5. Apply minimum necessary unless the disclosure is required by law, and release only the responsive records.
6. Send by a secure channel, and record what was sent in the accounting of disclosures log.
7. Escalate to the privacy officer anything unusual: requests that would make the patient the subject of an investigation, requests without clear authority, media inquiries, and anything involving a Part 2 program.

Media inquiries deserve their own line in the playbook. No 164.512 permission covers disclosures to the press. OCR's November 2023 settlement with Saint Joseph's Medical Center in New York ($80,000) followed an Associated Press story about the hospital's COVID-19 response that included photographs and information about three patients, including diagnoses, vital signs and treatment plans, released without their written authorization.¹⁵ New York-Presbyterian paid $2.2 million in 2016 after allowing a television crew to film patients for a documentary series.¹⁶

Minimum necessary

The minimum necessary standard at 164.502(b) says that when a covered entity or business associate uses, discloses or requests PHI, it must make reasonable efforts to limit the PHI to the minimum necessary to accomplish the intended purpose.¹ The implementation specifications at 164.514(d) turn that into three required programs.²

The three parts of minimum necessary

• Uses (164.514(d)(2)). Identify the people or classes of people in the workforce who need access to PHI to do their jobs, the categories of PHI each needs, and any conditions on that access, then make reasonable efforts to limit access accordingly. This is role-based access, written into the regulation in 2000.
• Routine disclosures and requests (164.514(d)(3) and (d)(4)). For disclosures and requests that recur, use standard protocols that limit the PHI to what is reasonably necessary. Individual review is not required.
• Non-routine disclosures and requests. Set criteria and review each one individually.

One sentence in 164.514(d)(5) carries a great deal of weight: a covered entity may not use, disclose or request an entire medical record unless the entire record is specifically justified as reasonably necessary for the purpose.² HHS guidance says a hospital may give treating clinicians access to the whole record when needed, but the policy has to say so and explain why.¹⁷

Where minimum necessary does not apply

Section 164.502(b)(2) lists the exceptions: disclosures to or requests by a provider for treatment; uses or disclosures to the individual; uses or disclosures under a valid authorization; disclosures to HHS for compliance and enforcement; uses or disclosures required by law; and uses or disclosures required for compliance with the HIPAA rules.¹ The treatment exception covers disclosures between providers, not every internal use by clinical staff; internal clinical access is still a "use" that the role-based access policy governs.

Reasonable reliance on the requester

For some disclosures, a covered entity may reasonably rely on the requester's statement that it asked for the minimum necessary: a public official who represents that the request is the minimum necessary for a permitted purpose, another covered entity, a professional who is a workforce member or business associate providing professional services, and a researcher with documentation from an IRB or privacy board (164.514(d)(3)(iii)). HHS's guidance stresses that reliance is permitted, not required.¹⁷ If a request plainly asks for more than its stated purpose needs, the covered entity can and should push back.

Role-based access: the security twin of minimum necessary

Minimum necessary is a Privacy Rule duty, but almost all of it is carried out by Security Rule controls. The Security Rule requires information access management policies (45 CFR 164.308(a)(4)), workforce security procedures for authorizing, clearing and terminating access (164.308(a)(3)), unique user identification and an emergency access procedure (164.312(a)(2)(i) and (ii), both required), audit controls that record activity in systems containing ePHI (164.312(b)), and regular review of system activity records such as audit logs and access reports (164.308(a)(1)(ii)(D)).¹⁸¹⁹ The mapping looks like this:

The plain-language base for identity and access control (account life cycle, multi-factor sign-in, privileged accounts, device control) is in Privacy and Security for Small and Medium Businesses, lesson 14: Identity, Access and Device Control. The Security Rule itself, and HHS's proposed changes to it, are in lesson 3 of this module.

Snooping is a minimum necessary failure

When workforce members look up records they have no job reason to see, it is both an impermissible use under the Privacy Rule and, usually, a breach that must be assessed under the Breach Notification Rule (lesson 5). OCR's enforcement record shows the cost. In June 2023, Yakima Valley Memorial Hospital in Washington paid $240,000 after security guards accessed the medical records of 419 people without a job reason; its corrective action plan required updated safeguarding policies and training "to prevent this type of snooping behavior in the future."²⁰ In February 2024, Montefiore Medical Center in New York paid $4.75 million after a malicious insider stole patient information.¹⁶ In both kinds of cases, the controls that would have caught the problem early were the same: narrower roles and audit logs someone actually reviewed.

Incidental disclosures and reasonable safeguards

A clinic is a physical place where people talk, and the Privacy Rule does not demand silence. Section 164.502(a)(1)(iii) permits a use or disclosure that is incident to an otherwise permitted one, as long as the covered entity has met minimum necessary and the safeguards standard in 164.530(c).¹ That standard requires "appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information," and specifically safeguards that reasonably protect PHI from intentional or unintentional uses or disclosures that violate the rule and that limit incidental uses or disclosures.²¹

HHS's guidance on incidental uses and disclosures gives examples of what can be incidental: a visitor overhearing a provider's conversation with a patient or another provider, a glimpse of a sign-in sheet, information seen on a nursing station whiteboard. It gives examples of reasonable safeguards: speaking quietly when discussing a patient's condition with family in a waiting room, avoiding patients' names in public hallways and elevators, posting signs reminding staff to protect confidentiality, locking file cabinets and records rooms, and using passwords on systems with PHI.²² The rule does not require structural changes like soundproof walls, and an incidental disclosure is not permitted if the covered entity failed to take reasonable safeguards in the first place.

The digital version of incidental

The examples HHS wrote in the early 2000s are about paper and voices. Today the same analysis applies to screens and messages, and the safeguards are mostly technical:

• Screens facing waiting rooms need privacy filters or a different angle, and workstations need automatic screen locks (an addressable Security Rule specification at 164.312(a)(2)(iii)).¹⁹
• Patient tracking boards in hallways can show initials or room numbers rather than full names and reasons for visit.
• Misdirected faxes and emails are not incidental disclosures; they are errors that must be assessed as possible breaches. Preprogrammed fax numbers, address autocomplete controls and data loss prevention rules reduce them.
• Appointment reminders left on voicemail should carry the minimum: a name, a callback number, and nothing about the reason for the visit unless the patient has agreed.
• Sign-in sheets are permitted, but should not ask for the reason for the visit.

Shen Smiles, a Pennsylvania dental practice, paid $140,000 in a settlement OCR announced October 8, 2026. During the investigation, the practice told OCR it could not give the patient her records because a workforce member had stolen them; OCR found it had no right of access policies and had not reasonably safeguarded PHI against intentional or unintentional impermissible uses or disclosures, which is the 164.530(c) standard.³

Authorizations

When no other permission applies, the covered entity needs the patient's written authorization under 164.508.⁹ An authorization is different from the optional TPO "consent" mentioned above: it is a detailed, specific form with required contents, and if any required piece is missing the authorization is defective and the disclosure is not permitted.

When an authorization is required

• Anything not otherwise permitted. Releasing records to a patient's employer, a life insurer, a lawyer for a private lawsuit without a subpoena or order, or a school (outside the immunization permission) usually needs an authorization.
• Psychotherapy notes (164.508(a)(2)). These are a mental health professional's notes analyzing or documenting the contents of a counseling session, kept separate from the rest of the record (164.501).⁸ Nearly every use or disclosure needs an authorization, with narrow exceptions such as the note-taker's own treatment use, supervised training programs, and the covered entity's defense in a legal action brought by the patient. An authorization for psychotherapy notes may be combined only with another authorization for psychotherapy notes.
• Marketing (164.508(a)(3)). Communications that encourage the recipient to buy or use a product or service need an authorization, except face-to-face communications and promotional gifts of nominal value. If a third party pays for the marketing, the authorization must say so.
• Sale of PHI (164.508(a)(4)). Any disclosure for which the covered entity receives remuneration needs an authorization stating that remuneration is involved, unless one of the listed exceptions applies.⁹

Core elements and required statements

Section 164.508(c)(1) lists six core elements every authorization must contain:⁹

1. a description of the information to be used or disclosed, in a specific and meaningful way;
2. the name or other specific identification of the person or class of persons authorized to make the disclosure;
3. the name or other specific identification of the person or class of persons who may receive it;
4. a description of each purpose (the statement "at the request of the individual" is enough when the patient initiates it and does not give a purpose);
5. an expiration date or an expiration event that relates to the individual or the purpose;
6. the individual's signature and the date, and, if a personal representative signs, a description of their authority.

