Privacy responsibilities United States

United States: HIPAA for covered entities

If your practice bills health plans electronically, you are almost certainly a HIPAA covered entity. That means a Notice of Privacy Practices for every patient, a business associate agreement with every vendor that handles protected health information, an ongoing risk analysis, trained staff, answers to access requests within 30 days, breach notices on the Rule’s timelines, and six years of documentation.

Last reviewed: November 2026 · For clinic owners, office managers and privacy officers

What you must do

Give patients your Notice of Privacy Practices.
Patients have a right to know how you use and share their information.
Give it at the first visit, make a good-faith effort to get a written acknowledgement, and record why if you could not. Post it in your office and on your website. HHS, Notice of Privacy Practices
Sign a business associate agreement with every vendor that handles PHI.
The agreement is what makes the vendor answerable to HIPAA.
Sign it before any protected health information moves. HHS, Business Associates
Run a risk analysis, and keep it current.
You cannot protect what you have not mapped.
Find where PHI lives and what could go wrong. The Security Rule sets no fixed schedule; review it whenever your systems change, and many practices do it every year. HHS, Guidance on risk analysis
Name a privacy official and a security official, and train your staff.
Many incidents start with a person, and so does good prevention.
One person can hold both roles in a small practice. Train every staff member and keep a record of the training. HHS, Security Rule
Give patients access to their records within 30 days.
Access is a right, and the clock is set by the Rule.
You can extend once, by up to 30 more days, if you tell the patient in writing why and when you will finish. 45 CFR 164.524
Follow the Breach Notification Rule.
Notice lets patients protect themselves.
Notify affected individuals without unreasonable delay and within 60 days of discovery. Report to HHS: within 60 days for 500 or more people, or within 60 days after the end of the year for smaller breaches. Notify the media when more than 500 residents of a state or jurisdiction are affected. HHS, Breach Notification Rule
Keep HIPAA documentation for six years.
Policies, training and assessments are your evidence.
Keep them for six years from when they were created or last in effect, whichever is later. 45 CFR 164.316
Follow your state’s medical-record retention rules.
HIPAA does not set how long to keep the medical record itself.
Your state law and licensing board set that period. Check both.

Why it matters

Your risk analysis, your business associate agreements and your training records are the documents an investigator asks to see. A small practice can put all three in order in a few weeks, and keep them current from there.

Common mistakes

Using a vendor that will not sign a business associate agreement.
Treating the risk analysis as a one-time project.
Handing out the Notice of Privacy Practices without recording the acknowledgement.
Calling a product “HIPAA certified”, when no such certification exists.

How PulseAI helps

We sign a Business Associate Agreement (BAA) with every US clinic before any data is shared.
US clinics run in a separate setup, stored and processed in the United States only.
Safeguards that meet the HIPAA Security Rule, and we use only the minimum information needed.
If a breach ever happens, we tell you without delay, as the law requires.

See how we protect your data on the Trust Center.

Questions, answered

Do I need a signed acknowledgement of my Notice of Privacy Practices?

You must make a good-faith effort to get one at the first visit. If the patient will not sign, record your attempt and the reason.

How often do I need a HIPAA risk analysis?

The Security Rule leaves the schedule to you and expects an ongoing process: review it whenever your systems change. Many practices review it every year.

How long do I have to answer an access request?

30 days, with one extension of up to 30 more days if you tell the patient in writing why.

When must I notify the media of a breach?

When a breach affects more than 500 residents of a state or jurisdiction, within 60 days of discovery.

Is there a HIPAA certification?

No. HHS does not certify products or vendors. Ask a vendor for a business associate agreement and how it meets the Security Rule.

Your next step

Give every patient a clear privacy statement, and keep their acknowledgement on file.

Download the free patient privacy templates

Comparing vendors? Request our security package.

This page explains common obligations in plain language. It isn’t legal advice. Check with your privacy officer or lawyer for your situation.

Official sources

Your privacy responsibilities: the other pages

OntarioDuties of a health information custodian.
QuébecLaw 25 and the health information act.
Rest of CanadaPIPEDA and provincial health acts.
Working with vendorsBAAs and service agreements.
Using AI with patient dataFive plain rules.
If something goes wrongBreach basics, and who to tell.
Patient privacy templatesFree statements and acknowledgements.

How we protect your patients’ information is on our Trust Center.