The Secretary's 1997 recommendations recognized the importance of balancing the privacy rights of individuals and the amount of control they have over the use and disclosure of their health information, with the need to permit health information to be used not just for routine health care activities (e.g., treatment and payment) but also for other purposes related to health care that are in the public interest (e.g., oversight, research, law enforcement, public health and safety). The standards are technology-neutral and scalable, based on the size and complexity of the organization. Congress addressed some of the concerns about the Privacy and Security Rules in the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009. An Overview of the HIPAA Privacy Standards

The HIPAA Privacy Rule established a set of federal standards for the protection of personal health information. First, it required covered entities (i.e., health plans, health care clearinghouses, and health care providers that conduct HIPAA electronic transactions) to put in place safeguards to protect health information from unauthorized access, use, or disclosure. Second, it described the circumstances under which covered entities are permitted to use or disclose an individual's health information. Those rights include the right of access to inspect and obtain a copy of their medical information, the right to amend inaccurate or incomplete information, and the right to an accounting of certain types of disclosures of the information. The Privacy Rule covers "protected health information" (PHI) that is created or received by a covered entity. General Requirements for Use and Disclosure

In the broadest sense, the Privacy Rule prohibits a covered entity from using or disclosing PHI except as expressly permitted or required by the rul e . The rule specifies only two circumstances when a covered entity is required to disclose PHI. The rest of the rule describes a wide range of circumstances under which it is permissible to use or disclose PHI. Thus, the Privacy Rule seeks to preserve the discretion that health care professionals have traditionally exercised when using or disclosing patient or beneficiary information. For all uses or disclosures of PHI that are not otherwise permitted or required by the rule, covered entities must obtain a patient's written authorization. A covered entity may use or disclose PHI for its own treatment, payment, or health care operations. Under certain other circumstances (e.g., disclosures to family members and friends, disclosures from public directories maintained by hospitals and other facilities, fundraising), the Privacy Rule requires covered entities to give the individual the opportunity to object to the disclosure (i.e., opt out). The rule also permits the use or disclosure of PHI for specified "national priority purposes" that are not directly connected to the treatment of the individual. That is the purpose of the Security Rule, under which each of the safeguards—administrative, physical, and technical—is composed of a number of standards. Implementation Specifications

Covered entities and business associates have considerable discretion and flexibility in how they implement the security standards. Each standard generally consists of one or more implementation specification (i.e., detailed instructions for implementing the standard) that are either "required" or "addressable." Many of the changes were enacted to address the concerns of privacy advocates and other stakeholders. Among its provisions, the HITECH Act (1) established four categories of violations of the rules to reflect increasing levels of culpability, and four corresponding tiers of CMPs that significantly increased the minimum penalty amount for each violation; (2) required HHS to investigate all complaints indicating violations due to willful neglect; (3) made business associates of covered entities—and their subcontractors—directly liable for violations of Privacy and Security Rules; and (4) required covered entities and their business associates to notify individuals whose PHI was breached.
The Privacy Rule, which was promulgated pursuant to the Health Insurance Portability and Accountability Act (HIPAA) of 1996, comprises a set of federal standards governing the use of personal health information. The Privacy Rule generally applies to individually identifiable health information created and maintained by payers and providers of health care, collectively referred to as covered entities. The rule establishes certain individual rights, including the right to inspect and obtain a copy of one's health information; describes the circumstances under which covered entities are permitted to use or disclose health information; and requires covered entities to put in place administrative, physical, and technical safeguards to protect health information from unauthorized access, use, or disclosure.
Broadly speaking, the Privacy Rule prohibits a covered entity from using or disclosing "protected health information" (PHI) except as expressly permitted or, in two instances, required by the rule. The Privacy Rule describes a wide range of circumstances under which it is permissible to use or disclose PHI. In so doing, the rule seeks to preserve the discretion that health care professionals have traditionally exercised when using or disclosing patient information. For all uses or disclosures of PHI that are not otherwise permitted or required by the rule, a covered entity must obtain a patient's written authorization.
Under the Privacy Rule, covered entities generally may use or disclose PHI for the purposes of treatment, payment, and other routine health care operations. Under certain other circumstances, the rule requires covered entities to give individuals the opportunity to object to the use or disclosure of their PHI. The rule also permits the use or disclosure of PHI for various specified activities not directly connected to treatment (e.g., research, law enforcement, public health).
The Privacy Rule does not specify the types of safeguards that need to be implemented to protect PHI from misuse. That is the purpose of the companion HIPAA Security Rule, under which each of the safeguards—administrative, physician, and technical—is composed of a number of standards. The security standards are designed to be scalable to the size and complexity of the covered entity, as well as technology-neutral. They include implementing security management policies and procedures, workforce security procedures, facility access controls, and controls on access to information technology (IT) systems. Each standard consists of one or more implementation specifications (i.e., detailed instructions for implementing the standard). Covered entities have considerable discretion and flexibility in how they implement the security standards.
The Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 included a series of modifications to the HIPAA privacy and security standards. Many of the changes were enacted to address the concerns of privacy advocates and other stakeholders. The HITECH Act created a notification requirement for breaches of unsecured (i.e., unencrypted) PHI, increased the civil monetary penalties for violating HIPAA, and expanded and strengthened enforcement activities by the Office for Civil Rights. It also made business associates of covered entities (i.e., companies and consultants with whom covered entities share PHI to help them operate) directly liable and subject to civil and criminal penalties for HIPAA violations.