Section 164.508(c)(2) adds three required statements: the individual's right to revoke the authorization in writing and how to do it (or a reference to the Notice of Privacy Practices if it describes this); whether the covered entity may condition treatment, payment, enrollment or eligibility on signing; and that information disclosed may be redisclosed by the recipient and no longer protected by the Privacy Rule. The authorization must be in plain language, and the patient must get a copy of the signed form (164.508(c)(3) and (4)).

Defective, compound and conditioned authorizations

An authorization is defective, and cannot be relied on, if the expiration date has passed or the expiration event is known to have occurred, if it is not filled out completely, if it is known to have been revoked, if it violates the rules on combining or conditioning, or if material information in it is known to be false (164.508(b)(2)). Most authorizations may not be combined with other documents (164.508(b)(3)), and a covered entity generally may not condition treatment, payment, enrollment or eligibility on a patient signing one (164.508(b)(4)). The exceptions are narrow: research-related treatment, health plan enrollment underwriting (never for psychotherapy notes), and services provided solely to create PHI for a third party, such as a pre-employment physical.⁹ Revocation must be in writing and is effective except to the extent the covered entity already acted in reliance on the authorization (164.508(b)(5)).

An authorization workflow that holds up

OCR's November 2024 settlement with Holy Redeemer Family Medicine in Pennsylvania shows what goes wrong without one. The practice sent a patient's protected health information, including "highly sensitive reproductive health information," to her prospective employer without a valid authorization. It paid $35,581 and took on a two-year corrective action plan with revised policies, training repeated at least every 12 months, and reporting to HHS.²³ The disclosure would have needed an authorization limited to what the employer was entitled to see. A defensible workflow has a few fixed steps:

1. Use one standard authorization form, built from the six core elements and three statements, with a field for exactly which records are covered (for example "results of the pre-employment drug screen dated..." rather than "all records").
2. Check every incoming authorization (including forms written by lawyers and insurers) against the same checklist before release; reject or return defective ones.
3. Release only what the authorization describes. Pre-employment and insurance requests are classic places where a whole chart goes out when one page was authorized.
4. Scan the signed authorization into the record, and keep it for six years (164.530(j)).
5. Track revocations so the next request does not rely on a revoked form.

The Notice of Privacy Practices

Section 164.520 requires covered health care providers and health plans to give individuals a Notice of Privacy Practices (NPP) describing how the entity uses and discloses PHI, the individual's rights, and the entity's legal duties.²⁴ The notice must carry, as a header or otherwise prominently displayed, the statement: "THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY."

What the notice must say

Under 164.520(b), the notice must describe, with at least one example, the uses and disclosures permitted for treatment, payment and health care operations; describe each other purpose for which the entity may use or disclose PHI without authorization; reflect more stringent law where it applies (the current text names 42 CFR Part 2 as an example); state that other uses need written authorization that can be revoked; and list each individual right and how to exercise it: restrictions, confidential communications, access, amendment, accounting, and a paper copy of the notice.²⁴ It must include separate statements if the entity plans to contact the individual for fundraising (with the right to opt out), if a group health plan discloses to a plan sponsor, and if a health plan uses PHI for underwriting (with the statement that it may not use genetic information for that purpose). The notice must state the entity's duties, how to complain to the entity and to HHS (with a promise of no retaliation), a contact person, and the effective date.

Distribution and acknowledgment

A provider with a direct treatment relationship must give the notice no later than the first service delivery, make a good-faith effort to get a written acknowledgment of receipt (and document why if it could not), keep copies available at the site and post it in a clear and prominent location, and post it prominently on its website if it has one that describes its services (164.520(c)).²⁴ Health plans must give the notice at enrollment and, at least once every three years, tell enrollees that it is available and how to get it. When a material change is made, the notice must be revised and redistributed by the method the rule sets for each type of entity.

The February 16, 2026 update

The two 2024 rules changed the NPP in a coordinated way. The Part 2 final rule of February 16, 2024 aligned the Part 2 patient notice with the HIPAA notice, and the HIPAA Privacy Rule amendments of April 26, 2024 (89 FR 32976) made the matching changes to 164.520, with an amendment citation of 89 FR 33064.²⁴²⁵ The current text adds two statements for covered entities that create or maintain Part 2 records:

• 164.520(b)(1)(iii)(D): a statement that Part 2 records, or testimony relaying their content, will not be used or disclosed in a civil, criminal, administrative or legislative proceeding against the individual without the individual's written consent or a court order after notice and an opportunity to be heard, and that a court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure;
• 164.520(b)(1)(iii)(E): if the entity intends to use or disclose Part 2 records for fundraising, a statement that the individual must first be given a clear and conspicuous opportunity to opt out.

Compliance with these notice changes was required by February 16, 2026, the same date as the Part 2 rule's compliance date.⁵ HHS published an updated model HIPAA Notice of Privacy Practices for providers and plans that create or maintain Part 2 records and a model Part 2 patient notice for Part 2 programs; a Part 2 program that is also a HIPAA covered entity may use a single combined notice.²⁶

What the Purl decision left standing in the notice

The 2024 reproductive health rule also added three notice provisions, 164.520(b)(1)(ii)(F), (G) and (H): a description of uses and disclosures prohibited under the new reproductive health provision, a description of uses and disclosures that require an attestation under 164.509, and a statement that information disclosed may be redisclosed and lose protection. On June 18, 2025, the U.S. District Court for the Northern District of Texas, in Carmen Purl, et al. v. HHS, No. 2:24-cv-00228-Z, declared unlawful and vacated most of the reproductive health rule, and among the notice changes vacated only (F), (G) and (H). HHS's page states that "the remaining modifications to the NPP requirements are undisturbed and remain in effect" and that compliance with them was required by February 16, 2026.⁵ In plain terms: a covered entity did not have to add the reproductive health statements, but it did have to add the Part 2 statements if it creates or maintains Part 2 records.

Patient rights, on the calendar

The Privacy Rule gives individuals five rights over their PHI beyond the notice itself: access, amendment, an accounting of disclosures, restrictions, and confidential communications. Each comes with deadlines, and each needs a queue, a log and an owner. The timeline below shows the clocks.

The right of access

Section 164.524 gives individuals a right to inspect and get a copy of their PHI in a designated record set, for as long as the covered entity keeps it.²⁷ The operational requirements are specific:

• Timing. The covered entity must act on a request no later than 30 days after receiving it. If it cannot, it may extend once by up to 30 more days, but only if, within the first 30 days, it gives the individual a written statement of the reasons for the delay and the date by which it will complete the action (164.524(b)(2)).
• Form and format. It must provide access in the form and format requested if readily producible; for PHI kept electronically, it must provide an electronic copy in the form requested if readily producible, or otherwise in a readable electronic form agreed with the individual (164.524(c)(2)).
• Sending to a third party. If the individual directs in writing, signed and clearly identifying the recipient, that the copy go to another person, the covered entity must send it there (164.524(c)(3)(ii)).
• Fees. Any fee must be reasonable and cost-based and may include only labor for copying, supplies (paper, or portable electronic media if the individual asks for it on media), postage, and preparing an agreed summary or explanation (164.524(c)(4)). Search and retrieval costs are not allowed.
• Verification. The covered entity must verify identity (164.514(h)), but may not use verification to create unreasonable barriers, and may require written requests only if it tells individuals in advance.

HHS's guidance describes three ways to set fees for an individual's own copies: actual allowable costs, a schedule of average allowable labor costs, or, for electronic copies of PHI kept electronically, a flat fee "not to exceed $6.50 (inclusive of all labor, supplies, and postage)." HHS says the $6.50 figure is an option for entities that do not want to calculate costs, not a cap on every fee.²⁸ Since Ciox Health, LLC v. Azar, No. 18-cv-0040 (D.D.C. January 23, 2020), HHS's fee guidance applies only to the extent it is consistent with that order, and the patient-rate fee limits do not apply when a third party requests records on its own behalf with the patient's authorization. They do still apply when the patient directs that a copy be sent to a third party under the access right.²⁹

Denials come in two kinds. Some grounds are unreviewable: psychotherapy notes; information compiled in reasonable anticipation of, or for use in, a legal proceeding; certain requests by inmates of correctional institutions; information in a research study while it is in progress, if the individual agreed; records covered by the federal Privacy Act; and information obtained from someone other than a provider under a promise of confidentiality. Other grounds are reviewable by another licensed professional chosen by the covered entity: a licensed professional's determination that access is reasonably likely to endanger the life or physical safety of the individual or another person, that the record references another person and access is reasonably likely to cause that person substantial harm, or that access by a personal representative is reasonably likely to cause substantial harm.²⁷ A denial must be in writing, in plain language, and must explain any review rights and how to complain. Even when part of a record may be denied, the rest must be provided.

