Health Privacy: HIPAA and Beyond

Most people assume their health information is protected by "HIPAA" wherever it goes. The law is narrower than that. It follows the organization, not the data: the same blood pressure reading is protected health information in a cardiologist's chart and unregulated by HIPAA in a phone app the patient downloaded. Course 73's Federal Laws That Reach Your Business covers HIPAA's notice table and the Security Rule from a compliance manager's seat. This lesson takes the patient's and the public's view: what the rules require, what rights you have, how the rules are enforced, what changed from 2024 to 2026, and where the gaps are.

Who HIPAA covers

The Health Insurance Portability and Accountability Act of 1996 directed HHS to write privacy and security standards. They live in 45 CFR Parts 160 and 164 and are known as the Privacy Rule, the Security Rule and the Breach Notification Rule. The 2009 HITECH Act, part of Public Law 111-5, added breach notice, made business associates directly liable, raised penalties and let state attorneys general sue.

HIPAA reaches three kinds of covered entity: health plans (insurers, HMOs, company health plans, Medicare, Medicaid, military and veterans programs), health care clearinghouses that convert billing data between formats, and health care providers that transmit health information electronically in connection with a standard transaction such as a claim. A provider that takes only cash and never bills electronically is outside the rule, though few practices work that way. Then come business associates: a person or company that, other than as a workforce member, creates, receives, maintains or transmits PHI for a covered entity, such as a billing service, a cloud host, an IT contractor with access to records, a shredding company or a law or accounting firm working with PHI. Business associates must sign a contract with the covered entity and follow the Security Rule directly.

Holder of health information	Bound by HIPAA?	What applies instead or as well
Doctor, hospital, pharmacy, dentist, therapist that bills insurance electronically	Yes, covered entity	State medical records and licensing laws too
Health insurer, HMO, Medicare, Medicaid, employer group health plan	Yes, health plan	ERISA and state insurance laws
Billing company, cloud vendor, IT contractor handling PHI for a covered entity	Yes, business associate	The business associate agreement
Health or fitness app you download yourself, a wearable maker	No	FTC Health Breach Notification Rule, FTC Section 5, state health data and consumer privacy laws
Employer holding sick notes or drug test results in personnel files	No, employment records are excluded from PHI	ADA and GINA confidentiality rules, state law
Life, disability or auto insurer	No, these are not health plans under HIPAA	State insurance privacy laws, FCRA for medical information in consumer reports
School nurse records	No, education records under FERPA are excluded from PHI	FERPA (lesson 05)
Direct-to-consumer DNA testing company	No	FTC Act, state genetic privacy laws, state consumer privacy laws

The exclusions for employment records and FERPA education records are written into the definition of PHI at 160.103. The definition of health information does list employers, life insurers and schools among those who can create it, which is why a few of their activities, such as running a group health plan, do fall under HIPAA. The test always comes back to role.

The Privacy Rule: what a covered entity may do with your information

The core of the Privacy Rule is that a covered entity may use or disclose PHI only as the rule permits or requires. 45 CFR 164.502(a) lists the permissions: to the patient; for treatment, payment and health care operations; incident to a permitted use; with the patient's written authorization; in situations where the patient has a chance to agree or object, such as hospital directories and family members involved in care; and for the public interest purposes in 164.512. Disclosure is required only to the patient (through the access and accounting rights) and to HHS for enforcement.

The public interest permissions are wide, and they are the ones people are surprised by. Section 164.512 allows disclosures required by law; for public health activities; about victims of abuse, neglect or domestic violence; for health oversight; for court and administrative proceedings; for law enforcement purposes; about decedents; for organ donation; for research; to avert a serious threat to health or safety; for specialized government functions such as military and national security; and for workers' compensation. Each has conditions. For law enforcement, a covered entity may disclose under a court order or court-ordered warrant, a judicial subpoena, a grand jury subpoena, or an administrative request only if the information is relevant and material to a legitimate inquiry, the request is specific and limited, and de-identified information could not reasonably be used.

