Patient privacy and scope

How your working relationship changes the rules

Hired directly by a patient or caregiver

Receiving records from a patient does not, by itself, make you a HIPAA covered entity or business associate. A provider still needs a lawful basis to disclose information to you. Patient authorization, access rights or another permitted disclosure may apply. Check state privacy law, contracts and professional duties even when HIPAA does not directly govern your practice.

Working as a hospital or health-plan employee

Follow the organization’s workforce policies, assigned access and training. Access only the records needed for your role; being able to open a record does not mean you are allowed to do so. Do not move information into a personal account or outside tool without approval.

Contracting for a covered entity or business associate

If your services involve creating, receiving, maintaining or transmitting protected health information on its behalf, you may be a business associate or subcontractor business associate. Where required, execute a business associate agreement (BAA) before the work begins. HIPAA duties can arise from the relationship even if nobody has signed the agreement.

What counts as patient data?

Protected health information (PHI) is individually identifiable information about health, care or payment that is held or transmitted by a covered entity or business associate, subject to exceptions. Electronic PHI (ePHI) is that information in electronic form. Not every piece of health information everywhere is regulated by HIPAA, but sensitive information still deserves protection.

• Medical records, diagnoses, prescriptions, appointment histories and care plans linked to a person.
• Bills, claims, explanation-of-benefits statements and insurance member numbers.
• Emails, texts, photos, recordings, filenames and calendar entries that reveal a person’s care.
• Combinations of dates, locations and rare conditions that identify someone even after a name is removed.

Permission to help is not unlimited permission to share

Document who the client is, the purpose of your work, what information you need and who may receive it. Confirm a caregiver’s authority rather than assuming that family relationship grants access. A HIPAA authorization is different from a service agreement and from legal authority to make decisions. Follow the provider’s release process and any restrictions or revocation.

A personal representative’s authority depends on applicable law and the scope of that authority. Helping someone communicate does not automatically make you their personal representative. Special rules may apply to minors, psychotherapy notes and substance-use-disorder records protected by 42 CFR Part 2.

For covered entities and business associates, the HIPAA minimum-necessary rule generally limits many uses, disclosures and requests; exceptions include disclosures to or requests by a healthcare provider for treatment, disclosures to the individual, and disclosures under a valid authorization. As a practice habit, limit every collection and disclosure to what the task actually needs.

A practical patient-data workflow

1. Map the information. List where records arrive, who sees them and where copies, exports and backups go. Include paper, mobile devices and vendors.
2. Choose approved systems. Assess risks and permitted uses before storing records. Where required, obtain BAAs from service providers and relevant subcontractors. Encryption or a BAA alone does not establish compliance.
3. Control access. Use individual accounts, least-privilege permissions, strong authentication, prompt access removal and appropriate logs. Avoid shared passwords.
4. Protect devices and messages. Use encryption where appropriate, screen locks, updates and secure backups. Verify recipients and attachments before sending. Email is not categorically prohibited by HIPAA; safeguards and any applicable patient-request process matter. Do not assume ordinary texting or a consumer app is suitable.
5. Keep records out of public spaces. Do not put identifiable case details in public profiles, marketplace briefs, testimonials, open AI tools or training examples. Check permissions and vendor terms before any automated processing.
6. Document disclosures and permissions. Record what was shared, with whom, why and when. Follow your applicable policies and legal requirements; not every sharing log is a HIPAA accounting of disclosures.
7. Set retention and disposal rules. HIPAA generally requires specified compliance documentation to be retained for six years, not all patient records for a universal six-year period. State law, contracts and other obligations can set different record-retention periods. Securely dispose of paper and electronic copies when allowed.
8. Prepare for incidents. Establish who handles misdirected messages, lost devices and unauthorized access. Contain the issue, preserve evidence, assess required notifications and follow applicable deadlines and contracts.

If information is exposed

Under the HIPAA Breach Notification Rule, a business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 days after discovery; contracts may require faster reporting. Covered entities have separate individual, HHS and sometimes media notification duties. Not every security incident is a reportable breach—apply the required assessment with qualified help, and check other laws even when HIPAA does not apply.

Sharing a case study safely

Removing a name is not HIPAA de-identification. The rule provides Safe Harbor and Expert Determination methods with specific requirements. Use fictional practice scenarios where possible and label them clearly. For real cases, obtain appropriate permissions and privacy review; an authorization for care coordination does not automatically permit public promotion.

Scope and referral

Advocates can help patients prepare questions and organize action. Clinical judgment, legal representation and regulated financial/insurance activity require the appropriate authority. Use referral and escalation paths. Patient choice, consent and culturally respectful communication guide the work.

Official guidance

• HHS: business associates and BAAs (opens in a new tab)
• HHS: Security Rule safeguards and risk analysis (opens in a new tab)
• HHS: minimum necessary and exceptions (opens in a new tab)
• HHS: breach notification (opens in a new tab)
• HHS: de-identification methods (opens in a new tab)

Sources checked November 14, 2026. Rules change — confirm with the official source before acting.

Educational guidance, not legal advice or a determination of your HIPAA status. Review your actual services, contracts and state requirements with a qualified privacy professional.

Patient information does not belong in PARC

PARC has no patient-record exchange, uploads or visitor accounts. Its corrections form sends editorial feedback to private Lovable Cloud storage for team review; never include patient details. Anonymous saved lists and checklist progress are stored in your browser. External AMME product links open separate sites with their own data practices. Fonts are loaded from Google, which receives the connection’s technical information.

On the published site, Lovable’s visitor analytics records pages visited, where visitors came from, country, browser, operating system, device type, time on page, page speed and errors for every visitor. It uses no cookies, stores nothing on your device, does not keep IP addresses and does not identify visitors. Detailed data is kept for 90 days and daily summaries for a year. Lovable collects this data for us. Lovable’s privacy policy (opens in a new tab) explains how it handles it. The editor preview is not counted.

PARC privacy notice