What HIPAA Privacy Compliance Actually Requires of Covered Entities
If your organization qualifies as a covered entity under the Health Insurance Portability and Accountability Act, HIPAA privacy compliance is not optional, and it is not a one-time project. It is an ongoing operational obligation with real enforcement consequences. The Office for Civil Rights at the Department of Health and Human Services has levied hundreds of millions of dollars in penalties against covered entities that treated the Privacy Rule as background noise rather than a binding compliance framework.
This post lays out what the HIPAA Privacy Rule actually requires, where covered entities most commonly fall short, and what a functioning compliance program looks like in practice. Whether you are a compliance manager building your program from scratch or an executive reviewing your current posture, this breakdown gives you the foundation you need to act.
Who Qualifies as a Covered Entity
Before addressing requirements, it is worth confirming scope. The HIPAA Privacy Rule applies to three categories of covered entities:
- Health plans — including health insurance companies, HMOs, company health plans, and government programs that pay for healthcare
- Healthcare clearinghouses — entities that process nonstandard health information into standard formats
- Healthcare providers — any provider that transmits health information electronically in connection with covered transactions
Business associates — vendors and contractors who handle protected health information on behalf of covered entities — face their own direct obligations under the HIPAA Rules, but the primary compliance burden and accountability rests with the covered entity itself.
Core Requirements Under the HIPAA Privacy Rule
1. Protecting Protected Health Information
The Privacy Rule establishes national standards for protecting protected health information (PHI) — individually identifiable health information held or transmitted in any form, including paper, electronic, and oral. Covered entities must implement reasonable safeguards to limit incidental uses and disclosures and must establish policies and procedures that restrict access to PHI on a minimum necessary basis.
The minimum necessary standard is one of the most frequently cited compliance gaps. Staff should access only the PHI they need to perform their job functions. Blanket access to all patient or member records does not satisfy this requirement.
2. Notice of Privacy Practices
Covered entities must provide individuals with a clear, written Notice of Privacy Practices (NPP) that explains how PHI may be used and disclosed, the individual's rights regarding their information, and the covered entity's legal duties. The notice must be written in plain language, made available upon request, and — for healthcare providers with a direct treatment relationship — provided at the first point of service.
Failure to maintain an accurate, current NPP that reflects actual privacy practices is a common finding during OCR audits and investigations.
3. Individual Rights
The Privacy Rule grants individuals a defined set of rights regarding their PHI. Covered entities must have documented processes to fulfill each of the following:
- Right of access — individuals may request and receive copies of their PHI, generally within 30 days
- Right to amend — individuals may request corrections to their PHI
- Right to an accounting of disclosures — individuals may request a record of certain disclosures of their PHI
- Right to request restrictions — individuals may request limits on uses and disclosures, though covered entities are generally not required to agree
- Right to confidential communications — individuals may request alternative means of communication
- Right to receive a notice — individuals are entitled to receive the NPP
The right of access has received heightened OCR enforcement attention. Covered entities that delay responses, charge excessive fees, or impose unreasonable barriers have faced significant civil money penalties.
4. Permissible Uses and Disclosures
The Privacy Rule defines the circumstances under which a covered entity may use or disclose PHI without an individual's authorization. Permitted uses include treatment, payment, and healthcare operations (collectively, TPO). Disclosures required by law, for public health activities, and for certain research purposes also fall within permitted categories.
For any use or disclosure that falls outside these permitted categories, the covered entity must obtain a valid written authorization from the individual before proceeding. Your policies must clearly map which activities require authorization and which do not, and your workforce must be trained accordingly.
5. Workforce Training and Accountability
A covered entity must train all workforce members who handle PHI on its privacy policies and procedures. This requirement is not satisfied by a one-time onboarding session. Training must be provided to new staff as a condition of employment and must be updated whenever material changes are made to policies or procedures.
Beyond training, covered entities must apply appropriate sanctions against workforce members who violate privacy policies. These sanctions must be documented and consistently applied. OCR investigators routinely look for evidence that organizations hold their people accountable — not just that policies exist on paper.
6. Designation of a Privacy Official
Every covered entity must designate a Privacy Official responsible for the development and implementation of HIPAA privacy policies and procedures. This person must also serve as a contact point for individuals with complaints or questions. For smaller organizations, this role may be combined with other compliance responsibilities, but the designation must be documented and the individual must have genuine authority to act.