Minimum necessary

For most uses and disclosures, a covered entity must limit PHI to the minimum reasonably necessary for the purpose. That means identifying which staff need access to which categories of information, using standard protocols for routine disclosures, reviewing other requests one by one, and never using or handing over an entire medical record unless the whole record is specifically justified (164.514(d)). The standard does not apply to disclosures to a provider for treatment, to the patient, under the patient's authorization, to HHS, when required by law, or for compliance with the rules (164.502(b)(2)). The treatment exception is deliberate: a doctor treating you should see whatever the referring doctor thinks matters.

Other Privacy Rule protections

• Genetic information: health plans, except certain long-term care insurers, may not use or disclose genetic information for underwriting, such as setting premiums or eligibility (164.502(a)(5)(i)). This carries GINA's insurance rules into HIPAA.
• Deceased patients: PHI stays protected for 50 years after death (164.502(f)).
• Personal representatives: a parent is usually the representative of a minor child, but not when the minor may lawfully consent to the care, and state law governs what parents may see (164.502(g)).
• Psychotherapy notes: a therapist's separate notes analyzing a session get extra protection; most uses need specific authorization, and they are excluded from the patient's own access right.

Your right of access

45 CFR 164.524 gives you a right to inspect and get a copy of your PHI in a designated record set, which includes your medical and billing records. The covered entity must act within 30 days of receiving the request. It may take one extension of up to 30 more days only by giving you, within the first 30 days, a written statement of the reasons and the date it will finish. It must provide the copy in the form and format you ask for if readily producible, including electronic copies of electronic records, and must send it to a third party you designate in a signed written request. Fees are limited to a reasonable, cost-based charge for copying labor, supplies, postage and any summary you agreed to.

Some denials cannot be reviewed: psychotherapy notes, information compiled for legal proceedings, certain inmate requests, research records during a study you agreed to, records covered by the Privacy Act where that law allows denial, and information from a non-provider given under a promise of confidentiality. Others can be reviewed by a different licensed professional: when access is reasonably likely to endanger the life or physical safety of you or someone else, or to cause substantial harm to another person named in the record. A denial must be in writing, in plain language, with the reason, any review rights and how to complain to HHS.

OCR enforces the access right through its Right of Access Initiative. Two recent examples from the OCR enforcement index: on March 6, 2025, OCR imposed a $200,000 civil money penalty on Oregon Health and Science University for failing to provide timely access to patient records, and in August 2026 OCR announced a $50,000 settlement with Azul Vision, where a patient asked for her records on January 9, 2023, complained to OCR in April 2023, and did not get them until January 6, 2025.

The Security Rule and the Breach Notification Rule

The Security Rule requires covered entities and business associates to protect electronic PHI with administrative, physical and technical safeguards, starting with an accurate and thorough risk analysis. Its proposed overhaul is covered below.

The Breach Notification Rule, added under HITECH, applies to breaches of unsecured PHI, meaning PHI not encrypted or destroyed to the standards in HHS guidance. Under 164.402, an impermissible use or disclosure is presumed to be a breach unless the organization documents a low probability of compromise using at least four factors (lesson 01). The notices, as HHS's Breach Notification Rule page sets them out:

Who is told	When	How and what
Each affected person	Without unreasonable delay, no later than 60 days after discovery	First-class mail, or email if the person agreed. A description of what happened, the types of information, steps people should take, what the entity is doing, and contact information
Substitute notice when contact information is missing for 10 or more	Same	Website home page notice for at least 90 days or major print or broadcast media, plus a toll-free number active for at least 90 days
Prominent media in a state	Same 60-day limit	When more than 500 residents of that state or jurisdiction are affected
HHS	Within 60 days for 500 or more people; for fewer than 500, within 60 days after the end of the calendar year	HHS breach report form. Reports of 500 or more are posted publicly on the HHS breach portal
The covered entity, from a business associate	Without unreasonable delay, no later than 60 days after discovery	Identifying each affected person where possible

The 60 days is an outer limit, not a safe harbor: notice must go out without unreasonable delay, and HHS has treated sitting on a known breach as a violation. Both covered entities and business associates bear the burden of showing that notices went out or were not required.

Penalties and who enforces

HHS's Office for Civil Rights (OCR) enforces the HIPAA rules. Under 42 U.S.C. 1320d-5(a), civil money penalties rise with culpability across four tiers: the violator did not know and with reasonable diligence would not have known; the violation was due to reasonable cause and not willful neglect; willful neglect corrected within 30 days; and willful neglect not corrected. The statute sets base amounts, and HHS adjusts them for inflation each year in 45 CFR 102.3.

