The HIPAA Privacy Rule is a federal law. This federal law gives you rights regarding your health information and provides rules and limits on who can receive and look at your health information. The Privacy Rule is applicable to all types of an individuals’ protected health information, whether that information is electronic, oral, or written.

The HIPAA Security Rule, though also a federal law, is different from the HIPAA Privacy Rule. The HIPAA Security Rule requires security for health information specifically in electronic form.

If you believe that a covered entity has violated your health information privacy rights or committed another violation under the HIPAA Privacy, Security, and Breach Notification Rules or the Patient Safety Act and Rule, you may file a complaint with the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR). Here, the OCR can investigate complaints against relevant entities and their associates.

The following list includes some examples of covered entities that are required to meet the requirements of the federal Privacy, Security and Breach Notification Rules:
Health Plans
Health care clearinghouses
Health care providers that conduct a portion of their business electronically using a HIPAA covered transaction.