HIPAA Privacy Rule vs Security Rule: what each covers

By Sam Rivera, Founder, SentinelPanda · March 24, 2026 · 3 min read · HIPAA

Engineers tend to default to "the Security Rule" when they say HIPAA. Most procurement reviews and breach notifications start with the Privacy Rule. Knowing the difference matters.

Two rules, one act

HIPAA — the Health Insurance Portability and Accountability Act — created several regulations. Two of them dominate compliance work for technology vendors that touch healthcare data: the Privacy Rule (45 CFR Part 160 and Subparts A and E of Part 164) and the Security Rule (45 CFR Part 160 and Subparts A and C of Part 164). They share enforcement (the HHS Office for Civil Rights), enforcement penalties, and the same definitions of covered entity and business associate — but they regulate different things.

Privacy Rule — what you can do with PHI

The Privacy Rule governs how protected health information (PHI) may be used and disclosed by covered entities and their business associates. It applies to PHI in any form — paper, oral, or electronic. It defines patient rights (access, amendment, accounting of disclosures), the minimum-necessary standard, and the notice of privacy practices that covered entities must publish.

A typical Privacy Rule question: "Can we share this patient list with a third-party care coordinator without explicit consent?" The answer is in the Privacy Rule's permitted uses (treatment, payment, healthcare operations) and the contracts that govern the sharing.

Security Rule — how ePHI must be protected

The Security Rule governs the protection of electronic protected health information (ePHI) — PHI in electronic form. It defines administrative, physical, and technical safeguards organised into 18 standards, each with required and addressable implementation specifications.

A typical Security Rule question: "What logical access controls are required for the EHR system?" The answer is in the Security Rule's technical safeguards — access control, audit controls, integrity, person or entity authentication, transmission security.

For software vendors, the Security Rule is the rule that drives encryption choices, access provisioning workflows, audit logging, and incident response capacity. Most engineering effort labelled "HIPAA work" is Security Rule work.

How they relate

The Privacy Rule sets the policy — what PHI is, who may handle it, under what conditions, with what patient rights. The Security Rule sets the technical floor for the electronic subset of that PHI. A breach of unsecured ePHI implicates both: the Security Rule because protections failed, and the Privacy Rule because an unpermitted use or disclosure occurred.

The Breach Notification Rule (a third rule that bridges both) is what governs the timing, content, and audiences of breach notification once a breach has occurred — to affected individuals, to HHS, and in some cases to the media.

Business associates owe both

Originally, business associates owed Privacy Rule and Security Rule obligations primarily through their Business Associate Agreement with the covered entity. The HITECH Act and the 2013 Omnibus Rule changed that: business associates are directly liable to HHS for Security Rule violations and for many Privacy Rule violations, in addition to their contractual obligations under the BAA.

Practical implication: if you are a SaaS vendor processing ePHI for a covered entity, OCR can come after you directly. Treat HIPAA as your own regulatory obligation, not just a contract clause.

When each shows up in your work

• <strong>Engineering and SecOps</strong> — Security Rule. Encryption, access control, audit logs, transmission security, contingency planning.
• <strong>Product and legal</strong> — Privacy Rule. Permitted uses, patient rights, minimum necessary, notice of privacy practices.
• <strong>Incident response</strong> — both, plus the Breach Notification Rule for the post-incident notification timeline.
• <strong>Procurement / RFP responses</strong> — both, usually framed as "are you HIPAA compliant" with separate questions on safeguards (Security) and PHI handling (Privacy).