The HIPAA Privacy Rule Explained: PHI, Rights, and Uses | Osto<\/title>\n<meta name=\"description\" content=\"The HIPAA Privacy Rule explained: what PHI it protects, how it can be used and disclosed, patient rights, and the minimum necessary standard.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">The HIPAA Privacy Rule sets the ground rules for how health information can be used and shared, and what rights people have over it. Here is what it means in practice.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>7 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>The Privacy Rule governs how protected health information may be used and disclosed, in any form. It permits core uses like treatment and payment without separate authorisation, but restricts most other sharing.<\/p>\n <p>It also grants individuals rights over their health data, access, amendment, and more, and requires the minimum necessary standard: limiting PHI use and sharing to what the task actually needs. It is the privacy counterpart to the Security Rule’s technical focus.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What the Privacy Rule is<\/a><\/li>\n <li><a href=\"#uses\">Permitted uses and disclosures<\/a><\/li>\n <li><a href=\"#rights\">Patient rights<\/a><\/li>\n <li><a href=\"#minimum\">The minimum necessary standard<\/a><\/li>\n <li><a href=\"#vs\">Privacy Rule vs Security Rule<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What is the HIPAA Privacy Rule?<\/h2>\n <p>The Privacy Rule is the part of HIPAA that sets national standards for protecting <a href=\"https:\/\/www.osto.one\/resources\/glossary\/protected-health-information\/\">protected health information<\/a>. Where the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/hipaa-security-rule\/\">Security Rule<\/a> is technical and focused on electronic data, the Privacy Rule is broader: it governs how PHI in any form, spoken, written, or electronic, may be used within an organisation and disclosed outside it. In short, it answers the question: who is allowed to see or share this health information, and under what conditions?<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The core principle<\/div>PHI belongs, in a meaningful sense, to the individual. The Privacy Rule limits how it can be used and shared without the person’s involvement, and gives them rights to see and influence what happens to it.<\/div>\n\n <h2 class=\"sec\" id=\"uses\">Permitted uses and disclosures<\/h2>\n <p>The Privacy Rule does not block all sharing, that would make healthcare impossible. It permits certain core uses without needing separate patient authorisation, most importantly treatment, payment, and healthcare operations. Beyond those, most other uses and disclosures require the individual’s authorisation, with specific exceptions defined in the rule.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">The practical line<\/div>Treatment, payment, and healthcare operations are generally permitted without separate authorisation. Marketing, sale of PHI, and most other secondary uses are not, they need explicit authorisation. When in doubt, the default is to restrict.<\/div>\n\n <h2 class=\"sec\" id=\"rights\">The rights the Privacy Rule gives patients<\/h2>\n <p>A defining feature of the Privacy Rule is the set of rights it grants individuals over their own health information. If you handle PHI, you must be able to honour these.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">Patient rights<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">What the Privacy Rule gives individuals<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">The rule grants people meaningful control over their own health information, and obliges you to honour it.<\/div>\n <svg viewBox=\"0 0 700 190\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Patient rights under the HIPAA Privacy Rule\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <g>\n <rect x=\"20\" y=\"20\" width=\"200\" height=\"70\" rx=\"12\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"120\" y=\"50\" text-anchor=\"middle\" fill=\"#2b3596\" font-size=\"13\" font-weight=\"800\">Access<\/text>\n <text x=\"120\" y=\"70\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">get a copy of their records<\/text>\n <rect x=\"250\" y=\"20\" width=\"200\" height=\"70\" rx=\"12\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"350\" y=\"50\" text-anchor=\"middle\" fill=\"#2b3596\" font-size=\"13\" font-weight=\"800\">Amendment<\/text>\n <text x=\"350\" y=\"70\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">correct inaccurate records<\/text>\n <rect x=\"480\" y=\"20\" width=\"200\" height=\"70\" rx=\"12\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"580\" y=\"50\" text-anchor=\"middle\" fill=\"#2b3596\" font-size=\"13\" font-weight=\"800\">Accounting<\/text>\n <text x=\"580\" y=\"70\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">see who it was disclosed to<\/text>\n <rect x=\"135\" y=\"105\" width=\"200\" height=\"70\" rx=\"12\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.5\"\/>\n <text x=\"235\" y=\"135\" text-anchor=\"middle\" fill=\"#0a7d6c\" font-size=\"13\" font-weight=\"800\">Restriction<\/text>\n <text x=\"235\" y=\"155\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">request limits on use<\/text>\n <rect x=\"365\" y=\"105\" width=\"200\" height=\"70\" rx=\"12\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.5\"\/>\n <text x=\"465\" y=\"135\" text-anchor=\"middle\" fill=\"#0a7d6c\" font-size=\"13\" font-weight=\"800\">Confidential contact<\/text>\n <text x=\"465\" y=\"155\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">choose how they are reached<\/text>\n <\/g>\n<\/g><\/svg>\n \n<\/div>\n\n <p>People can access and get copies of their records, request corrections, ask for an accounting of certain disclosures, request restrictions on use, and ask to be contacted confidentially. Building systems that can actually fulfil these requests is part of Privacy Rule compliance, not an optional extra.