The intent of the HIPAA Privacy Rule is to protect the privacy of patients seeking health care while simultaneously permitting important uses of health information.
The Privacy Rule limits the use and disclosure of PHI and establishes patient rights.
The Privacy Rule allows covered entities to analyze their own needs and to implement programs based on their own environment. However, it requires that all new privacy policies and procedures are compliant with the Privacy Rule and monitored at least annually.
The Privacy Rule also requires covered entities to develop processes to handle complaints. The covered entity must identify where individuals can submit complaints. They must advise that complaints can also be submitted to the Secretary of Health and Human Services (HHS), without fear of retaliation for submitting the complaint.
