Tracker record · Federal · Final rule
HIPAA privacy, security, and breach requirements
The HIPAA Privacy, Security, and Breach Notification Rules govern covered entities and business associates: use and disclosure limits, administrative, physical, and technical safeguards, and breach notification to individuals, HHS, and in larger cases the media. Texas's Medical Records Privacy Act and SB 1188 layer state duties on top; the reproductive-health privacy rulemaking and its litigation are tracked as related records.
Status
- Legal status
- In effect (2024 reproductive-health amendments largely vacated June 18, 2025 (Purl); vacatur final after the September 10, 2025 dismissal of the intervenors' appeal)
- Allegation or finding
- Operative law
- Applicability
- Health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with a covered transaction (45 C.F.R. 160.103); and business associates performing functions or activities for a covered entity involving protected health information
- Enforceability
- Binding on parties within scope
- Law checked through
- October 12, 2026
- Primary-source pinpoint
- 45 C.F.R. parts 160, 164
- Citation
- 45 C.F.R. parts 160 and 164
- Source
- 45 C.F.R. parts 160, 164