HIPAA role guide
Privacy Officer HIPAA Guide
Navigate permitted uses, patient access rights, and minimum necessary standards while organizing training and policy updates.
Reviewed August 2026
Learn → Assess → Remediate
Sources and limitations
Source types include regulation, official guidance, NIST and CISA materials, and clearly labeled HIPAAmart implementation notes. This educational starting point is not legal advice, a risk determination, an audit opinion, or a certification of compliance.
Available guidance
- HIPAA Privacy Rule
Understand how the Privacy Rule protects individually identifiable health information and gives people meaningful rights over their records.
- HIPAA Security Rule
A practical guide to the administrative, physical, and technical safeguards used to protect electronic protected health information.
- Breach Notification Rule
Know when an impermissible use or disclosure may be a breach, who must be notified, and what documentation supports the decision.
- Protected Health Information
A plain-English starting point for recognizing PHI, understanding identifiers, and separating HIPAA analysis from broader privacy questions.
- HIPAA Overview
A map of the HIPAA rules, the organizations they reach, and the operational work that turns obligations into evidence.
- Covered Entities
How to analyze whether an organization is a health plan, health care clearinghouse, or covered health care provider under HIPAA.
- Electronic Protected Health Information
A working guide to ePHI, the electronic form of protected health information that the Security Rule safeguards.
- Minimum Necessary Standard
How to limit many uses, disclosures, and requests for PHI to what is reasonably needed for the intended purpose.
- HIPAA Enforcement Rule
What enforcement authority can examine, investigate, and resolve alleged HIPAA violations—and how organizations can prepare.
- HIPAA Incident Response
Build an incident process that connects security containment, privacy analysis, breach decisions, communications, and evidence.