Tier	Statute's base amounts	Current adjusted range per violation (2025 adjustment, in force as of October 2026)	Calendar-year cap for identical violations
1. Did not know	$100 minimum	$145 to $73,011	$2,190,294
2. Reasonable cause	$1,000 minimum	$1,461 to $73,011	$2,190,294
3. Willful neglect, corrected in 30 days	$10,000 minimum	$14,602 to $73,011	$2,190,294
4. Willful neglect, not corrected	$50,000 minimum	$73,011 to $2,190,294	$2,190,294

The caps in the table are the regulation's. In a Notification of Enforcement Discretion published April 30, 2019 (84 FR 18151), HHS said it would apply lower annual caps for the first three tiers until further notice: $25,000 for no knowledge, $100,000 for reasonable cause and $250,000 for willful neglect corrected, with $1.5 million kept for willful neglect not corrected, all before inflation adjustment. The notice said HHS expected to revise the tiers by rulemaking.

Most OCR cases end in a resolution agreement: a settlement payment and a corrective action plan, usually two years of monitored fixes, with no admission of liability. Civil money penalties are imposed when an entity will not settle. Criminal penalties for knowingly obtaining or disclosing health information in violation of HIPAA are prosecuted by the Justice Department under a separate provision.

State attorneys general

HITECH added 1320d-5(d): a state attorney general who believes residents have been threatened or harmed by a HIPAA violation may sue in federal court for an injunction or for damages of up to $100 per violation, capped at $25,000 for all violations of an identical requirement in a calendar year, plus costs and attorney fees at the court's discretion. The state must give HHS prior written notice and a copy of the complaint where feasible, and may not sue over a violation while HHS has its own action pending on it. A state can also bring claims under its own consumer protection and breach laws, which have their own penalties.

Enforcement cases

Entity	Year	Amount	What happened
Anthem	2018	$16 million	A series of cyberattacks exposed electronic PHI of almost 79 million people; OCR called it a record settlement
Premera Blue Cross	2020	$6.85 million	Breach affecting more than 10.4 million people; OCR said it was the second-largest HIPAA payment to that date
Oregon Health and Science University	2025	$200,000 civil money penalty	Failure to provide timely access to patient records
OSF HealthCare System	2026	$552,250 and a two-year corrective plan	Nephilim ransomware found April 23, 2021; PHI of 53,907 patients stolen; OCR found no accurate risk analysis and late notice to patients and HHS
Comstar, LLC (ambulance billing business associate)	2025	$75,000	Ransomware in March 2022 affecting 585,621 people; no accurate risk analysis (announced May 30, 2025)
Ambry Genetics	2026	$700,000	Resolution agreement after a phishing attack that exposed about 225,000 patients' health data, per OCR's index headline, announced September 17, 2026
Azul Vision	2026	$50,000	Took about two years to answer a patient's records request

The pattern in recent cases is consistent: ransomware or phishing gets in, and OCR's finding is that the organization never did an accurate, thorough risk analysis. Of the 25 most recent actions on OCR's index as of October 2026, six were flagged as ransomware cases.

Change Healthcare: the largest health data breach

Change Healthcare, a UnitedHealth Group company that processes health care claims and payments, was hit by ransomware in early 2024; OCR issued a Dear Colleague letter about the attack in March 2024. OCR's Change Healthcare FAQ tracks the count as reported to OCR:

• July 19, 2024: Change Healthcare filed its breach report with a placeholder of about 500 individuals while it worked out the number.
• October 22, 2024: about 100 million individual notices sent.
• January 24, 2025: about 190 million people affected.
• July 31, 2025: about 192.7 million people affected.

Because Change Healthcare was a business associate to thousands of providers and plans, OCR addressed who had to notify: covered entities remain responsible, may delegate notice to Change Healthcare or UnitedHealth Group, and only one entity needs to send notices. OCR said it would not start a covered entity's 60-day clock until it received the information it needed from Change Healthcare. OCR opened investigations of Change Healthcare and UnitedHealth Group. The Anthem breach that was the "largest health data breach in history" in 2018 affected almost 79 million people; Change Healthcare's count is more than double that.

