Overview
EnactedHIPAA signed August 21, 1996. The Privacy Rule was published December 28, 2000, with compliance required by April 14, 2003 (April 14, 2004 for small health plans).
Primary citation45 CFR Parts 160 and 164, Subparts A and E
Official titleStandards for Privacy of Individually Identifiable Health Information
Who must complyCovered entities — health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with a covered transaction — plus their business associates.
Who enforces itHHS Office for Civil Rights (OCR)
Related rulesSecurity Rule (45 CFR Part 164 Subpart C), Breach Notification Rule (45 CFR Part 164 Subpart D), and the Enforcement Rule (45 CFR Part 160 Subparts C–E).