Laboratories are part of this right. Since a 2014 rule that amended both the CLIA laboratory regulations and the Privacy Rule, HIPAA covered labs must give patients direct access to their completed test reports.³⁰ Separately, the federal information blocking rules (45 CFR Part 171, first finalized May 1, 2020) apply to most providers, health IT developers and health information networks, and an unreasonable delay in giving patients their electronic health information can be information blocking as well as a HIPAA access violation.³¹

The Right of Access Initiative

OCR announced its Right of Access Initiative in 2019 to enforce timely, affordable access. OCR's August 27, 2026 settlement with Azul Vision, Inc., a California eye care group, "marks the 55th enforcement action" in the initiative: a patient asked for her records in January 2023, complained to OCR in April 2023, and did not get them until January 2025, after OCR opened its investigation. Azul Vision paid $50,000 and agreed to a two-year corrective action plan that includes revised policies, training on the access right, and regular reports to HHS logging each access request with the date received and the date completed.³² OCR's October 8, 2026 announcement of the Shen Smiles settlement is subtitled "Settlement Marks OCR's 56th HIPAA Right of Access Enforcement Action." That makes 56 actions as of October 8, 2026.³

Other recent actions in OCR's list include a $200,000 civil money penalty against Oregon Health and Science University (March 6, 2025), a $100,000 penalty against a mental health center (November 19, 2024) and a $70,000 penalty against Gums Dental Care (October 17, 2024).¹⁶ The pattern across these cases is consistent: no written access policy, requests handled by whoever picked up the phone, no tracking of the 30-day clock, and records released only after OCR called. The corrective action plans all impose the same fix: a written procedure, a log of every request with dates, and training.

Operationally, the right of access needs:

1. A single intake point (portal, form, email address, front desk) that date-stamps every request, including verbal ones the organization chooses to accept.
2. A log with the date received, the day-30 deadline, any extension letter sent and its date, the date completed, the format provided and the fee charged.
3. A map of every system in the designated record set, including billing, imaging, patient portal messages and any outside storage, so copies are complete.
4. A posted fee schedule that matches 164.524(c)(4), and staff who know the difference between an access request (fee limits apply) and an authorization from a third party (they do not).
5. Template letters: extension notice, written denial with review rights, and a cover letter for electronic delivery.
6. A monthly report to the privacy officer of any request past day 20 with no response.

The right to amend

Section 164.526 lets individuals ask a covered entity to amend PHI in a designated record set. The entity must act no later than 60 days after receipt, with one 30-day extension if it gives a written statement of the reasons and the completion date within the first 60 days.³³ It may deny an amendment if the information was not created by the entity (unless the originator is no longer available), is not part of the designated record set, would not be available for inspection under the access right, or is accurate and complete. A denial must be written and must tell the individual they can submit a statement of disagreement, which the entity must then link to the disputed record and include in future disclosures. If it accepts the amendment, it must make it, tell the individual, and make reasonable efforts to inform people the individual identifies and others known to have the information who may rely on it. In an EHR, this means a way to append amendments and statements of disagreement to the right entries, not just a scanned letter in a miscellaneous folder.

The accounting of disclosures

Section 164.528 gives individuals a right to an accounting of disclosures of their PHI made in the six years before the request.³⁴ The list of excluded disclosures is long: those for treatment, payment and health care operations; those to the individual; incidental disclosures; those under an authorization; facility directory and family and friends disclosures under 164.510; national security and intelligence disclosures; disclosures to correctional institutions and law enforcement custodians; those in a limited data set; and those made before the compliance date. What remains are mostly 164.512 public interest disclosures (to public health, health oversight, law enforcement, courts, coroners, researchers under a waiver) and impermissible disclosures, including breaches. For each, the accounting must give the date, the recipient's name and address if known, a brief description of the PHI, and a brief statement of purpose.

The entity must act within 60 days, with one 30-day extension on written notice. The first accounting in any 12-month period is free; later ones may carry a reasonable cost-based fee if the individual is told in advance and can withdraw or change the request. A health oversight agency or law enforcement official may ask the entity to suspend the individual's right to receive an accounting of disclosures to them for a time.³⁴ HITECH directed HHS to expand the accounting to include TPO disclosures through an electronic health record; HHS proposed a rule to do so on May 31, 2011, including an "access report" of who viewed a record, but that proposal was never finalized.³⁵ Because nearly every accountable disclosure happens outside routine TPO flows, the practical control is the same log the request desk keeps.

Restrictions and the self-pay rule

Section 164.522(a) lets an individual ask a covered entity to restrict uses and disclosures for treatment, payment or operations, or to family and friends under 164.510(b).³⁶ In general the entity need not agree. If it does agree, it is bound, except that it may disclose restricted information to a provider for emergency treatment. It may end the restriction for the future with the individual's agreement or by telling the individual.

One restriction is mandatory. Under 164.522(a)(1)(vi), added by HITECH and the 2013 Omnibus Rule, a covered entity must agree to a request not to disclose PHI to a health plan for payment or health care operations (not treatment) if the PHI pertains solely to a health care item or service that the individual, or someone other than the health plan on the individual's behalf, has paid for out of pocket in full, and the disclosure is not otherwise required by law.³⁶ The NPP must say so.²⁴

The self-pay restriction is simple to state and hard to run, because most practice management and pharmacy systems are built to send every encounter to the payer automatically. To honor it, the organization needs a way to flag the specific visit, prescription or service as restricted at the point of service; to stop the claim and any related operations reporting (for example, quality data feeds to the plan) for that item; to keep the restricted item separate if a later, insured service is related; and to explain to the patient that they must pay in full and that follow-up care billed to insurance may reveal the condition. Each of those steps is a configuration and training task, and each should be tested before the first patient asks.

Confidential communications

Section 164.522(b) requires covered health care providers to accommodate reasonable requests to receive communications by alternative means or at alternative locations, such as a different mailing address or a cell phone instead of the home landline.³⁶ A provider may not require an explanation. A health plan must accommodate reasonable requests if the individual clearly states that disclosure of all or part of the information could endanger them. Either may require the request in writing and may condition the accommodation on information about how payment will be handled and on a valid alternative address or method.

Confidential communications matter most for people at risk: someone leaving an abusive relationship, a teenager covered on a parent's plan, an adult dependent whose explanation of benefits goes to the policyholder. The operational failure is a preference saved in one system (the EHR) but not in another that also sends mail or texts (the billing system, the patient portal, the appointment reminder vendor, the health plan's explanation of benefits run). The fix is to treat a confidential communications request like any other piece of contact data that must propagate to every system and every business associate that contacts patients.

Personal representatives

Section 164.502(g) requires a covered entity to treat a personal representative as the individual for purposes of the Privacy Rule, to the extent of the representative's authority.¹ For an adult or emancipated minor, that is a person with legal authority to make health care decisions, such as a health care agent under a power of attorney or a court-appointed guardian. For an unemancipated minor, it is usually the parent or guardian, with three exceptions: when the minor consents to care and no other consent is required by law, when a court or other law allows the minor or another person to consent, and when the parent agrees to a confidential relationship between the minor and the provider. Even in those cases, state law on parental access controls, and where state law is silent the provider may use professional judgment. For a deceased individual, it is the executor, administrator or other person authorized to act for the estate.

Section 164.502(g)(5) lets a covered entity decline to treat someone as a personal representative if it reasonably believes the individual has been or may be subjected to domestic violence, abuse or neglect by that person, or that treating them as the representative could endanger the individual, and it decides in professional judgment that doing so is not in the individual's best interest.¹ Systems should record who the personal representative is, the document that grants authority, its scope and any expiration, and any professional judgment decision to limit that person's access. HHS's guidance on personal representatives works through the minor and deceased-patient cases in more detail.³⁷

The privacy program: official, training, sanctions and documentation

Section 164.530 sets the administrative requirements that turn the Privacy Rule from text into a program.²¹ In OCR's settlements, these requirements are where the corrective action plans focus, because a missing program is what OCR usually finds behind a single bad disclosure.

