HIPAA Rules: The 5 Main Rules Explained for Marketers

HIPAA's main rules are the Privacy Rule, the Security Rule, the Breach Notification Rule and the Enforcement Rule, and the 2013 Omnibus Rule modified all four, which is why most lists name five HIPAA rules (HHS; 78 FR 5566). HHS's own list of HIPAA regulations also includes standards for electronic transactions, code sets and identifiers. For a healthcare website, the Privacy Rule decides what may be shared with tracking vendors and the Security Rule how electronic PHI is protected. Curve Compliance strips PHI before data reaches an ad platform and signs a BAA on every plan.

Book a call. HHS says regulated entities must follow the HIPAA Rules when they use tracking technologies. Curve Compliance sends conversions to your ad platforms server-side, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup. Book a call with Curve.

The HIPAA rules in one table

HHS lists the HIPAA Administrative Simplification regulations as transactions and code set standards, identifier standards, and the Privacy, Security, Enforcement and Breach Notification Rules, found at 45 CFR Parts 160, 162 and 164 (HHS).

Rule	What it covers	Who must follow it	Where it lives	Source
Privacy Rule	How PHI in any form may be used and disclosed, and patients' rights over it	Covered entities and business associates	45 CFR Part 160 and Part 164, Subparts A and E	HHS
Security Rule	Administrative, physical and technical safeguards for electronic PHI	Covered entities and business associates	45 CFR Part 160 and Part 164, Subparts A and C	HHS
Breach Notification Rule	Notice to individuals, HHS and sometimes the media after a breach of unsecured PHI	Covered entities and business associates	45 CFR 164.400 to 164.414	HHS
Enforcement Rule	Compliance, investigations, civil money penalties and hearings	Applied by HHS to covered entities and business associates	45 CFR Part 160, Subparts C, D and E	HHS
Omnibus Rule (2013)	Modified the four rules above for the HITECH Act and GINA	Same as the rules it modified	78 FR 5566	Federal Register
Transactions, code sets and identifiers	Standard formats for electronic claims and other transactions	Covered entities	45 CFR Part 162	HHS

Where the rules come from: the HIPAA statute

The Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, was enacted on August 21, 1996 (Public Law 104-191). It has five titles:

• Title I. Health care access, portability and renewability.
• Title II. Preventing health care fraud and abuse; administrative simplification; medical liability reform.
• Title III. Tax-related health provisions.
• Title IV. Application and enforcement of group health plan requirements.
• Title V. Revenue offsets.

The privacy and security rules come from Title II, Subtitle F, "Administrative Simplification." Its stated purpose is to improve Medicare, Medicaid and the health care system "by encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information" (HIPAA, sec. 261). The HITECH Act, enacted in 2009, added provisions that strengthen those protections (HHS); see what the HITECH Act changed.

The Privacy Rule

The Privacy Rule protects individually identifiable health information "held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral," and calls it protected health information (PHI). HHS says "A major goal of the Privacy Rule is to assure that individuals' health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care" (HHS). See what PHI means.

Three parts matter most to marketers. Uses and disclosures need a permission in the rule or the patient's authorization; see treatment, payment and operations. HHS calls the minimum necessary principle "A central aspect of the Privacy Rule" (HHS); see minimum necessary and ad tracking. And "a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing," with narrow exceptions (45 CFR 164.508(a)(3)); see authorization and ad tracking.

The Security Rule

The Security Rule covers electronic PHI (ePHI) only: "Unlike the Privacy and Breach Notification Rules, the Security Rule does not apply to PHI that is maintained or transmitted on paper or verbally" (HHS). Covered entities and business associates must "Ensure the confidentiality, integrity, and availability of all electronic protected health information" they create, receive, maintain or transmit, protect against reasonably anticipated threats and impermissible uses or disclosures, and "Ensure compliance with this subpart by its workforce" (45 CFR 164.306).

Its standards fall into three groups of safeguards: administrative (45 CFR 164.308), physical (164.310) and technical (164.312) (eCFR). The administrative safeguards start with a risk analysis, "an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI" (HHS). See what ePHI is.

HHS proposed a major update, published January 6, 2025 (90 FR 898). It is still a proposal: HHS's agenda lists "Final Action 07/00/2027" (reginfo.gov), and HHS says "the current Security Rule remains in effect" (HHS). The 2026 HIPAA rules guide covers what it would change.

The Breach Notification Rule

A breach is, generally, "an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information." An impermissible use or disclosure "is presumed to be a breach" unless a risk assessment shows a low probability that the PHI has been compromised (HHS).

Notices to individuals "must be provided without unreasonable delay and in no case later than 60 days following the discovery of a breach." Breaches affecting 500 or more individuals go to HHS within the same 60 days, and a breach affecting more than 500 residents of a state or jurisdiction also needs notice to prominent media outlets there. A business associate must tell the covered entity "without unreasonable delay and no later than 60 days from the discovery of the breach" (HHS). See the breach notification guide.

The Enforcement Rule and penalty tiers

The Enforcement Rule "contains provisions relating to compliance and investigations, the imposition of civil money penalties for violations of the HIPAA Administrative Simplification Rules, and procedures for hearings" (HHS). HHS's Office for Civil Rights (OCR) "administers and enforces the HIPAA Rules" (HHS); see who enforces HIPAA.