<\/p>\n\n <h2 class=\"sec\" id=\"minimum\">The minimum necessary standard<\/h2>\n <p>One of the rule’s most practical requirements is the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/minimum-necessary-standard\/\">minimum necessary<\/a> standard: when using or disclosing PHI, you must limit it to the minimum needed to accomplish the purpose. An employee should see only the health data their role requires; a disclosure should include only the relevant records. For a software company, this translates directly into access controls and role-based permissions.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Where privacy meets engineering<\/div>The minimum necessary standard is a privacy principle with a technical answer: granular access control. Limiting who can see which PHI, and logging it, is how you operationalise a Privacy Rule requirement in a real system.<\/div>\n\n <h2 class=\"sec\" id=\"vs\">Privacy Rule vs Security Rule<\/h2>\n <p>The two rules are complementary, not competing. The Privacy Rule governs the what and who of using and sharing PHI in any form. The Security Rule governs the how of protecting that data specifically in electronic form, through administrative, physical, and technical safeguards. You need both: privacy defines the rules of access, security enforces them technically.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to Privacy Rule compliance<\/h2>\n <p>Much of the Privacy Rule turns into concrete engineering: enforcing minimum necessary access, logging who viewed what, and being able to produce records when someone exercises their rights. Doing this across scattered systems is where access creeps beyond what is necessary and audit trails go missing.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. Access control and audit logging run on one platform, so you can enforce minimum necessary access, prove who saw which PHI, and support patient-rights requests, all mapped to HIPAA alongside 200+ other frameworks. That turns Privacy Rule principles into controls that actually operate, which is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Turn privacy principles into working controls.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Enforce minimum necessary access and log every view of PHI on one platform mapped to HIPAA. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is the HIPAA Privacy Rule?<\/summary><p>It is the part of HIPAA that sets standards for how protected health information may be used and disclosed, in any form. It permits core uses like treatment and payment without separate authorisation, restricts most other sharing, and grants individuals rights over their data.<\/p><\/details>\n <details><summary>What is the difference between the Privacy Rule and the Security Rule?<\/summary><p>The Privacy Rule governs how PHI in any form may be used and shared, and the rights people have over it. The Security Rule governs how electronic PHI is protected technically, through safeguards. They are complementary: privacy sets the rules, security enforces them.<\/p><\/details>\n <details><summary>What uses of PHI are allowed without authorisation?<\/summary><p>Chiefly treatment, payment, and healthcare operations. Most other uses and disclosures, such as marketing or sale of PHI, require the individual’s explicit authorisation, with limited exceptions defined in the rule.<\/p><\/details>\n <details><summary>What rights does the Privacy Rule give patients?<\/summary><p>Rights to access and obtain copies of their records, request amendments, receive an accounting of certain disclosures, request restrictions on use, and ask to be contacted confidentially. Organisations handling PHI must be able to honour these.<\/p><\/details>\n <details><summary>What is the minimum necessary standard?<\/summary><p>The requirement to limit PHI use and disclosure to the minimum needed for the purpose. In practice it means role-based access, so people see only the health data their job requires, enforced through access controls and logging.<\/p><\/details>\n <details><summary>Does the Privacy Rule apply to business associates?<\/summary><p>Yes. Business associates handling PHI on behalf of a covered entity are bound by applicable Privacy Rule provisions through their <a href=\"https:\/\/www.osto.one\/resources\/glossary\/business-associate\/\">business associate<\/a> agreement, in addition to the Security Rule’s safeguard requirements.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>The HIPAA Privacy Rule Explained: PHI, Rights, and Uses | Osto The HIPAA Privacy Rule sets the ground rules for\u2026<\/p>\n","protected":false},"author":8,"featured_media":872,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[332,354],"class_list":["post-871","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-hipaa-privacy-rule","tag-what-is-the-hipaa-privacy-rule"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/871","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=871"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/871\/revisions"}],"predecessor-version":[{"id":873,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/871\/revisions\/873"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/872"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=871"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=871"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=871"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":871,"date":"2026-08-17T06:23:25","date_gmt":"2026-08-17T06:23:25","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=871"},"modified":"2026-08-17T06:23:25","modified_gmt":"2026-08-17T06:23:25","slug":"hipaa-privacy-rule-explained","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/hipaa-privacy-rule-explained\/","title":{"rendered":"The HIPAA Privacy Rule Explained: PHI, Rights, and Uses"},"content":{"rendered":"\n\n\n\n\n\nThe HIPAA Privacy Rule Explained: PHI, Rights, and Uses | Osto<\/title>\n<meta name=\"description\" content=\"The HIPAA Privacy Rule explained: what PHI it protects, how it can be used and disclosed, patient rights, and the minimum necessary standard.