The privacy official and the security official required by the Security Rule (164.308(a)(2)) may be the same person in a small practice. The two jobs overlap heavily: the security official owns the access controls and audit logs that the privacy official needs to enforce minimum necessary. In larger organizations the privacy and security offices should share a single incident intake, because almost every privacy incident (a misdirected email, a snooping employee, a stolen laptop) is also a security event, and vice versa. Training should cover both rules together and should be practical: how to verify a caller, what to do with a subpoena, how to spot a request that needs an authorization, where to send a patient who wants their records, and how to report a mistake quickly without fear.

Sanctions are where many programs are weakest. A sanction policy that exists on paper but is applied only to front-line staff, never to physicians or managers, invites both legal and morale problems. OCR's corrective action plans typically require entities to report "Reportable Events," meaning workforce violations of the revised policies, to HHS during the plan's term, which turns the sanction log into evidence.²³

Rules in motion as of October 2026

The pending Privacy Rule final rule (RIN 0945-AA00)

On January 21, 2021, HHS published a proposed rule, "Proposed Modifications to the HIPAA Privacy Rule To Support, and Remove Barriers to, Coordinated Care and Individual Engagement," at 86 FR 6446, RIN 0945-AA00, with comments due March 22, 2021.³⁸ Its main proposals included cutting the access response time from 30 days to 15 calendar days with one 15-day extension; strengthening in-person inspection, including letting individuals take notes and photographs of their PHI; requiring providers and plans to respond to requests sent from other providers and plans for EHR copies; changing the fee structure and requiring posted fee schedules; creating a minimum necessary exception for individual-level care coordination and case management; expressly permitting disclosures to social services agencies and community-based organizations for care coordination; replacing the "professional judgment" standard in several provisions with a good-faith belief standard; allowing disclosures to prevent a "serious and reasonably foreseeable" threat instead of a "serious and imminent" one; and eliminating the written acknowledgment of the NPP.

According to the White House Office of Information and Regulatory Affairs (OIRA), the final rule "HIPAA Privacy Rule: Changes to Support Coordinated Care and Individual Engagement and Reduce Regulatory Burdens" was received for review under Executive Order 12866 on April 2, 2026 and was still shown as pending, with no concluded date, as of October 28, 2026.⁶ OIRA review is the last step before publication, but its contents are not public until HHS publishes it, and a final rule can differ from the proposal. HHS's 2026 regulatory agenda also lists a separate proposed rule on timely access to PHI (RIN 0945-AA28), projected for November 2026, according to a law firm review of the agenda.³⁹ Until either appears in the Federal Register, the 30-day access deadline, the NPP acknowledgment and the other current provisions stay in force.

The 2024 reproductive health rule and Purl v. HHS

The April 26, 2024 final rule, "HIPAA Privacy Rule To Support Reproductive Health Care Privacy" (89 FR 32976), would have prohibited using or disclosing PHI to investigate or impose liability on anyone for seeking, obtaining, providing or facilitating reproductive health care that was lawful where provided, and would have required a signed attestation (new 164.509) for certain requests for PHI potentially related to reproductive health care, from health oversight agencies, courts, law enforcement and coroners.²⁵ On June 18, 2025, in Purl v. HHS, the Northern District of Texas declared unlawful and vacated most of that rule, leaving in place the notice changes tied to Part 2 described above.⁵ HHS did not appeal by the August 18, 2025 deadline, and the Fifth Circuit dismissed intervenors' appeal on September 10, 2025, according to a law firm analysis.⁴⁰ The eCFR still prints 164.509 with no editorial note about the vacatur, and no rule formally removing the vacated text had been found as of October 28, 2026.⁴¹ For operations, the result is that the pre-2024 rules for law enforcement, oversight and court requests govern again, and an organization that built attestation workflows in 2024 may keep using attestations voluntarily but cannot rely on the vacated rule as the reason to refuse a request that is otherwise permitted or required. State laws on reproductive health records, which vary widely, still apply.

42 CFR Part 2: substance use disorder records

Federal confidentiality protections for substance use disorder treatment records predate HIPAA by more than two decades. The statute, now at 42 U.S.C. 290dd-2, rests on the judgment that people will not seek treatment for addiction if their records can be used to arrest, prosecute, fire or evict them.⁴² The regulations at 42 CFR Part 2 were long stricter than HIPAA, requiring written patient consent for most disclosures, including for treatment and payment, which made Part 2 records hard to integrate into ordinary care. Section 3221 of the CARES Act (March 27, 2020) directed HHS to align parts of Part 2 with HIPAA while keeping the anti-prosecution protections. The result is the final rule "Confidentiality of Substance Use Disorder (SUD) Patient Records," published February 16, 2024 at 89 FR 12472, RIN 0945-AA16, effective April 16, 2024, with a compliance date of February 16, 2026.⁴³⁴

What is a Part 2 program?

Part 2 does not apply to every record that mentions drugs or alcohol. It applies to a Part 2 program, which is a federally assisted "program" under 42 CFR 2.11.⁴⁴ A program is any of the following:

• a person or entity, other than a general medical facility, that holds itself out as providing, and provides, SUD diagnosis, treatment or referral for treatment;
• an identified unit within a general medical facility that holds itself out as providing, and provides, those services; or
• medical personnel or other staff in a general medical facility whose primary function is providing those services and who are identified as such providers.

"Federally assisted" is defined broadly in 2.12(b): conducted in whole or part by a federal agency; carried out under a federal license, certification, registration or authorization, including Medicare provider participation and DEA registration to dispense controlled substances for SUD treatment; supported by federal funds in any form; or assisted by the IRS through tax-exempt status or deductible contributions.⁴⁵ In practice nearly every SUD treatment program in the country qualifies. Section 2.12(e) adds that emergency room staff who refer a patient for an apparent overdose are generally not covered unless their primary function is SUD care or the emergency department holds itself out as an SUD provider, and that a record is not covered if the SUD care was not provided by a Part 2 program, even if federal funds paid for it. VA records are governed by a separate statute, 38 U.S.C. 7332 (2.12(c)(1)).⁴⁵

Examples of Part 2 programs include an opioid treatment program dispensing methadone, a residential addiction treatment center, an identified addiction medicine unit in a hospital, and a private practitioner who advertises SUD treatment and prescribes buprenorphine under a DEA registration. A primary care clinic that occasionally treats patients for alcohol use disorder without holding itself out as an SUD provider is generally not a Part 2 program, though it may receive Part 2 records from one, and those records stay protected in its hands.

Records, lawful holders and qualified service organizations

Records under Part 2 means any information, recorded or not, created, received or acquired by a Part 2 program relating to a patient, including diagnosis, treatment and referral information, billing information, emails, voicemails and texts.⁴⁴ A record sent by a Part 2 program to a non-Part 2 provider remains a record in that provider's hands, although the provider may segregate it. A lawful holder is a person bound by Part 2 because it received records under a written consent with the required notice, or under one of the exceptions to consent. A qualified service organization (QSO) is a vendor that provides services to a Part 2 program (data processing, billing, laboratory analysis, legal, accounting, population health management, medical staffing and similar) under a written agreement acknowledging that it is fully bound by Part 2 and will, if necessary, resist in judicial proceedings any efforts to obtain access to patient identifying information except as Part 2 permits. The 2024 definition also brings in HIPAA business associates of Part 2 programs that are covered entities, for PHI that is also a Part 2 record.⁴⁴ A cloud EHR vendor serving an opioid treatment program therefore needs both a business associate agreement and QSO terms, often combined into one contract (see lesson 6).

