Most confusion about HIPAA comes from treating it as a single monolithic regulation. It isn't. The obligations that actually govern day-to-day work sit in three distinct rules, each answering a different question. The Privacy Rule asks: what are you allowed to do with health information? The Security Rule asks: how must you protect the electronic version of it? And the Breach Notification Rule asks: when protection fails, who do you have to tell, and how fast? Learn which rule owns which question and the whole framework stops feeling like a wall of jargon and starts reading like a checklist.
Three Rules, One Framework
The three rules arrived over roughly a decade and build on each other. The Privacy Rule (effective 2003) came first and is the broadest: it governs the use and disclosure of PHI in every form. The Security Rule (effective 2005) narrowed the focus to electronic PHI and specified how to protect it. The Breach Notification Rule (2009, introduced by the HITECH Act) closed the loop by defining what has to happen when PHI is exposed. Two further rules — the Enforcement Rule and the 2013 Omnibus Rule — tie the system together and extended direct liability to business associates, but the three above are the ones that shape what you build and operate.
Held together, they answer the three questions any regulator ultimately asks after an incident: were you permitted to hold and share this data, did you protect it properly, and did you respond correctly when it leaked. A gap in any one is where enforcement actions are born.
The Privacy Rule
The Privacy Rule is the oldest and widest of the three. It governs uses and disclosures of PHI — who may see health information, for what purposes, and with what permission — and it applies to PHI in every form, from an electronic record to a paper chart to a spoken exchange at a reception desk.
Its organising idea is the minimum necessary standard: use or disclose only the smallest amount of PHI needed for the task at hand. It also permits certain uses without individual authorisation — treatment, payment, and healthcare operations, the "TPO" exceptions — while requiring authorisation for most others, such as marketing. And it grants individuals a set of enforceable rights over their own data.
- Right of access. Individuals can inspect and get a copy of their records, generally within 30 days.
- Right to amend. They can request corrections to inaccurate or incomplete information.
- Accounting of disclosures. They can ask for a record of certain disclosures you've made.
- Notice of Privacy Practices. They must be told how their information is used and shared.
For a product team, the Privacy Rule translates less into legal paperwork and more into design: role-based access, data minimisation, and the ability to export or correct a record on request are Privacy Rule obligations wearing engineering clothes.
The Security Rule
The Security Rule is narrower in scope but far deeper in mechanics. It applies only to electronic PHI and requires safeguards in three families. This is the rule a software company spends most of its effort satisfying, because it maps almost one-to-one onto controls a serious security programme already runs.
| Safeguard family | What it covers | Examples |
|---|---|---|
| Administrative | The policies and people around ePHI | Risk analysis, workforce training, a designated security official, contingency planning |
| Physical | Control over facilities and devices | Facility access controls, workstation security, device and media disposal |
| Technical | The controls in the systems themselves | Access control, audit logging, integrity controls, encryption, transmission security |
A crucial detail: the Security Rule labels each implementation specification as either required or addressable. Addressable does not mean optional — it means you must implement it if reasonable and appropriate, or document why not and adopt an equivalent measure. Encryption of ePHI, for instance, is addressable, but skipping it without a documented, defensible alternative is exactly the kind of gap OCR penalises. The rule's anchor is the security risk analysis: a documented assessment of where ePHI lives and what threatens it, and the single most common thing found missing in enforcement actions. It is the same discipline as an ISO 27001 risk assessment, pointed at health data.
The Breach Notification Rule
The Breach Notification Rule governs the worst day. A breach is an impermissible acquisition, access, use, or disclosure of unsecured PHI that compromises its security or privacy. The word unsecured is load-bearing: PHI that was properly encrypted to standard generally falls under a safe harbour and its exposure may not be a reportable breach at all — one of the strongest practical arguments for encrypting everything.
When an incident happens, you assess it against a four-factor risk analysis — the nature and extent of the PHI, who received it, whether it was actually acquired or viewed, and the extent to which the risk has been mitigated — to judge the probability that PHI was compromised. Unless that probability is low, notification is required:
- Affected individuals — without unreasonable delay and no later than 60 days from discovery.