Rules in motion, 2024 to 2026

The reproductive health privacy rule and its vacatur

On April 22, 2024, OCR issued the HIPAA Privacy Rule to Support Reproductive Health Care Privacy, published at 89 FR 32976 on April 26, 2024. It barred covered entities from using or disclosing PHI to investigate or impose liability on people for seeking, obtaining, providing or facilitating lawful reproductive health care, and required an attestation for certain requests. On June 18, 2025, the U.S. District Court for the Northern District of Texas, in Purl v. HHS, No. 2:24-cv-00228-Z, declared the rule unlawful and vacated most of it. HHS's reproductive health page says the court vacated only three Notice of Privacy Practices provisions among the NPP changes, 45 CFR 164.520(b)(1)(ii)(F), (G) and (H), so the other NPP modifications remain in effect with compliance required by February 16, 2026, and that HHS "will determine next steps." As of October 2026, the core reproductive health protections are not in force.

The proposed Security Rule overhaul

On January 6, 2025, OCR published a proposed rule at 90 FR 898 (RIN 0945-AA22), with comments due March 7, 2025. HHS's fact sheet lists the main changes: end the distinction between "required" and "addressable" specifications; require encryption of ePHI at rest and in transit and multi-factor authentication, with limited exceptions; require a technology asset inventory and network map updated at least every 12 months; restore certain systems and data within 72 hours; run a compliance audit every 12 months, vulnerability scans every six months and penetration tests every 12 months; segment networks; and have business associates verify their safeguards in writing every 12 months. The current Security Rule stays in effect until a final rule issues. 2026 news reports on the federal regulatory agenda, such as GovInfoSecurity's, say the final rule has been pushed to July 2027 at the earliest. As of October 2026 no final rule has been published.

42 CFR Part 2: substance use disorder records

Federally assisted substance use disorder programs follow stricter confidentiality rules than HIPAA, in 42 CFR Part 2. A final rule aligning Part 2 more closely with HIPAA was announced February 8, 2024 and published February 16, 2024, with compliance required by February 16, 2026. HHS's fact sheet describes the changes:

• A patient may give one consent for all future uses and disclosures for treatment, payment and health care operations.
• HIPAA covered entities and business associates that receive records under that consent may redisclose them as HIPAA allows.
• Records and testimony still may not be used in civil, criminal, administrative or legislative proceedings against the patient without the patient's specific consent or a court order.
• SUD counseling notes, a clinician's separate notes analyzing counseling sessions, need their own specific consent, like psychotherapy notes under HIPAA.
• HIPAA's breach notification requirements now apply to Part 2 records, and Part 2's old criminal penalties are replaced by the HIPAA civil and criminal enforcement structure.

Health data outside HIPAA

The FTC Health Breach Notification Rule

For health data held by companies outside HIPAA, the main federal rule is the FTC's Health Breach Notification Rule, 16 CFR Part 318. It covers vendors of personal health records, PHR related entities that interact with them, and their third party service providers, excluding HIPAA covered entities. A personal health record is an electronic record of identifiable health information that "has the technical capacity to draw information from multiple sources" and is managed for the individual. The FTC's guidance gives the examples of a health app that syncs with a fitness tracker and a diet app that takes a user's weight and pulls calorie counts from restaurant menus.

The FTC voted 3 to 2 on April 26, 2024 to amend the rule, published May 30, 2024 at 89 FR 47028 and effective July 29, 2024. The amendments made clear the rule applies to health apps and similar technologies, defined a "breach of security" to include an unauthorized disclosure as well as a hack, allowed email notice, required notices to name the third parties that got the data, and required notice to the FTC at the same time as individuals for breaches of 500 or more. Individuals must be told without unreasonable delay and within 60 calendar days of discovery. A violation is treated as an unfair or deceptive practice, with civil penalties of up to $53,088 per violation as of October 2026.