The single consent for treatment, payment and operations

The biggest operational change in the 2024 rule is that a patient may sign a single written consent for all future uses and disclosures for treatment, payment and health care operations.⁴ The consent must still contain the elements in 42 CFR 2.31(a): the patient's name; who may make the disclosure; a specific and meaningful description of the information; the recipients by name or class; each purpose; the right to revoke in writing and how; an expiration date or event; the signature and date. For a TPO consent, the rule allows a general recipient description such as "my treating providers, health plans, third-party payers, and people helping to operate this program," a purpose of "for treatment, payment, and health care operations," and an expiration of "none." A TPO consent must also state that records may be redisclosed by the recipient and may no longer be protected by Part 2, and the consequences of refusing to sign. If the recipient is a HIPAA covered entity or business associate, the consent must say that it may redisclose under HIPAA except for uses in proceedings against the patient.⁴⁶

Three kinds of consent must stay separate. A consent to use records in a civil, criminal, administrative or legislative investigation or proceeding cannot be combined with consent for any other purpose (2.31(d)). SUD counseling notes, a new category defined in 2.11 as a Part 2 provider's notes analyzing counseling session conversations and kept separate from the rest of the record, need their own consent that can be combined only with another counseling notes consent, and a program may not condition treatment, payment, enrollment or eligibility on it (2.31(b)).⁴⁶⁴⁴ The definition mirrors HIPAA's psychotherapy notes and excludes medication monitoring, session times, treatment modalities, test results and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress. Finally, every disclosure made with written consent must be accompanied by a copy of the consent or a clear explanation of its scope (2.32(b)), plus a notice that Part 2 prohibits unauthorized use or redisclosure.⁴⁴⁷

Redisclosure after the 2024 rule

Under 42 CFR 2.33(b), a HIPAA covered entity or business associate that receives Part 2 records under a TPO consent may use and redisclose them as HIPAA permits, with one exception: the records still cannot be used or disclosed in proceedings against the patient without specific consent or a court order.⁴⁸⁴ That is the alignment Congress asked for. A hospital that receives an addiction treatment history under a TPO consent can now share it with a consulting specialist or bill for related care under HIPAA's TPO rules, rather than seeking a new Part 2 consent each time. Recipients that are not covered entities or business associates, and lawful holders who received records for other purposes, remain bound by Part 2's stricter redisclosure limits.

The rule also says that segregating or segmenting Part 2 records is not required, and lets Part 2 programs disclose de-identified records to public health authorities without consent, using HIPAA's de-identification standard.⁴ Not being required to segregate is not the same as being free to ignore which records came from a Part 2 program. Systems still need to know that a given document carries the proceedings protection and, for counseling notes, the separate consent requirement, so the request desk can stop it from going out in response to a subpoena.

Protection from use in proceedings against the patient

The protection that defines Part 2 survived the 2024 rule intact. Part 2 records, and testimony relaying their content, may not be used or disclosed in civil, criminal, administrative or legislative proceedings against the patient, or to investigate or prosecute the patient, without the patient's written consent or a court order issued under Part 2's subpart E procedures after notice and an opportunity to be heard.⁴⁴⁵ Section 2.12(d)(1) applies the restriction to anyone who obtains records from a Part 2 program, covered entity, business associate or other lawful holder, regardless of their status. A subpoena alone is never enough; a court order authorizing disclosure must be accompanied by a subpoena or other legal mandate compelling it, as the NPP language now tells patients.²⁴

The 2024 rule added a safe harbor for investigative agencies: an agency that acts with reasonable diligence to determine whether a provider is a Part 2 program before requesting records, which includes searching SAMHSA's online treatment facility locator and checking the provider's Part 2 patient notice or HIPAA NPP, has limited liability if it unknowingly receives Part 2 records without the required court order, and must then follow specified steps.⁴ For providers, the operational point is that the NPP and the facility locator listing are now part of how outsiders identify Part 2 programs, so both should be accurate.

Breach notice, penalties and OCR enforcement

Three changes make Part 2 look much more like HIPAA from an enforcement point of view:

• Breach notification. The HIPAA Breach Notification Rule's requirements now apply to breaches of Part 2 records by Part 2 programs: notice to affected patients, to the HHS Secretary and, in some cases, to the media, on HIPAA's timelines.⁴²⁶ The mechanics are in lesson 5.
• Penalties. Part 2's old criminal-only penalty provision was replaced with the civil and criminal enforcement authorities that apply to HIPAA violations under sections 1176 and 1177 of the Social Security Act (42 U.S.C. 1320d-5 and 1320d-6).⁴⁴² The civil money penalty amounts in effect in 2026 are the 2025 inflation-adjusted figures, because HHS cancelled the 2026 adjustment; lesson 8 has the table.⁴⁹
• Enforcer. On August 25, 2025, the HHS Secretary delegated authority to administer and enforce Part 2 to the Director of OCR (Federal Register notice August 27, 2025). Starting February 16, 2026, anyone may file a Part 2 complaint with OCR, and enforcement follows the HIPAA Enforcement Rule procedures in 45 CFR Part 160, subparts C, D and E.²⁶ Patients may file complaints with the Part 2 program and with HHS at the same time.⁴

Patients also gained HIPAA-style rights to request restrictions and to an accounting of disclosures. HHS said the compliance date for the Part 2 accounting right will be set when HIPAA's accounting provision is revised, and patients gained a right to opt out of fundraising communications.⁴

Part 2 and HIPAA side by side

Part 2 and Medicaid work requirement verification

Part 2 has a new and very practical application in 2026. Federal law now requires many Medicaid adults ages 19 to 64 to meet a community engagement requirement: 80 hours a month of work, community service or similar activity, or at least half-time enrollment in education, to keep coverage. Some people are excluded, including people who are medically frail or have other special medical needs, which can include some people with SUD, and people taking part in certain SUD treatment programs. States must verify exclusions using reliable information they already have, without asking the individual for more where possible.⁵⁰ The requirement comes from 42 U.S.C. 1396a(xx) and 42 CFR 435.557, and a CMS interim final rule (91 FR 33348, June 3, 2026) requires states to implement it by January 1, 2027.⁵¹ How the requirement works in Idaho, and what it means for Idaho enrollees, is covered in Idaho Medicaid, lesson 6: The 2027 Work Requirements, Step by Step.

The obvious source of proof that someone is in SUD treatment is the state Medicaid agency's own claims data, much of which came from Part 2 programs. On September 29, 2026, OCR issued FAQ guidance on when Part 2 lets a state Medicaid agency use those records to verify an exclusion.⁵⁰ The guidance describes three paths:⁵¹

1. An existing TPO consent. If the patient gave the Part 2 program a single consent for all future TPO, and the program disclosed records to the agency under it (for example, with a claim), the program had to send a copy of the consent or a clear explanation of its scope (2.33(a)(2) and 2.32(b)). The agency may then use the records for TPO, which includes verifying an exclusion, without new consent.
2. A specific-purpose consent obtained by the agency. The agency may get the patient's written consent to use Part 2 records it already holds for the specific purpose of deciding whether an exclusion applies.
3. A TPO consent obtained by the agency. The agency may get written consent to use the records it holds for all future TPO, which covers exclusion determinations.

For records the agency received under a narrower consent, such as a consent to disclose for payment purposes, the FAQ's examples have the agency obtain a new written consent rather than rely on the old one. Any consent the agency obtains must have all the 2.31(a) elements, including the right to revoke and an expiration date or event. And the proceedings protection follows the records into the eligibility system: they may not be used to bring or support criminal charges against the patient, to investigate the patient criminally, or in civil, criminal, administrative or legislative proceedings against the patient (2.12(d)(1)), including records a patient obtains and hands over directly (2.23(b)); a separate consent is needed for any such use (2.31(d)).⁵¹ OCR Director Paula M. Stannard said the guidance "helps ensure that state Medicaid agencies comply with Part 2."⁵⁰

For state agencies and their vendors, the operational questions are which records in the eligibility and claims systems came from Part 2 programs, under which consent, and whether the consent's scope is recorded somewhere the verification logic can read. For Part 2 programs, the question is whether they collected TPO consents from Medicaid patients after the 2024 rule, and whether the consent copies or scope statements actually went with the claims. For advocates, the question is whether people who qualify for an SUD-related exclusion are losing coverage because the state could not use, or did not try to use, the records it already had.

A Part 2 operations checklist

1. Decide, in writing, whether your organization or any unit of it is a Part 2 program, using the three-prong definition in 2.11 and the federal assistance test in 2.12(b). Record the decision and the reasons.
2. If you are a Part 2 program, confirm that your patient notice follows the HHS model Part 2 patient notice and that your HIPAA NPP, if you are also a covered entity, includes the 164.520(b)(1)(iii)(D) and (E) statements.
3. Adopt a consent form with every 2.31(a) element, including the TPO options, and separate forms for SUD counseling notes and for proceedings.
4. Configure systems to send a copy of the consent or a scope statement, plus the 2.32 notice, with every disclosure made under consent.
5. Mark records that came from a Part 2 program, whether you are the program or a recipient, so the request desk knows the proceedings protection applies. Segregation is not required; recognition is.
6. Route every subpoena, warrant and agency request touching those records to the privacy officer, and release them in proceedings against the patient only with specific consent or a Part 2 court order.
7. Update vendor contracts so that business associates and QSOs serving the program carry both HIPAA and Part 2 obligations.
8. Fold Part 2 records into the HIPAA breach process, including the four-factor risk assessment and the 60-day outer limit.
9. Train staff on the differences that remain: proceedings, counseling notes, redisclosure by non-HIPAA recipients and the consent copy.

