For patients;

• It means being able to make informed choices when seeking care and reimbursement for care based on how PHI may be used.
• It enables patients to find out how their information may be used, and about certain disclosures of their information that have been made.
• It generally limits release of information to the minimum reasonable needed for the purpose of disclosure.
• It generally gives patients the right to examine and obtain a copy of their own health records and request corrections.
• It empowers individuals to control certain uses and disclosures of their health information.

Final modifications to the Rule were adopted on August 14, 2002. Among other things, the modifications addressed the following aspects of the Privacy Rule:

Uses and disclosures for treatment, payment and health care operations, including eliminating the requirement for the individual’s consent for these activities;

Parents as the personal representative of un-emancipated minors;

Uses and disclosures for research purposes; and

Transition provisions, including business associate contracts.

In addition to these key areas, the modifications included changes to certain other provisions where necessary to clarify the Privacy Rule, and a list of technical corrections intended as editorial or typographical corrections to the Privacy Rule.

For more information about the final modifications to the Privacy Rule, see the Fact Sheet entitled, Modifications to the Standards for Privacy of Individually Identifiable Health Information Final Rule. This Fact sheet can be found at

To eliminate such barriers to health care, mandatory consent was replaced with the voluntary consent provision that permits health care providers to obtain consent for treatment, payment and health care operations, at their option, and enables them to obtain consent in a manner that does not disrupt needed treatment. Although consent is no longer mandatory, the Rule still affords individuals the opportunity to engage in important discussions regarding the use and disclosure of their health information through the strengthened notice requirement, while allowing activities that are essential to quality health care to occur unimpeded. These modifications will ensure that the Rule protects patient privacy as intended without harming consumers' access to care or the quality of that care. Further, the individual's right to request restrictions on the use or disclosure of his or her PHI is retained in the Rule as modified.

In addition, after the compliance dates above, individuals have a right to file a complaint directly with the covered entity. Individuals should refer to the covered entity’s notice of privacy practices for more information about how to file a complaint with the covered entity.

A covered entity may also leave a message with a family member or other person who answers the phone when the patient is not home. The Privacy Rule permits covered entities to disclose limited information to family members, friends, or other persons regarding an individual's care, even when the individual is not present. However, covered entities should use professional judgment to assure that such disclosures are in the best interest of the individual and limit the information disclosed. 

In situations where a patient has requested that the covered entity communicate with him in a confidential manner, such as by alternative means or at an alternative location, the covered entity must accommodate that request, if reasonable.

Yes, covered entities such as physician offices may use patient sign-in sheets or call out patient names in waiting rooms, so long as the information disclosed is appropriately limited. The Privacy Rule explicitly permits certain "incidental disclosures" that occur as a by-product of an otherwise permitted disclosure. However, these "incidental" disclosures are permitted only to the extent that the covered entity has applied reasonable and appropriate safeguards, and implemented the minimum necessary standard, where appropriate.

Yes, the Privacy Rule allows this communications to occur, as long as the patient has been informed of this use and disclosure, and does not object. The Privacy Rule provides that a hospital or other covered health care provider may maintain in a directory the following information about that individual: the individual's name; location in the facility; health condition expresses in general terms; and religious affiliation. The facility may disclose this directory information to members of the clergy.

The minimum necessary standard requires covered entities to evaluate their practices and enhance protections as needed to limit unnecessary or inappropriate access to PHI. It is intended to reflect and be consistent with, not override, professional judgment and standards. Therefore, it is expected that covered entities will utilize the input of prudent professionals involved in health care activities when developing policies and procedures that appropriately limit access to PHI without sacrificing the quality of health care.

There is an exception to the general rule that a covered entity must treat an adult or emancipated minor's personal representative as the individual. Specifically, the Privacy Rule does not require a covered entity to treat a personal representative as the individual if, in the exercise of professional judgment, it believes doing so would not be in the best interest of the individual because of a reasonable belief that the individual has been or may be subject to domestic violence, abuse or neglect by the personal representative, or that doing so would otherwise endanger the individual. This exception applies to adults and both emancipated and un-emancipated minors who may be subject to abuse or neglect by their personal representatives.

However, covered entities must make disclosures that are required under the Rule. Consequently, with respect to the individual's right of access to PHI and for an accounting of disclosures, covered entities must provide the individual's personal representative access to the individual's PHI or an accounting of disclosures upon the request of the personal representative, unless the covered entity, in the exercise of professional judgment, believes doing so would not be in the best interest of the individual because of a reasonable belief that the individual may be subject to domestic violence, abuse or neglect by the personal representative, or that doing so would otherwise endanger the individual. The Rule allows a specified time period before a covered entity must act on such a request; and during this interim period, an individual and his personal representative will have an opportunity to resolve any dispute they may have concerning the request.

(1) when the minor is the one who consents to care and the consent of the parent is not required under State or other applicable law;

(2) when the minor obtains care at the direction of a court or a person appointed by the court;

(3) when, and to the extent that, the parent agrees that the minor and the health care provider may have a confidential relationship.

However, even in these exceptional situations, the parent may have access to the medical records of the minor related to this treatment when State or other applicable law requires or permits such parental access. Parental access would be denied when State or other law prohibits such access. If State or other applicable law is silent on a parent's right of access in these cases, the licensed health care provider may exercise his or her professional judgment to the extent allowed by law to grant or deny parental access to the minor's medical information.  Finally, as is the case with respect to all personal representatives under the Privacy Rule, a provider may choose not to treat a parent as a personal representative when the provider reasonable believes, in his or her professional judgment, that the child has been or may be subjected to domestic violence, abuse or neglect, or that treating the parent as the child's personal representative could endanger the child.

Business associates, however, are not subject to the requirements of the Privacy rule, and the Secretary cannot impose civil monetary penalties on a business associate for breach of its business contract with the covered entity, unless the business associate is itself a covered entity.

With respect to business associates, a covered entity is considered to be out of compliance with the Privacy Rule, if it fails to take the steps described above. If a covered entity is out of compliance with the Privacy Rule because of its failure to take these steps, further disclosures of PHI to the business associate are not permitted. In cases where a covered entity is also a business associate, the covered entity is considered to be out f compliance with the Privacy Rule if it violates the satisfactory assurances it provided as a business associate of another covered entity.

If a service is hired to do work for a covered entity where disclosure of PHI is not limited in nature, it likely would be a business associate. However, when such work is performed under the direct control of the CE, the Privacy Rule permits the CE to treat the service as part of its workforce, and the CE need not enter into a BA contract with the service.

Under 45 CFR 164.526, a covered entity must amend PHI about an individual in a designated record set, including any designated record sets held by a BA.  Under 45 CFR 164.528, the Privacy Rule requires a CE to provide an accounting of certain disclosures, including certain disclosures by its BA, to the individual upon request.

Yes, assuming that the electronic contract satisfies the applicable requirements of State contract law. The Privacy Rule generally allows for electronic documents, including BA contracts, to qualify as written documents for purposes of meeting the Rule's requirements. However, currently, no standards exist under HIPAA for electronic signatures. In the absence of specific standards, covered entities must ensure any electronic signature used will result in a legally binding contract under applicable State or other law.