HIPAA Key Rules and Permitted Disclosures
PHI may be used for treatment, payment and operations without authorization; most other uses need the patient's written authorization unless a specific exception applies.
Core rules
- Treatment, payment and health care operations (TPO): permitted without the patient's authorization (45 CFR 164.506).
- Minimum necessary: use, disclose or request only the minimum PHI needed. It does not apply to disclosures to a provider for treatment, disclosures to the patient, uses under an authorization, disclosures to HHS, or uses required by law (164.502(b)).
- Written authorization required for most uses of psychotherapy notes, for marketing, and for sale of PHI (164.508).
- Opportunity to agree or object (verbal is enough): facility directory listings and sharing with family or friends involved in the patient's care (164.510).
- A deceased person's PHI stays protected for 50 years after death (164.502(f)).
- HIPAA documentation (policies, notices, authorizations) must be kept 6 years from creation or last effective date (164.530(j)).
Status note (Oct 2026): the April 2024 HIPAA Privacy Rule to Support Reproductive Health Care Privacy (89 Fed. Reg. 32976) was vacated by the U.S. District Court for the Northern District of Texas on June 18, 2025 (Purl v. HHS, No. 2:24-cv-228, ECF 110), except some notice-of-privacy-practices changes to 164.520. Its provisions are not included here. Check for later changes before release.
Citations are to the 2024 CFR edition on govinfo.
Preview only. The full sheet also covers: Public-interest disclosures allowed without authorization (45 CFR 164.512); Patient rights and deadlines; Breach notification.
Sources
- 45 CFR 164.502: Uses and disclosures: general rules (personal representatives) · U.S. Government Publishing Office (govinfo), e-CFR text
- 45 CFR 164.506: Uses and disclosures to carry out treatment, payment, or health care operations · U.S. Government Publishing Office (govinfo), e-CFR text
- 45 CFR 164.508: Uses and disclosures for which an authorization is required (core elements, defects, revocation, copy to individual) · U.S. Government Publishing Office (govinfo), e-CFR text
- 45 CFR 164.510(b) Uses and disclosures for involvement in the individual's care (10-1-24 edition) · U.S. Government Publishing Office (govinfo)
- 45 CFR 164.512 Uses and disclosures for which an authorization or opportunity to agree or object is not required · U.S. Government Publishing Office (govinfo)
- 45 CFR 164.524 Access of individuals to protected health information, (c)(2) form and format (text re-read in the 10-1-25 edition on govinfo, identical to 10-1-24) · U.S. Government Publishing Office (govinfo)
- 45 CFR 164.526 Amendment of protected health information · U.S. Government Publishing Office (govinfo)
- 45 CFR 164.528 Accounting of disclosures of protected health information · U.S. Government Publishing Office (govinfo)
- 45 CFR 164.530: Administrative requirements (safeguards) · U.S. Government Publishing Office (govinfo), e-CFR text
- 45 CFR 164.404 Notification to individuals (breach) · U.S. Government Publishing Office (govinfo)
- 45 CFR 164.406 Notification to the media (breach) · U.S. Government Publishing Office (govinfo)
- 45 CFR 164.408 Notification to the Secretary (breach) · U.S. Government Publishing Office (govinfo)
- Purl v. U.S. Department of Health and Human Services, No. 2:24-cv-228-Z (N.D. Tex. June 18, 2025), Memorandum Opinion and Order, ECF No. 110 · U.S. District Court, N.D. Texas, via GovInfo