Skip to main content
—
Framework library
Framework module · hipaa-privacy-rule

HIPAA Privacy Rule

The federal rule governing permitted uses and disclosures of protected health information, minimum-necessary practices, notices, and individual privacy rights for covered entities and business associates.

45 CFR Part 160 and Part 164 Subparts A and E · HHS Office for Civil Rights

Standing today
Directory entry

00Answer

from the registry record
What is HIPAA Privacy Rule?
The federal rule governing permitted uses and disclosures of protected health information, minimum-necessary practices, notices, and individual privacy rights for covered entities and business associates.
Who does HIPAA Privacy Rule apply to?
HIPAA Privacy Rule applies to healthcare, US, per HHS Office for Civil Rights.
What is the current version of HIPAA Privacy Rule?
The current edition is 45 CFR Part 160 and Part 164 Subparts A and E, issued by HHS Office for Civil Rights. Source: https://www.hhs.gov/hipaa/for-professionals/privacy/index.html.
What does an assessment under HIPAA Privacy Rule require?
No control catalog has been ingested for HIPAA Privacy Rule yet — the registry tracks it as planned (Tracked metadata: we name the regime and monitor its issuing authority. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.

01Standing

Directory entry

Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.

HIPAA Privacy Rule is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.

Metadata only; the codified Privacy Rule has not been modelled as a requirement catalog.

Request this frameworkAuthority source (opens in a new tab)

02Registry record

checked 2026-08-28
Registry status
Planned · namedTracked metadata: we name the regime and monitor its issuing authority. No control or requirement model is implemented.
Control units
Not on record — no catalog ingested and no authority-published count cited.
Control families
Uses and disclosures · Minimum necessary · Individual rights · Notices and authorizations · Administrative requirements
Applies to
healthcare · US
Verification
Primary — the issuing body's own page was read and states this version. checked 2026-08-28

03Version ledger

1 edition
45 CFR Part 160 and Part 164 Subparts A and ECurrent editiondate not published

06Related frameworks

scored from registry facts
  1. HITRUST CSFv11.8.0

    Also applies to healthcare · A licensed cybersecurity and risk-management framework used across healthcare and other sectors. HITRUST offers scoped assessment and certification programs through its authorized processes; registry tracking claims no certification.

  2. HIPAA Security Rule45 CFR Part 164 Subparts A and C

    Also applies to healthcare · The federal safeguards standard for electronic protected health information, binding on covered entities and their business associates.

  3. HIPAA Breach Notification Rule45 CFR §§ 164.400–414

    Also applies to healthcare · What a covered entity or business associate must tell individuals, the media, and HHS after a breach of unsecured protected health information, and how fast.

  4. Colorado AI ActSB 26-189

    Also applies to healthcare · Colorado's AI law, rewritten. SB 26-189 repealed and reenacted the 2024 statute, dropping the high-risk-AI regime for narrower notice and disclosure duties on automated decision-making technology used in consequential decisions.

See control-level overlap in the Control Atlas
HIPAA Privacy Rule | ControlFrame