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">The HIPAA Privacy Rule sets the ground rules for how health information can be used and shared, and what rights people have over it. Here is what it means in practice.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>7 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>The Privacy Rule governs how protected health information may be used and disclosed, in any form. It permits core uses like treatment and payment without separate authorisation, but restricts most other sharing.<\/p>\n <p>It also grants individuals rights over their health data, access, amendment, and more, and requires the minimum necessary standard: limiting PHI use and sharing to what the task actually needs. It is the privacy counterpart to the Security Rule’s technical focus.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What the Privacy Rule is<\/a><\/li>\n <li><a href=\"#uses\">Permitted uses and disclosures<\/a><\/li>\n <li><a href=\"#rights\">Patient rights<\/a><\/li>\n <li><a href=\"#minimum\">The minimum necessary standard<\/a><\/li>\n <li><a href=\"#vs\">Privacy Rule vs Security Rule<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What is the HIPAA Privacy Rule?<\/h2>\n <p>The Privacy Rule is the part of HIPAA that sets national standards for protecting <a href=\"https:\/\/www.osto.one\/resources\/glossary\/protected-health-information\/\">protected health information<\/a>. Where the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/hipaa-security-rule\/\">Security Rule<\/a> is technical and focused on electronic data, the Privacy Rule is broader: it governs how PHI in any form, spoken, written, or electronic, may be used within an organisation and disclosed outside it. In short, it answers the question: who is allowed to see or share this health information, and under what conditions?<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The core principle<\/div>PHI belongs, in a meaningful sense, to the individual. The Privacy Rule limits how it can be used and shared without the person’s involvement, and gives them rights to see and influence what happens to it.<\/div>\n\n <h2 class=\"sec\" id=\"uses\">Permitted uses and disclosures<\/h2>\n <p>The Privacy Rule does not block all sharing, that would make healthcare impossible. It permits certain core uses without needing separate patient authorisation, most importantly treatment, payment, and healthcare operations. Beyond those, most other uses and disclosures require the individual’s authorisation, with specific exceptions defined in the rule.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">The practical line<\/div>Treatment, payment, and healthcare operations are generally permitted without separate authorisation. Marketing, sale of PHI, and most other secondary uses are not, they need explicit authorisation. When in doubt, the default is to restrict.<\/div>\n\n <h2 class=\"sec\" id=\"rights\">The rights the Privacy Rule gives patients<\/h2>\n <p>A defining feature of the Privacy Rule is the set of rights it grants individuals over their own health information. If you handle PHI, you must be able to honour these.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">Patient rights<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">What the Privacy Rule gives individuals<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">The rule grants people meaningful control over their own health information, and obliges you to honour it.<\/div>\n <svg viewBox=\"0 0 700 190\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Patient rights under the HIPAA Privacy Rule\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <g>\n <rect x=\"20\" y=\"20\" width=\"200\" height=\"70\" rx=\"12\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"120\" y=\"50\" text-anchor=\"middle\" fill=\"#2b3596\" font-size=\"13\" font-weight=\"800\">Access<\/text>\n <text x=\"120\" y=\"70\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">get a copy of their records<\/text>\n <rect x=\"250\" y=\"20\" width=\"200\" height=\"70\" rx=\"12\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"350\" y=\"50\" text-anchor=\"middle\" fill=\"#2b3596\" font-size=\"13\" font-weight=\"800\">Amendment<\/text>\n <text x=\"350\" y=\"70\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">correct inaccurate records<\/text>\n <rect x=\"480\" y=\"20\" width=\"200\" height=\"70\" rx=\"12\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.5\"\/>\n <text x=\"580\" y=\"50\" text-anchor=\"middle\" fill=\"#2b3596\" font-size=\"13\" font-weight=\"800\">Accounting<\/text>\n <text x=\"580\" y=\"70\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">see who it was disclosed to<\/text>\n <rect x=\"135\" y=\"105\" width=\"200\" height=\"70\" rx=\"12\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.5\"\/>\n <text x=\"235\" y=\"135\" text-anchor=\"middle\" fill=\"#0a7d6c\" font-size=\"13\" font-weight=\"800\">Restriction<\/text>\n <text x=\"235\" y=\"155\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">request limits on use<\/text>\n <rect x=\"365\" y=\"105\" width=\"200\" height=\"70\" rx=\"12\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.5\"\/>\n <text x=\"465\" y=\"135\" text-anchor=\"middle\" fill=\"#0a7d6c\" font-size=\"13\" font-weight=\"800\">Confidential contact<\/text>\n <text x=\"465\" y=\"155\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10.5\">choose how they are reached<\/text>\n <\/g>\n<\/g><\/svg>\n \n<\/div>\n\n <p>People can access and get copies of their records, request corrections, ask for an accounting of certain disclosures, request restrictions on use, and ask to be contacted confidentially. Building systems that can actually fulfil these requests is part of Privacy Rule compliance, not an optional extra.