FTC case	Date	Amount	What the FTC alleged
GoodRx	February 1, 2023	$1.5 million civil penalty	The FTC's first Health Breach Notification Rule case. GoodRx shared users' medications and health conditions with Facebook, Google, Criteo and others, and gave Facebook lists of people who bought certain drugs for ad targeting, without notifying anyone. Order bars sharing health data for advertising
BetterHelp	March 2, 2023	$7.8 million for partial refunds	The online counseling service promised to keep health data private, then shared email addresses, IP addresses and health questionnaire answers with Facebook, Snapchat, Criteo and Pinterest for advertising. A deception case under the FTC Act
Easy Healthcare (Premom app)	May 17, 2023	$100,000 civil penalty, plus $100,000 to Connecticut, D.C. and Oregon	The ovulation app passed sexual and reproductive health data to AppsFlyer and Google through software kits, and shared data with SDKs from Chinese firms, while promising not to; failed to notify users

State health data laws

Washington's My Health My Data Act (2023, RCW chapter 19.373) is the broadest. Signed April 27, 2023, it applied to most regulated entities from March 31, 2024 and to small businesses from June 30, 2024, according to the Washington Attorney General. It covers consumer health data, defined in RCW 19.373.010 as personal information linked or reasonably linkable to a consumer that identifies past, present or future physical or mental health status: conditions, treatments, medications, bodily functions and vital signs, reproductive or sexual health information, gender-affirming care, biometric and genetic data, precise location that could show an attempt to get health services, and health inferences drawn from non-health data such as purchases. It requires consent to collect and a separate consent to share, a signed authorization to sell (kept by seller and buyer for six years), a right to delete including from backups, a privacy policy linked from the home page, and it bans geofencing within 2,000 feet of an in-person health care facility to track people or send them health ads. Violations are per se violations of Washington's Consumer Protection Act, enforced by the Attorney General and by private lawsuits.

The first class action under the Act was filed February 10, 2025 in the Western District of Washington against Amazon.com and Amazon Advertising, alleging that an Amazon advertising software kit in apps such as The Weather Channel and OfferUp collected location data that could reveal health information without the notice and consent the Act requires, according to a WilmerHale summary. No ruling on the merits was found as of October 2026.

Nevada (SB 370, effective March 31, 2024) and Connecticut (SB 3 of 2023, amending the Connecticut Data Privacy Act) followed with narrower laws. A Hunton summary reports that Nevada requires opt-in consent to collect consumer health data beyond what a requested service needs, separate consent to share and written authorization to sell, bans geofences within 1,750 feet of health facilities, and has no private right of action; Connecticut added consumer health data to its sensitive data category with opt-in consent before sale and a 1,750-foot geofence ban around mental health and reproductive or sexual health facilities. Most broad state consumer privacy laws (lesson 08) also treat health data as sensitive and require opt-in consent.

Genetic privacy: GINA, state laws and 23andMe

The Genetic Information Nondiscrimination Act of 2008 has two parts. Title I, administered by the Departments of Labor, HHS and Treasury, limits health insurers' use of genetic information. Title II, enforced by the EEOC since November 21, 2009, bars employers with 15 or more employees from using genetic information in employment decisions, generally bars them from requesting, requiring or buying it, and requires them to keep any they have in a separate confidential medical file. Genetic information includes a person's and family members' genetic tests and family medical history.

Direct-to-consumer DNA companies are outside both HIPAA and GINA's insurer rules. The test case came in 2025. 23andMe filed for bankruptcy in March 2025 with about 13 million customers. More than 30 states initially objected to selling their residents' genetic data without consent, MedTech Dive reported. Regeneron led the May 2025 auction at $256 million before TTAM Research Institute, a nonprofit, won at $305 million. On June 27, 2025, the bankruptcy judge approved the sale to TTAM over remaining objections from California, Kentucky, Tennessee, Texas and Utah, which argued their genetic privacy laws required opt-in consent from each customer. TTAM agreed to notify customers before closing that they could delete their data, and not to transfer genetic data later except to a domestic nonprofit research institution or a qualifying U.S. company that adopts its privacy terms.

Questions and answers

Can my doctor share my records with another doctor without asking me?

Yes, for treatment. Treatment, payment and health care operations are permitted uses under 164.502(a)(1), and the minimum necessary standard does not apply to disclosures for treatment. Psychotherapy notes and Part 2 substance use records have stricter rules.

Can the police get my medical records?

Sometimes. Under 164.512(f), a covered entity may disclose PHI to law enforcement under a court order, court-ordered warrant, judicial or grand jury subpoena, or an administrative request that meets a three-part test, and in some other narrow situations. HIPAA permits these disclosures; it does not require them unless another law does. The 2024 rule that would have added protections for reproductive health care was vacated in 2025.

