HIPAA Privacy Rule vs. Security Rule Key Differences for Healthcare Providers

November 10, 2026

A biller in the medical billing company is working on denied claims. She picks one claim, gathers the medical notes, and uploads them through the practice’s secure portal. The upload works fine. An hour later, she sees a problem. She picked the wrong payer from the list. Now the patient’s records are with an insurance company that has nothing to do with this patient.

No one hacked the system. The file was encrypted the whole time. But the records still went to the wrong place. That is mainly a privacy problem, not a security problem.

This simple mistake shows why HIPAA has two different rules. Many people think of HIPAA as one big rule, and staff training often mixes privacy and security together. But an office can have strong passwords and still send a chart to the wrong insurer. The opposite also happens. Some offices have careful staff who never share too much, but their computers have not been updated in years.

What's the difference between the HIPAA Privacy Rule and Security Rule?

We convey it to new billers in a simple manner. The Privacy Rule is about who can look at a patient’s information and why. It also grants patients rights, such as the right to obtain copies of their medical records. The Security Rule is concerned with protecting electronic patient data. It ensures the data is secure, isn’t modified by the wrong person and is available when personnel need it.”

Paper records confuse many people. The Privacy Rule covers patient information in every form, including paper and spoken words. The Security Rule only covers electronic information, which is called ePHI. So a printed statement on the front desk falls under the Privacy Rule only. A balance read to a patient over the phone is the same. But a claim file in your billing system is electronic, so both rules apply to it. To learn more about billing compliance, read our guide to HIPAA compliance in medical billing.

HIPAA Privacy Rule vs. Security Rule at a glance

	Privacy Rule	Security Rule
What it covers	Patient information on paper, on computers, and in conversations	Electronic patient information only
Main goal	Decides who can use or share information, and protects patient rights	Keeps electronic information and systems safe
Question staff ask	Can we share this for this reason?	How do we stop it from being seen, changed, lost, or deleted?
Common tasks	Answering record requests, following sharing rules	Controlling logins, checking risks, planning for outages
Who is in charge	A privacy official	A security official
Staff training	Training on privacy rules	Training on security awareness
Records to keep	Kept for six years	Kept for six years
Billing example	Choosing which records to send for an appeal	Protecting those records during upload

In many small practices, one person handles both jobs. This is often the practice manager. That is fine, as long as the person knows they are in charge of both.

What the Privacy Rule means for your practice

Most privacy decisions happen quickly. The person holding the record often decides in a few seconds. Someone calls the front desk and asks about a patient’s balance. A biller needs medical notes to appeal a denial. A patient sends an email asking for a list of everything they paid this year. In each case, someone must decide if the reason is allowed. They must also decide how much information to share.

The Privacy Rule also asks for basic safety steps. For example, staff should not leave a printed list of patient accounts on the counter. The office should also have a way to handle complaints. So privacy is much more than signing consent forms.

Patient rights are part of privacy compliance

Patients have several rights under the Privacy Rule. They can ask to see and copy their records. They can ask you to fix mistakes in their records. They can ask for a list of certain times their information was shared. They can ask you to limit how their information is used. They can also ask you to send bills to a different address, like their work address. You can say no to most requests to limit information. But there is one important exception. Sometimes a patient pays the full bill out of their own pocket. Then they ask you not to tell their health plan about that visit. In this case, you usually have to agree, unless a law requires you to share it.

Patients usually have the right to get their medical and billing records, with some limited exceptions. An unpaid bill is not a reason to refuse. You usually have 30 calendar days to respond. This time limit may get shorter in the future. HHS planned a proposal on response times for November 2026. An older proposal from 2021 would have cut the time to 15 days.

So your office should handle record requests separately from billing disputes. Also, patients do not use legal words. A patient may just say, “Can you send me everything showing what I paid last year?” Your staff should know this is a records request. Sending another bill is not enough.

What the Security Rule means for your practice

The Privacy Rule is about who can see information. The Security Rule is about keeping electronic information safe and usable. HHS describes three main goals:

Confidentiality: people without permission cannot see the data.
Integrity: no one changes or deletes the data without permission.
Availability: your team can get to the data when they need it.
All three goals matter in billing. Suppose someone changes a charge without permission. That is an integrity problem. Now suppose the billing system stops working for two days at the end of the month, and no one can find claim documents. That is an availability problem, and it can slow down payments for a week.

Administrative, physical, and technical safeguards

The security rules follow three types of protocols. These are administrative protections, planing and training on the changing rules and regulations. Physical safeguards include protecting the building and the things inside it. Not only that, but technical data protection is also considered a mandatory part.

Think about a biller who works from home. A secure connection helps. But it does not show if family members use the same laptop. It also does not show where downloaded reports are saved. Your risk assessment and policies should answer these questions.

How both rules apply to everyday billing

✓ Sending records for a denial appeal

Before you upload anything, check a few basic things. Is the request real? Is this the correct patient account? Who will receive the records? What does this appeal actually need?Next, think about how you send the records. Use an approved system. Check who can open the file on the other side. Make sure you can prove later what you sent and where.Both steps are important. Sending an encrypted file to the wrong payer is still a privacy problem. Sending the right file by regular email is still a security problem.

Now think back to the example at the start. The practice should investigate the wrong upload, save the evidence, and follow its incident plan. It should also find out why the system made it so easy to pick the wrong payer. If it does not fix that, the same mistake may happen again.

✓ Printing and mailing a statement

The statement in your billing software is ePHI. When you print it, it’s paper PHI. It’s still covered by the Privacy Rule therefore it has to be put in the right envelope. It shouldn’t be sitting in an open tray all day. The electronic copy and the system are still protected under the Security Rule. However, the paper version is not covered.

To learn more, read what counts as PHI in medical billing.

✓ Reviewing a downloaded A/R report

A practice manager may download an aging report to check old unpaid accounts. This is normal. But where does the report go next? It may get saved on a personal laptop or a personal cloud account. Then even an authorized person has created a risk. It is easier to decide where reports should be saved before anyone downloads them.

✓ Handling a billing system outage

When the billing system is down, people tend to do fast repairs. Staff are unable to view balances or prepare appeals. Perhaps someone starts logging work in a spreadsheet. Soon patient data will be stored in places where no one intended it to be. Prepare for outages in advance. How will personnel be given vital information? Record temporary work. Also make sure more than one person knows where the working backup is kept.

Recent Blogs

HIPAA Privacy Rule vs. Security Rule: Key Differences for Healthcare Providers