<\/p>\n\n <h2 class=\"sec\" id=\"minimum\">The minimum necessary standard<\/h2>\n <p>One of the rule’s most practical requirements is the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/minimum-necessary-standard\/\">minimum necessary<\/a> standard: when using or disclosing PHI, you must limit it to the minimum needed to accomplish the purpose. An employee should see only the health data their role requires; a disclosure should include only the relevant records. For a software company, this translates directly into access controls and role-based permissions.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Where privacy meets engineering<\/div>The minimum necessary standard is a privacy principle with a technical answer: granular access control. Limiting who can see which PHI, and logging it, is how you operationalise a Privacy Rule requirement in a real system.<\/div>\n\n <h2 class=\"sec\" id=\"vs\">Privacy Rule vs Security Rule<\/h2>\n <p>The two rules are complementary, not competing. The Privacy Rule governs the what and who of using and sharing PHI in any form. The Security Rule governs the how of protecting that data specifically in electronic form, through administrative, physical, and technical safeguards. You need both: privacy defines the rules of access, security enforces them technically.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to Privacy Rule compliance<\/h2>\n <p>Much of the Privacy Rule turns into concrete engineering: enforcing minimum necessary access, logging who viewed what, and being able to produce records when someone exercises their rights. Doing this across scattered systems is where access creeps beyond what is necessary and audit trails go missing.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. Access control and audit logging run on one platform, so you can enforce minimum necessary access, prove who saw which PHI, and support patient-rights requests, all mapped to HIPAA alongside 200+ other frameworks. That turns Privacy Rule principles into controls that actually operate, which is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Turn privacy principles into working controls.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Enforce minimum necessary access and log every view of PHI on one platform mapped to HIPAA. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is the HIPAA Privacy Rule?<\/summary><p>It is the part of HIPAA that sets standards for how protected health information may be used and disclosed, in any form. It permits core uses like treatment and payment without separate authorisation, restricts most other sharing, and grants individuals rights over their data.<\/p><\/details>\n <details><summary>What is the difference between the Privacy Rule and the Security Rule?<\/summary><p>The Privacy Rule governs how PHI in any form may be used and shared, and the rights people have over it. The Security Rule governs how electronic PHI is protected technically, through safeguards. They are complementary: privacy sets the rules, security enforces them.<\/p><\/details>\n <details><summary>What uses of PHI are allowed without authorisation?<\/summary><p>Chiefly treatment, payment, and healthcare operations. Most other uses and disclosures, such as marketing or sale of PHI, require the individual’s explicit authorisation, with limited exceptions defined in the rule.<\/p><\/details>\n <details><summary>What rights does the Privacy Rule give patients?<\/summary><p>Rights to access and obtain copies of their records, request amendments, receive an accounting of certain disclosures, request restrictions on use, and ask to be contacted confidentially. Organisations handling PHI must be able to honour these.<\/p><\/details>\n <details><summary>What is the minimum necessary standard?<\/summary><p>The requirement to limit PHI use and disclosure to the minimum needed for the purpose. In practice it means role-based access, so people see only the health data their job requires, enforced through access controls and logging.<\/p><\/details>\n <details><summary>Does the Privacy Rule apply to business associates?<\/summary><p>Yes. Business associates handling PHI on behalf of a covered entity are bound by applicable Privacy Rule provisions through their <a href=\"https:\/\/www.osto.one\/resources\/glossary\/business-associate\/\">business associate<\/a> agreement, in addition to the Security Rule’s safeguard requirements.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>The HIPAA Privacy Rule Explained: PHI, Rights, and Uses | Osto The HIPAA Privacy Rule sets the ground rules for\u2026<\/p>\n","protected":false},"author":8,"featured_media":872,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[332,354],"class_list":["post-871","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-hipaa-privacy-rule","tag-what-is-the-hipaa-privacy-rule"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/871","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=871"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/871\/revisions"}],"predecessor-version":[{"id":873,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/871\/revisions\/873"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/872"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=871"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=871"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=871"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}