Common mistakes, from OCR's cases

• No access policy and no clock. In the Azul Vision case, a patient waited about two years for records; in Shen Smiles, OCR found no right of access policies at all, and the practice paid $140,000 after OCR had proposed a civil money penalty. Azul Vision's corrective action plan requires a log of every request with the date received and the date completed.³²³
• Talking to the press. Saint Joseph's Medical Center ($80,000, 2023) and New York-Presbyterian ($2.2 million, 2016) disclosed patient information to news organizations without authorization. There is no media permission in the Privacy Rule.¹⁵¹⁶
• Sending the whole chart. Holy Redeemer Family Medicine sent a prospective employer records including reproductive health information without a valid authorization.²³ Requests from employers, insurers and lawyers need an authorization and a release limited to what it covers.
• Roles too broad, logs unread. Security guards at Yakima Valley Memorial Hospital viewed 419 patients' records; an insider at Montefiore Medical Center stole patient information. Narrow roles and audit review are the controls.²⁰¹⁶
• Answering online reviews with patient details. OCR's list includes several dental and medical practices that disclosed PHI while responding to patients' online reviews, including a 2019 settlement with a dental practice over social media disclosures and a 2023 action against a New Jersey provider over responses to online reviews.¹⁶ Confirming that someone is a patient is itself a disclosure.
• Treating the NPP as a one-time document. The February 16, 2026 Part 2 changes required revised notices for many providers and plans. Organizations that never revisited a notice written in 2013 may be out of date.⁵
• Losing the self-pay restriction in the billing system. A restriction recorded in the EHR does nothing if the practice management system sends the claim anyway.³⁶
• No accounting log. Public health reports, subpoena responses and law enforcement disclosures that are not logged cannot be produced when a patient asks for an accounting.³⁴

Questions people ask

Can we email records to a patient who asks for them by unencrypted email?

The access right requires providing copies in the form and format requested if readily producible (164.524(c)(2)).²⁷ OCR's FAQ says a covered entity that sends PHI by unencrypted email at the individual's request is not responsible for unauthorized access while the message is in transit, assuming the individual was warned of and accepted the risks. The covered entity must still use reasonable care, such as entering the correct address.⁵² Your security policy should describe how the warning is given and recorded.

Does a patient have to sign anything for us to send records to another doctor?

Not under HIPAA. Disclosures to another provider for that provider's treatment of the patient are permitted under 164.506(c)(2) and exempt from minimum necessary.¹⁰ State law may be stricter for some kinds of records, and Part 2 records need a Part 2 consent (which can now be a single TPO consent).⁴⁶

Can a parent see a teenager's records?

Usually, because the parent is usually the personal representative. But not when the minor lawfully consented to the care and no other consent is required, when a court or other law lets the minor or someone else consent, or when the parent agreed to confidentiality between the minor and the provider. State law on parental access governs those cases.¹³⁷ Health care for minors, including SUD care under Part 2's minor consent rule at 42 CFR 2.14, is an area where staff need a clear written procedure.

What do we do when police show up asking about a patient?

Route the request to the person on duty who handles law enforcement requests, verify identity and authority, and identify which part of 164.512(f) applies: legal process, identification of a suspect (limited to listed data elements), a crime victim, a death, a crime on the premises, or an emergency.¹⁴ If the patient may be a Part 2 patient, stop: Part 2 records need a Part 2 court order for law enforcement use. Log the disclosure for the accounting.

Is our cloud EHR or AI transcription vendor allowed to see our records?

Yes, as a business associate performing a function for you, under a business associate agreement, and subject to minimum necessary. A vendor that uses PHI for its own purposes, such as training products for other customers, needs a specific permission for that, which a standard agreement may not give. Lesson 6 covers vendor contracts in detail.

Do we have to honor a request not to tell the insurer?

Only in one case: when the patient (or someone other than the health plan) pays in full out of pocket for the specific item or service, and the disclosure is for payment or operations and not required by law. Then you must agree (164.522(a)(1)(vi)). Other restriction requests you may refuse, but if you agree, you are bound.³⁶

Who can file a complaint, and where?

Anyone can file a HIPAA complaint with OCR, and since February 16, 2026 anyone can file a Part 2 complaint with OCR as well.²⁶ Patients can also complain to the covered entity's privacy contact, and the entity may not retaliate (164.530(d) and (g)).²¹ OCR reported 30,256 new HIPAA complaints in calendar year 2024.⁵³

Hard questions

Should the access deadline be shorter than 30 days?

For a shorter deadline: most records are electronic, patient portals already release many results in near real time, and the 21st Century Cures Act's information blocking rules treat unnecessary delay as a problem in its own right. Patients switching doctors, appealing denials or managing chronic conditions need records quickly, and OCR's Right of Access cases show some entities stretching 30 days into years. For keeping 30 days: small practices with paper archives, multiple systems and one part-time records clerk say 15 days is not realistic for complete records, especially when imaging and outside records are involved, and that a shorter clock will mostly produce more violations rather than faster access. What the evidence shows: HHS proposed 15 days in 2021, and the final rule has been at OIRA since April 2, 2026.³⁸⁶ HHS's agenda also lists a separate timely access proposal for November 2026, which one law firm reads as a sign that HHS may not finalize the 15-day change and may ask for comment on a different approach.³⁹ OCR's enforcement record shows the problem is less often days 16 to 30 than requests ignored for months; the Right of Access cases, 56 as of October 8, 2026, typically involve delays far beyond the current deadline, such as the nearly two years in Azul Vision.³³²

Did aligning Part 2 with HIPAA go too far, or not far enough?

For the 2024 alignment: hospitals, health plans and many clinicians argued that separate consent rules kept addiction histories out of the records clinicians use, contributing to dangerous prescribing and fragmented care, and that a single TPO consent and HIPAA-style redisclosure let SUD care be treated like other medical care. Against it, or for going slower: many patient advocates and some treatment providers worried that wider sharing increases the chance that records reach employers, child welfare agencies or courts, and that fear of exposure keeps people from treatment. What the evidence shows: the rule kept the strongest protection (no use in proceedings against the patient without consent or a court order) and still requires patient consent for TPO, so it did not erase the difference with HIPAA.⁴ The compliance date was February 16, 2026, and published data on how patients are responding to TPO consents, or on whether the proceedings protection is holding up in practice, was not available as of October 2026.

Should states use SUD treatment records to verify Medicaid work requirement exclusions?

For using them: the law tells states to use information they already have, and using claims data protects people from losing coverage because they did not send paperwork. Requiring patients in SUD treatment to prove their treatment again would be a barrier for exactly the people the exclusion is meant to protect. Against, or for caution: SUD records are among the most sensitive health records a state holds, and using them for eligibility decisions widens the set of systems and workers that touch them. Some patients would prefer not to have their treatment status used at all. What the evidence shows: OCR's September 29, 2026 guidance allows use only under an existing TPO consent or a new consent the agency obtains, and keeps the proceedings protection in place, so a state cannot use the records without consent.⁵¹ How many states will collect the consents they need before January 1, 2027, and whether exclusions are applied accurately, is not yet known.

Should minimum necessary apply to care coordination?