How much can a provider charge for my records?

Only a reasonable, cost-based fee covering copying labor, supplies for paper or electronic media, postage, and an agreed summary. 164.524(c)(4) lists the only cost items allowed, and searching for or retrieving records is not among them.

My pharmacy app shows ads for products related to my prescriptions. Is that legal?

It depends on who runs the app and what you agreed to. If the pharmacy itself (a covered entity) runs it, HIPAA limits marketing uses of PHI without authorization. If a separate discount or coupon company runs it, as in the GoodRx case, HIPAA does not apply; the FTC Act, the Health Breach Notification Rule and state laws may.

Do I have to give my genetic test results to my employer?

No, if your employer has 15 or more employees. GINA Title II generally bars employers from requesting, requiring or buying genetic information, including family medical history, with narrow exceptions such as voluntary wellness programs that meet specific requirements.

Who decides whether a breach is "low probability of compromise"?

The covered entity or business associate does the risk assessment, but it bears the burden of proof and must document it. OCR can review the assessment in an investigation and disagree. If the documentation does not show a low probability, the incident is treated as a breach requiring notice.

If my data was in the Change Healthcare breach, who should have notified me?

Your health plan or provider is responsible, but OCR allowed them to delegate notice to Change Healthcare or UnitedHealth Group, which offered to send notices for its customers. Only one notice is required. If you got a letter from Change Healthcare, that was likely the delegated notice.

Does the FTC rule cover my smartwatch?

The watch maker can be a PHR related entity if it sends data to a health app, and the app is a PHR vendor if it draws information from multiple sources. The FTC's guidance uses a health app syncing with a fitness tracker as its example of a covered PHR. A breach, including an unauthorized disclosure, triggers notice within 60 calendar days.

Hard questions

Should HIPAA follow the data instead of the organization?

Supporters of the current design say HIPAA fits the health care system it was built for, with rules tied to billing and treatment workflows, and that extending it to every app would impose clinical-grade duties on consumer products. Those who want it extended point to the FTC's GoodRx, BetterHelp and Premom cases as proof that the most sensitive health data now flows through companies outside HIPAA, and to Washington's My Health My Data Act as a model keyed to the data itself. The FTC's 2024 amendments and the state laws are partial answers; Congress has not changed HIPAA's scope.

Was vacating the reproductive health rule correct?

The court in Purl v. HHS found the rule unlawful, and challengers argued HHS exceeded its authority by limiting disclosures that state law enforcement and child abuse reporting laws rely on. HHS, when it issued the rule, argued that after the Supreme Court's 2022 decision in Dobbs, patients and providers needed assurance that seeking lawful care in one state would not expose records to investigators from another, and that the rule fit HIPAA's existing structure of conditions on law enforcement disclosures. HHS has not announced an appeal or replacement as of October 2026, per its own page saying it would determine next steps.

Should the Security Rule mandate encryption and MFA?

OCR's proposal rests on its enforcement record: case after case where ransomware got in through weak authentication and found unencrypted data, and where no accurate risk analysis had been done. Opponents argue the mandates would be costly, would fall hardest on small and rural providers, and would lock in technical rules that could age badly. The 2026 reports of delay to 2027 suggest the agency is still weighing those comments. Encryption is already the price of the breach safe harbor, so many organizations encrypt whether or not the rule requires it.

Should patients be able to sue under HIPAA?

HIPAA gives no private right of action, so individuals depend on OCR, state attorneys general and state law claims. Advocates for a private right argue that OCR resolves a small share of complaints with money penalties and that breach victims have no direct remedy. Providers and insurers argue that private suits would drive up costs, produce class actions over technical violations, and divert money from security to litigation. State laws like Washington's, which allow private suits for health data violations, will provide evidence on how private enforcement works in practice.

Was the 23andMe sale a fair outcome for customers?

The bankruptcy judge reasoned that TTAM would run the business the same way, with the same people handling data, that customers were told they could delete their data, and that a Chapter 11 plan could have moved the data with no consent at all. The five objecting states argued their genetic privacy laws required each customer's opt-in consent before a transfer, and that bankruptcy should not override that. The case showed that a promise in a privacy policy can change hands with the company, and that state genetic privacy laws are untested against federal bankruptcy law.