How to HIPAA: Privacy
Free HIPAA guide · 20 controls · 5 templates
The substantive Privacy Rule duties: permitted uses and disclosures, minimum necessary, and individual rights. The sections below are assembled from the same control catalog, threat library, and enforcement mapping our free assessment runs on.
Why this matters
- The Privacy Rule
- Governs how PHI may be used and disclosed and the rights individuals hold over it. Most OCR complaints and penalties come from everyday mishandling here (over-sharing, missing authorizations, ignored access requests), not from hackers.
- Privacy duties as a business associate
- The Privacy Rule provisions a business associate is directly responsible for: permitted uses, minimum necessary, and supporting individual rights. Mishandling these creates direct liability even as 'just' the vendor.
The controls in this area
The 45 CFR §164 requirements HIPAA places here: 20 of the 103 controls in our catalog. Our free templates and assessment track each one:
164.502(g) · 164.520 · 164.522 · 164.524 · 164.526 · 164.528 · 164.530(h) · 164.502(a)(3) · 164.502(a)(4) · 164.502(a)(5)(ii) · 164.502(a)/(b) · 164.502(b) / .514(d) · 164.506 · 164.508 · 164.510 · 164.512 · 164.514(a)-(c) · 164.514(d) · 164.514(f)/(g) · 164.504(e)
What enforcement looks like here
OCR's recurring investigation findings in this area:
- Right of access 164.524
- Notice of privacy practices 164.520
Breach causes reported to HHS that implicate these controls: Unauthorized Access
Related threat scenarios
Common threats (NIST SP 800-30 classes) that this area's controls defend against:
- AccidentalAccidental disclosure / over-share
Exploits: No access controls on shares · 164.312(a) Access Control; 164.514(d)
Free templates for this area
De-branded policy and procedures templates mapped to this area's controls. Read the full text free, then adapt them to your organization:
See where your organization stands on the 20 controls in this area.
Join Us