For an exception: case managers and care coordinators, including community organizations helping with housing or food, say they waste time negotiating over what they may see, and that an exception would help patients with complex needs. HHS proposed one in 2021. Against: privacy advocates say "care coordination" is broad enough to cover almost any use, and that an exception would remove the main limit on how much data flows to plans, vendors and social service partners. What the evidence shows: the proposal is part of the final rule pending at OIRA; until it is published, minimum necessary applies to these uses except where they are treatment disclosures between providers.³⁸⁶

Where to go next

• HHS model Notices of Privacy Practices and model Part 2 patient notice: Free HHS templates, updated for the February 16, 2026 Part 2 changes, for providers, health plans and Part 2 programs. Adapt with your own contact information and practices, then compare with your current notice line by line.
• HHS guidance: Individuals' right of access (FAQs on fees, format, third-party directives): Free OCR FAQs for release-of-information staff and privacy officers; read them with the Ciox Health note, and use them to check your fee schedule and request log.
• HHS Minimum Necessary Requirement guidance: Free, short OCR guidance for practice managers and EHR administrators building role-based access; pair it with your role matrix.
• HHS Fact Sheet: 42 CFR Part 2 Final Rule: Free two-page HHS summary of every 2024 Part 2 change, for SUD programs, hospitals, health plans and vendors; a good checklist starting point.
• SAMHSA FindTreatment.gov: Free federal locator of SUD treatment facilities. Programs should confirm their listing is accurate, because investigative agencies use it to decide whether Part 2 applies.
• OCR Resolution Agreements and Civil Money Penalties: Free public list of OCR settlements and penalties with the full resolution agreements and corrective action plans; read the plans to see what OCR expects a privacy program to contain.
• Office of Information and Regulatory Affairs: regulatory review search: Free White House site showing the status of the pending HIPAA Privacy Rule final rule; check it before rewriting access policies or notices.

Still being checked (7 items)

These points could not be fully confirmed against a primary source when this lesson was written and fact checked in October 2026. The text above states each one as uncertain.

• The HHS access guidance main page (hhs.gov/hipaa/for-professionals/privacy/guidance/access) would not load on Oct. 28, 2026; fee and email points were confirmed instead from OCR FAQs 2030, 2033 and 2061.
• OIRA shows the Privacy Rule final rule (RIN 0945-AA00) received April 2, 2026; a law firm review gives April 4, 2026. Its contents are not public and may differ from the 2021 proposal.
• The November 2026 projection for a separate timely access proposed rule (RIN 0945-AA28) comes from a law firm review of HHS's regulatory agenda, not from an HHS document read for this lesson.
• Whether HHS will formally remove the vacated reproductive health rule text, including 45 CFR 164.509, which the eCFR still prints as of Oct. 23, 2026.
• The September 2026 OCR FAQ document does not carry its own date on its face; the date comes from the HHS press release of Sept. 29, 2026.
• No published data were found on how many patients have signed Part 2 TPO consents since February 16, 2026, or on how states will apply SUD-related Medicaid exclusions.
• The Shen Smiles press release (Oct. 8, 2026) does not describe a corrective action plan; whether the Aug. 11, 2026 resolution agreement includes one was not checked.

Last verified October 28, 2026. General education, not legal, compliance or medical advice; rule versions and dates are stated in the text, and the sources used are listed in the Notes and Sources below. Check the regulator's current text before relying on any point.