7. Business Associate Agreements
When a covered entity shares PHI with a business associate — a vendor, contractor, or other party that performs services on its behalf — the covered entity must have a signed Business Associate Agreement (BAA) in place before any PHI is disclosed. The BAA must include specific HIPAA-required provisions establishing the business associate's obligations to protect PHI.
Failure to maintain current BAAs with all relevant vendors is one of the most common Privacy Rule violations OCR identifies. This includes cloud service providers, billing companies, IT support vendors, and any other third party with access to PHI.
HIPAA Privacy Compliance and the Security Rule: Understanding the Relationship
The Privacy Rule governs who can access PHI and under what conditions. The HIPAA Security Rule governs how electronic PHI (ePHI) must be protected through administrative, physical, and technical safeguards. The two rules are distinct but deeply interdependent. A covered entity cannot claim meaningful HIPAA privacy compliance without also addressing its Security Rule obligations — particularly around access controls, audit controls, and transmission security.
For organizations that want a structured starting point, the HIPAA Privacy & Security Compliance for Healthcare Administrators resource provides practical guidance covering both rules in an accessible format for compliance and administrative teams.
Where Covered Entities Most Commonly Fall Short
In my experience working with healthcare organizations and other covered entities, the most persistent HIPAA privacy compliance gaps are not exotic. They are operational failures that accumulate over time:
- Outdated or inaccurate Notices of Privacy Practices that do not reflect current practices
- Incomplete or expired Business Associate Agreements with active vendors
- Inadequate access controls allowing workforce members to view PHI beyond their job function
- Inconsistent or undocumented responses to individual rights requests
- Workforce training that exists on paper but has not been meaningfully delivered or updated
- No designated Privacy Official or a designee without the authority or resources to act
Many of these failures are not the result of bad intent — they are the result of compliance programs that were built reactively rather than proactively, and that have not kept pace with organizational changes. A structured compliance program development engagement is often the most efficient way to identify and close these gaps systematically.
HIPAA Privacy Compliance in Healthcare Organizations
For organizations operating within the broader healthcare ecosystem — including provider groups, health systems, and payers — HIPAA privacy compliance is one layer of a larger regulatory picture. Our healthcare industry compliance practice addresses the full range of obligations these organizations face, including both HIPAA rules and the operational security requirements that support them.
For those who need ongoing executive-level compliance leadership without the cost of a full-time hire, our Regulatory vCISO Services provide the strategic oversight needed to maintain a defensible program across both HIPAA and related frameworks.
Documentation Is Not Optional
The Privacy Rule requires covered entities to maintain written policies and procedures and to retain documentation for a minimum of six years from the date of creation or the date it was last in effect, whichever is later. This documentation burden extends to training records, complaint logs, sanction records, and any decisions made under the minimum necessary standard.
If your program cannot produce this documentation during an OCR audit or investigation, the absence itself becomes evidence of non-compliance. For organizations that need help building or rebuilding their documentation infrastructure, our HIPAA Compliance Documentation Toolkit provides a structured starting point.
Practical Next Steps for Compliance Managers
If you are assessing or strengthening your HIPAA privacy compliance posture, prioritize the following actions:
- Conduct or update your HIPAA risk assessment, covering both privacy and security obligations
- Review and update your Notice of Privacy Practices to reflect current practices
- Audit your BAA inventory and close any gaps with active vendors and service providers
- Review workforce access to PHI against the minimum necessary standard
- Verify that training records are current and that a documented sanctions policy is in place
- Confirm that your Privacy Official designation is current and that the individual has authority to act
- Establish or review your process for responding to individual rights requests within required timeframes
None of these steps requires a major technology investment. Most require documented process, clear ownership, and consistent execution — which is exactly where an experienced compliance partner adds the most value.
Get Expert Support for HIPAA Privacy Compliance
Cleared Systems works with healthcare organizations, covered entities, and regulated businesses to build and sustain HIPAA privacy compliance programs that hold up under scrutiny. If your organization needs a gap assessment, program development support, or ongoing compliance leadership, we are ready to help. Request a quote to start a conversation with our team, or explore our IT compliance services to learn how we support the technical side of HIPAA compliance alongside your privacy program obligations.