Civil money penalties follow four tiers of culpability in 45 CFR 160.404(b)(2): the entity did not know and, by exercising reasonable diligence, would not have known; reasonable cause and not willful neglect; willful neglect corrected within 30 days; and willful neglect not corrected within 30 days (45 CFR 160.404). The amounts "will be updated annually and published at 45 CFR part 102" (45 CFR 160.404; 45 CFR 102.3). See the HIPAA marketing penalties reference table.

The Omnibus Rule

HHS published the Omnibus Rule on January 25, 2013, effective March 26, 2013. It modified the Privacy, Security and Enforcement Rules "to implement statutory amendments under the Health Information Technology for Economic and Clinical Health Act," updated the Breach Notification Rule after comments on its interim final rule, and strengthened protections for genetic information under the Genetic Information Nondiscrimination Act (GINA) (78 FR 5566).

It also finalized HITECH's changes for business associates. HHS says HITECH applies the Security Rule's safeguards "to business associates in the same manner that they apply to covered entities" and provides that "business associates are civilly and criminally liable for penalties for violations of these provisions" (HHS). See what a business associate is.

Which rules touch website tracking

All three main rules. HHS's tracking bulletin covers obligations "under the HIPAA Privacy, Security, and Breach Notification Rules" for regulated entities that use online tracking technologies (HHS):

• Privacy Rule. HHS says "tracking technology vendors are business associates if they create, receive, maintain, or transmit PHI on behalf of a regulated entity for a covered function," so disclosures to them must be permitted and covered by a business associate agreement (HHS).
• Security Rule. "OCR is prioritizing compliance with the HIPAA Security Rule in investigations into the use of online tracking technologies" (HHS).
• Breach Notification Rule. When PHI goes to a tracking vendor with no permission and no BAA, "there is a presumption that there has been a breach of unsecured PHI" unless the entity shows a low probability of compromise (HHS).

A June 20, 2024 court order vacated the part of the bulletin about unauthenticated public pages that connect an IP address to a visit about specific health conditions or providers (HHS; annotated bulletin). For what counts as PHI on a page, see what counts as PHI on a website. Your setup decides which rules apply, so talk to your counsel.

How Curve Compliance helps

Curve Compliance helps with the part of these rules that touches ad tracking. It replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what the platform accepted.

Curve signs a BAA on every plan, is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. Check your other vendors in the BAA Directory, and run the free website scan to see which trackers your site loads today.

Sources, checked October 26, 2026: HHS combined regulation text; Summary of the HIPAA Privacy Rule; Summary of the HIPAA Security Rule; HHS Breach Notification Rule; HHS Enforcement Rule; HHS covered entities; HHS online tracking guidance; HHS Security Rule NPRM; HHS regulatory initiatives; HHS Part 2 fact sheet; Public Law 104-191; 78 FR 5566; 90 FR 898; RIN 0945-AA22; 45 CFR 164.306; 45 CFR part 164, subpart C; 45 CFR 164.508; 45 CFR 160.404; 45 CFR 102.3.

Frequently Asked Questions

What are the 5 basic rules of HIPAA?

Most lists name the Privacy Rule, the Security Rule, the Breach Notification Rule, the Enforcement Rule and the 2013 Omnibus Rule, which modified the other four (HHS; 78 FR 5566). HHS's own list of HIPAA regulations also includes the transactions, code set and identifier standards.

What are the three main rules of HIPAA?

The Privacy Rule, the Security Rule and the Breach Notification Rule. HHS says "Together, the Privacy, Security, and Breach Notification Rules help to protect the privacy and security of protected health information (PHI)" (HHS).

What is the HIPAA Rule?

There is no single HIPAA Rule. HHS uses "HIPAA Rules" for the regulations at 45 CFR Parts 160, 162 and 164, chiefly the Privacy, Security, Breach Notification and Enforcement Rules (HHS; HHS).

What does the HIPAA security Rule require covered entities to do?

Ensure the confidentiality, integrity and availability of all ePHI they create, receive, maintain or transmit, protect against reasonably anticipated threats and impermissible uses or disclosures, and ensure workforce compliance, through administrative, physical and technical safeguards (45 CFR 164.306; HHS).

Who are the 3 primary covered entities under HIPAA?

Health plans, health care clearinghouses, and health care providers that transmit information electronically "in connection with a transaction for which HHS has adopted a standard" (HHS). See what a covered entity is.

What are the two main purposes of HIPAA?

The Act's title leads with two aims: "to improve portability and continuity of health insurance coverage in the group and individual markets" and "to combat waste, fraud, and abuse in health insurance and health care delivery." Its Administrative Simplification subtitle, the source of the Privacy and Security Rules, sets standards for the electronic transmission of certain health information (Public Law 104-191).

What are the three components of the HIPAA security Rule?

Administrative, physical and technical safeguards, which covered entities and business associates "must put in place to secure individuals' electronic protected health information" (HHS; eCFR).

What is the new HIPAA Rule in 2026?

No single rule: updated notices of privacy practices and the 42 CFR Part 2 alignment had to be in place by February 16, 2026, while the Security Rule update is still proposed (HHS; HHS; reginfo.gov). See the 2026 HIPAA rules guide.

Talk to Curve Compliance

Book a call. HIPAA's rules decide what your tracking may send. Curve Compliance sends conversions server-side, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.