Notes

1. 45 CFR 164.502, "Uses and disclosures of protected health information: General rules," including (a) permitted and required disclosures, (b) minimum necessary and its exceptions, and (g) personal representatives; as amended through 89 FR 32976 (Apr. 26, 2024), with the reproductive health provisions vacated in Purl v. HHS (June 18, 2025). Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
2. 45 CFR 164.514, "Other requirements relating to uses and disclosures of protected health information," including (d) minimum necessary implementation specifications, (e) limited data sets and (h) verification. Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
3. HHS Office for Civil Rights, "HHS' Office for Civil Rights Settles HIPAA Privacy Rule Investigation with Dr. Linda L. Shen d/b/a Shen Smiles, P.C.," subtitled "Settlement Marks OCR's 56th HIPAA Right of Access Enforcement Action," press release, Oct. 8, 2026 ($140,000; settlement dated Aug. 11, 2026) (read Oct. 28, 2026). Read it online. ↩
4. HHS, "Fact Sheet 42 CFR Part 2 Final Rule," Feb. 8, 2024, updated Jan. 30, 2026: single TPO consent, redisclosure by covered entities and business associates, proceedings protections, SUD counseling notes, breach notification, penalties, safe harbor, segregation not required, complaints (read Oct. 28, 2026). Read it online. ↩
5. HHS, "HIPAA Privacy Rule Final Rule to Support Reproductive Health Care Privacy" page, with notice of the June 18, 2025 order in Carmen Purl, et al. v. HHS, No. 2:24-cv-00228-Z (N.D. Tex.) vacating most of the rule and, among the NPP changes, only 45 CFR 164.520(b)(1)(ii)(F), (G) and (H); remaining NPP changes required by Feb. 16, 2026; content last reviewed June 27, 2025 (read Oct. 28, 2026). Read it online. ↩
6. Office of Information and Regulatory Affairs, EO 12866 review record for "HIPAA Privacy Rule: Changes to Support Coordinated Care and Individual Engagement and Reduce Regulatory Burdens," RIN 0945-AA00, received Apr. 2, 2026, status pending (read Oct. 28, 2026). Read it online. ↩
7. 45 CFR 160.103, definitions of "disclosure," "use," "workforce," "protected health information" and related terms. Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
8. 45 CFR 164.501, definitions of "designated record set," "treatment," "payment," "health care operations," "marketing" and "psychotherapy notes." Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
9. 45 CFR 164.508, "Uses and disclosures for which an authorization is required": (a)(2) psychotherapy notes, (a)(3) marketing, (a)(4) sale of PHI, (b) defective, compound and conditioned authorizations and revocation, (c) core elements and required statements. Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
10. 45 CFR 164.506, "Uses and disclosures to carry out treatment, payment, or health care operations," including (b) optional consent and (c)(1) to (5) permitted TPO disclosures. Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
11. 45 CFR 160.203, "General rule and exceptions" (preemption of contrary state law, with the exception for more stringent state privacy law). Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
12. 45 CFR 164.510, "Uses and disclosures requiring an opportunity for the individual to agree or to object": (a) facility directories and (b) involvement in care and notification, including disclosures about deceased individuals. Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
13. HHS Office for Civil Rights, "Summary of the HIPAA Privacy Rule" (12 national priority purposes; incidental uses; role-based access; administrative requirements), content last reviewed Mar. 14, 2025 (read Oct. 28, 2026). Read it online. ↩
14. 45 CFR 164.512, "Uses and disclosures for which an authorization or opportunity to agree or object is not required," paragraphs (a) to (l). The 2024 amendments to this section from 89 FR 32976 were among the provisions vacated in Purl v. HHS (June 18, 2025). Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
15. HHS Office for Civil Rights, "HHS Office for Civil Rights Settles HIPAA Investigation with St. Joseph's Medical Center Over Disclosure of Patients' Protected Health Information to a News Reporter," press release, Nov. 20, 2023 ($80,000; two-year monitoring) (read Oct. 28, 2026). Read it online. ↩
16. HHS Office for Civil Rights, "Resolution Agreements and Civil Money Penalties" list, including New York Presbyterian Hospital ($2.2 million, Apr. 21, 2016), Montefiore Medical Center ($4.75 million, Feb. 6, 2024), Gums Dental Care ($70,000, Oct. 17, 2024), a mental health center ($100,000, Nov. 19, 2024), Oregon Health and Science University ($200,000, Mar. 6, 2025), a dental practice social media case (Oct. 2, 2019) and a New Jersey online reviews case (June 5, 2023) (read Oct. 28, 2026). Read it online. ↩
17. HHS Office for Civil Rights, "Minimum Necessary Requirement" guidance (45 CFR 164.502(b) and 164.514(d)), content last reviewed July 26, 2013 (read Oct. 28, 2026). Read it online. ↩
18. 45 CFR 164.308, "Administrative safeguards," including (a)(1)(ii)(C) sanction policy, (a)(1)(ii)(D) information system activity review, (a)(2) assigned security responsibility, (a)(3) workforce security and (a)(4) information access management; Security Rule as amended by the 2013 Omnibus Rule. Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
19. 45 CFR 164.312, "Technical safeguards," including (a)(1) access control with unique user identification, emergency access procedure, automatic logoff and encryption, and (b) audit controls. Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
20. HHS Office for Civil Rights, resolution agreement page for Yakima Valley Memorial Hospital ($240,000, June 15, 2023; security guards impermissibly accessed the records of 419 individuals) (read Oct. 28, 2026). Read it online. ↩
21. 45 CFR 164.530, "Administrative requirements": (a) personnel designations, (b) training, (c) safeguards, (d) complaints, (e) sanctions, (f) mitigation, (g) retaliation, (h) waiver, (i) policies and procedures, (j) documentation. Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
22. HHS Office for Civil Rights, "Incidental Uses and Disclosures" guidance, content last reviewed July 26, 2013 (read Oct. 28, 2026). Read it online. ↩
23. HHS Office for Civil Rights, Resolution Agreement and Corrective Action Plan with Holy Redeemer Family Medicine (effective Sept. 24, 2024; announced Nov. 26, 2024; $35,581; two-year CAP with policy revision, annual training and reporting of Reportable Events) (read Oct. 28, 2026). Read it online. ↩
24. 45 CFR 164.520, "Notice of privacy practices for protected health information," 65 FR 82802 (Dec. 28, 2000), as amended at 67 FR 53271 (Aug. 14, 2002), 78 FR 5701 (Jan. 25, 2013) and 89 FR 33064 (Apr. 26, 2024); paragraphs (b)(1)(ii)(F) to (H) vacated June 18, 2025. Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
25. HHS, "HIPAA Privacy Rule To Support Reproductive Health Care Privacy," final rule, 89 FR 32976 (Apr. 26, 2024), govinfo.gov (read Oct. 28, 2026). Read it online. ↩
26. HHS Office for Civil Rights, "42 CFR Part 2" page: delegation of Part 2 enforcement to the OCR Director on Aug. 25, 2025 (FR notice Aug. 27, 2025), complaints to OCR from Feb. 16, 2026, breach reporting, model Part 2 patient notice and updated model HIPAA NPP; last reviewed Sept. 29, 2026 (read Oct. 28, 2026). Read it online. ↩
27. 45 CFR 164.524, "Access of individuals to protected health information": (a) grounds for denial, (b) timely action and the one 30-day extension, (c) form, format, third-party directives and fees, (d) denials. Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
28. HHS Office for Civil Rights, FAQ 2030, "Is $6.50 the maximum amount that can be charged to provide individuals with a copy of their PHI?" (flat fee option for electronic copies of electronic PHI, not a cap), with the Ciox Health note (read Oct. 28, 2026). Read it online. ↩
29. HHS Office for Civil Rights, FAQ 2033, "When do the HIPAA Privacy Rule limitations on fees apply?" with note that the guidance applies only to the extent consistent with Ciox Health, LLC v. Azar, No. 18-cv-0040 (D.D.C. Jan. 23, 2020) (read Oct. 28, 2026). Read it online. ↩
30. CMS, CDC and OCR, "CLIA Program and HIPAA Privacy Rule; Patients' Access to Test Reports," final rule, 79 FR 7289 (Feb. 6, 2014), govinfo.gov (read Oct. 28, 2026). Read it online. ↩
31. ONC (now ASTP), "21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program," final rule, 85 FR 25642 (May 1, 2020), establishing 45 CFR Part 171 (read Oct. 28, 2026). Read it online. ↩
32. HHS Office for Civil Rights, "HHS OCR Settles HIPAA Investigation with Azul Vision," press release, Aug. 27, 2026 ($50,000; "marks the 55th enforcement action" in the Right of Access Initiative; two-year CAP) (read Oct. 28, 2026). Read it online. ↩
33. 45 CFR 164.526, "Amendment of protected health information" (60 days, one 30-day extension, denial grounds, statements of disagreement). Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
34. 45 CFR 164.528, "Accounting of disclosures of protected health information" (six-year period, exclusions, content, 60 days plus one 30-day extension, first accounting in 12 months free, suspension for oversight and law enforcement). Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
35. HHS Office for Civil Rights, "HIPAA Privacy Rule Accounting of Disclosures Under the Health Information Technology for Economic and Clinical Health Act," proposed rule, Federal Register, May 31, 2011, FR Doc. 2011-13297 (never finalized) (read Oct. 28, 2026). Read it online. ↩
36. 45 CFR 164.522, "Rights to request privacy protection for protected health information": (a) restrictions, including the required self-pay restriction at (a)(1)(vi), and (b) confidential communications. Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
37. HHS Office for Civil Rights, "Personal Representatives" guidance, content last reviewed Jan. 5, 2024 (read Oct. 28, 2026). Read it online. ↩
38. HHS, "Proposed Modifications to the HIPAA Privacy Rule To Support, and Remove Barriers to, Coordinated Care and Individual Engagement," proposed rule, 86 FR 6446 (Jan. 21, 2021), RIN 0945-AA00, comments due Mar. 22, 2021, govinfo.gov (read Oct. 28, 2026). Read it online. ↩
39. Adam H. Greene, Rebecca L. Williams and Apurva Dharia, "HHS Updates Rulemaking Timeframes," Davis Wright Tremaine Privacy and Security Law Blog, July 8, 2026 (RIN 0945-AA28 timely access proposed rule projected for November 2026) (read Oct. 28, 2026). Read it online. ↩
40. Nelson Mullins, "Appeals Dropped of Decision Vacating HIPAA Reproductive Health Privacy Rule, Confirming Apparent End of the Rule and Attestation Requirement," Health Law Diagnosis, September 2025 (read Oct. 28, 2026). Read it online. ↩
41. eCFR, 45 CFR 164.509 (attestation requirement), Title 45 current as of Oct. 23, 2026, printed without an editorial note on the Purl vacatur (read Oct. 28, 2026). Read it online. ↩
42. 42 U.S.C. 290dd-2, "Confidentiality of records," as amended by section 3221 of the CARES Act, Pub. L. 116-136 (Mar. 27, 2020), including subsection (f) on penalties under sections 1176 and 1177 of the Social Security Act. Cornell LII (read Oct. 28, 2026). Read it online. ↩
43. HHS, "Confidentiality of Substance Use Disorder (SUD) Patient Records," final rule, 89 FR 12472 (Feb. 16, 2024), RIN 0945-AA16, effective Apr. 16, 2024, compliance date Feb. 16, 2026 (read Oct. 28, 2026). Read it online. ↩
44. 42 CFR 2.11, "Definitions," including "Part 2 program," "program," "records," "lawful holder," "qualified service organization" and "SUD counseling notes," as revised by 89 FR 12472 (Feb. 16, 2024). Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
45. 42 CFR 2.12, "Applicability": (b) federally assisted, (c)(1) VA exclusion, (d) restrictions on use and disclosure, (e) explanation of applicability, as revised by 89 FR 12472. Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
46. 42 CFR 2.31, "Consent requirements": (a) required elements including TPO consent language, (b) SUD counseling notes, (c) invalid consents, (d) consent for proceedings, as revised by 89 FR 12472. Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
47. 42 CFR 2.32, "Notice and copy of consent to accompany disclosure," as revised by 89 FR 12472. Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
48. 42 CFR 2.33, "Uses and disclosures permitted with written consent," including (b) redisclosure by covered entities and business associates that receive records under a TPO consent, as revised by 89 FR 12472. Cornell LII text of the current eCFR (read Oct. 28, 2026). Read it online. ↩
49. HHS, "Annual Civil Monetary Penalties Inflation Adjustment," final rule, 91 FR 3665 (Jan. 28, 2026), setting the 2025 amounts; and HHS notice at 91 FR 66566 (Oct. 21, 2026) that it will continue to use the 2025 levels because the 2026 adjustment was cancelled (read Oct. 28, 2026). Read it online. ↩
50. HHS, "HHS OCR Clarifies Privacy Rules for State Medicaid Programs," press release, Sept. 29, 2026 (Part 2 and Medicaid community engagement verification; quote from OCR Director Paula M. Stannard) (read Oct. 28, 2026). Read it online. ↩
51. HHS Office for Civil Rights, FAQ on when 42 CFR Part 2 permits a state Medicaid agency to use Part 2 records to verify an exclusion from the community engagement requirement, September 2026, citing 42 U.S.C. 1396a(xx)(5), 42 CFR 435.557, the CMS interim final rule at 91 FR 33348 (June 3, 2026), and 42 CFR 2.12(d)(1), 2.23(b), 2.31, 2.32 and 2.33(a)(2) (read Oct. 28, 2026). Read it online. ↩
52. HHS Office for Civil Rights, FAQ 2061, "Is a covered entity responsible if it complies with an individual's access request to receive PHI in an unsecure manner?" (no, if the individual was warned of and accepted the risks; reasonable care still required), with the Ciox Health note (read Oct. 28, 2026). Read it online. ↩
53. HHS Office for Civil Rights, Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance for Calendar Year 2024 (30,256 new complaints) (read Oct. 28, 2026). Read it online. ↩
54. HHS Office for Civil Rights, Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information (breaches affecting 500 or more individuals) (read Oct. 28, 2026). Read it online. ↩