- The HHS Office for Civil Rights — within 60 days for breaches affecting 500 or more people; smaller breaches are logged and reported annually.
- The media — for breaches affecting 500 or more residents of a state or jurisdiction.
If you're a business associate and you suffer the breach, your first obligation is to notify the covered entity you serve — generally without unreasonable delay and no later than 60 days — so it can meet its own notification duties. This is why your incident-response plan and your Business Associate Agreements have to be written to line up; a mismatch here turns a technical incident into a contractual and regulatory one.
Side by Side
The cleanest way to keep the three straight is to see them in one view — what each covers, how wide its scope is, and the obligation that defines it.
| Rule | Core question | Scope | Defining obligation |
|---|---|---|---|
| Privacy Rule | What may you do with PHI? | All PHI — spoken, paper, electronic | Minimum necessary; individual rights |
| Security Rule | How must you protect it? | Electronic PHI only | Administrative, physical, technical safeguards |
| Breach Notification Rule | What if protection fails? | Unsecured PHI | Notify individuals, HHS, and sometimes media |
How They Work Together
The rules feel abstract until a single event runs through all three at once. Picture an unencrypted laptop holding a patient list, stolen from a car. The Privacy Rule is implicated the moment that PHI is disclosed to someone with no right to see it. The Security Rule is implicated because the device wasn't encrypted and access wasn't controlled — the safeguards failed. And the Breach Notification Rule now dictates the response: run the four-factor analysis, and because the PHI was unsecured, notify the affected individuals, OCR, and possibly the media within the deadlines.
One incident, three rules, three separate ways to be found non-compliant. That interdependence is why you can't treat them in isolation — and why a strong control here doubles as evidence elsewhere. Much of what the Security Rule demands is the same work as ISO 27001 for healthcare, and the breach discipline is exactly what a tabletop exercise is built to rehearse.
Build role-based access, data minimisation, and record export/correction into the product. Most Privacy Rule obligations are engineering decisions, not policy documents.
Document where ePHI lives, assess the threats, and implement the administrative, physical, and technical safeguards — treating "addressable" specs like encryption as things you do or defensibly document.
Write the incident-response plan, wire the four-factor assessment into it, and align it with your BAAs so the notification clock and the contractual duties don't contradict each other.
Final Thought
The three rules are not competing frameworks to choose between; they are three views of the same obligation, sequenced from permission to protection to response. The organisations that struggle with HIPAA are almost always the ones that collapsed the three into a vague sense of "being careful with health data" and then discovered, after an incident, that careful isn't a control. The ones that do well keep the questions separate — may we, how do we protect it, what if it leaks — and can point to a concrete answer for each.
The test: take one real piece of PHI in your systems and trace it through all three rules. Can you name the basis on which you use it, the specific safeguards protecting it, and the exact steps you'd take if it were exposed tomorrow? Three clear answers means the framework is real; a blank on any one is your next priority.
Frequently Asked Questions
The Privacy Rule governs how PHI may be used and disclosed, in any form. The Security Rule sets administrative, physical, and technical safeguards for electronic PHI specifically. The Breach Notification Rule dictates who must be told, and how quickly, when unsecured PHI is exposed. Together they answer what you may do with health data, how you must protect it, and what happens when protection fails.
The Privacy Rule covers PHI in every form — spoken, paper, and electronic — and governs uses and disclosures, the minimum-necessary standard, and individual rights like access and amendment. The Security Rule applies only to electronic PHI and specifies the administrative, physical, and technical safeguards that protect it. Privacy is about what you may do with the data; Security is about how you protect it electronically.
An impermissible acquisition, access, use, or disclosure of unsecured PHI that compromises its security or privacy. Unless you can show a low probability that PHI was compromised — assessed through a four-factor risk analysis — notification is required. Individuals must be told without unreasonable delay and no later than 60 days; HHS and, for large breaches, the media must also be notified.
No. The Security Rule applies only to electronic PHI. Paper records, spoken disclosures, and other non-electronic PHI are still fully covered by the Privacy Rule, which governs uses and disclosures regardless of form — but the technical and electronic safeguards of the Security Rule attach specifically to ePHI.