Domain I: Privacy Rule Obligations
Minimum necessary, permitted uses and disclosures, verification of who is asking, and the individual-rights support each entity type owes.
Some items in this domain are written for one entity type. Items marked Business Associates only or Covered Entities only apply to that type; unmarked items apply to every HIPAA-regulated organization.
Every item here is already part of the current, final HIPAA Security Rule. Items marked NPRM: would become Required are currently Addressable, OCR’s pending 2025 proposed rule would eliminate that flexibility and make them mandatory if finalized (not yet in effect).
Minimum-necessary standard applied to routine PHI use and disclosure
45 C.F.R. §164.502(b) · Source: www.ecfr.gov/current/title-45/section-164.502
Permitted-use and disclosure limits in the BAA followed in operational practice, not only on paper
45 C.F.R. §164.504(e)(2) · Source: www.ecfr.gov/current/title-45/section-164.504
Process to support the covered entity's obligations to individuals (access, amendment, accounting of disclosures) when the BA holds the records
45 C.F.R. §164.504(e)(2)(ii) · Source: www.ecfr.gov/current/title-45/section-164.504
PHI returned or destroyed at contract termination, or the extension of protections documented if return or destruction is infeasible
45 C.F.R. §164.504(e)(2)(ii)(I) · Source: www.ecfr.gov/current/title-45/section-164.504
Uses and disclosures of PHI limited to treatment, payment, and health care operations, those made with an opportunity to agree or object, the public-interest categories the rule lists, and those made under a valid authorization, with the workforce trained on which is which
45 C.F.R. §164.502(a); 164.506; 164.510; 164.512 · Source: www.ecfr.gov/current/title-45/section-164.502
Identity and authority of a requester verified before any disclosure, including personal representatives and public officials, and the verification documented
45 C.F.R. §164.514(h); 164.502(g) · Source: www.ecfr.gov/current/title-45/section-164.514
Reasonable safeguards in place to limit incidental uses and disclosures of PHI in every form: oral, paper, and electronic
45 C.F.R. §164.530(c)(2); 164.502(a)(1)(iii) · Source: www.ecfr.gov/current/title-45/section-164.530
No sale of PHI, and no marketing or fundraising communications, without the authorization or opt-out the Privacy Rule requires
45 C.F.R. §164.502(a)(5)(ii); 164.508(a)(3)-(4); 164.514(f) · Source: www.ecfr.gov/current/title-45/section-164.502