HIPAA Privacy Rule vs. Security Rule Key Differences for Healthcare Providers

November 10, 2026

A biller in the medical billing company is working on denied claims. She picks one claim, gathers the medical notes, and uploads them through the practice’s secure portal. The upload works fine. An hour later, she sees a problem. She picked the wrong payer from the list. Now the patient’s records are with an insurance company that has nothing to do with this patient.

No one hacked the system. The file was encrypted the whole time. But the records still went to the wrong place. That is mainly a privacy problem, not a security problem.

This simple mistake shows why HIPAA has two different rules. Many people think of HIPAA as one big rule, and staff training often mixes privacy and security together. But an office can have strong passwords and still send a chart to the wrong insurer. The opposite also happens. Some offices have careful staff who never share too much, but their computers have not been updated in years.

What's the difference between the HIPAA Privacy Rule and Security Rule?

We convey it to new billers in a simple manner. The Privacy Rule is about who can look at a patient’s information and why. It also grants patients rights, such as the right to obtain copies of their medical records. The Security Rule is concerned with protecting electronic patient data. It ensures the data is secure, isn’t modified by the wrong person and is available when personnel need it.”

Paper records confuse many people. The Privacy Rule covers patient information in every form, including paper and spoken words. The Security Rule only covers electronic information, which is called ePHI. So a printed statement on the front desk falls under the Privacy Rule only. A balance read to a patient over the phone is the same. But a claim file in your billing system is electronic, so both rules apply to it. To learn more about billing compliance, read our guide to HIPAA compliance in Medical billing.

HIPAA Privacy Rule vs. Security Rule at a glance

	Privacy Rule	Security Rule
What it covers	Patient information on paper, on computers, and in conversations	Electronic patient information only
Main goal	Decides who can use or share information, and protects patient rights	Keeps electronic information and systems safe
Question staff ask	Can we share this for this reason?	How do we stop it from being seen, changed, lost, or deleted?
Common tasks	Answering record requests, following sharing rules	Controlling logins, checking risks, planning for outages
Who is in charge	A privacy official	A security official
Staff training	Training on privacy rules	Training on security awareness
Records to keep	Kept for six years	Kept for six years
Billing example	Choosing which records to send for an appeal	Protecting those records during upload

In many small practices, one person handles both jobs. This is often the practice manager. That is fine, as long as the person knows they are in charge of both.

What the Privacy Rule means for your practice

Most privacy decisions happen quickly. The person holding the record often decides in a few seconds. Someone calls the front desk and asks about a patient’s balance. A biller needs medical notes to appeal a denial. A patient sends an email asking for a list of everything they paid this year. In each case, someone must decide if the reason is allowed. They must also decide how much information to share.

The Privacy Rule also asks for basic safety steps. For example, staff should not leave a printed list of patient accounts on the counter. The office should also have a way to handle complaints. So privacy is much more than signing consent forms.

Patient rights are part of privacy compliance

Patients have several rights under the Privacy Rule. They can ask to see and copy their records. They can ask you to fix mistakes in their records. They can ask for a list of certain times their information was shared. They can ask you to limit how their information is used. They can also ask you to send bills to a different address, like their work address. You can say no to most requests to limit information. But there is one important exception. Sometimes a patient pays the full bill out of their own pocket. Then they ask you not to tell their health plan about that visit. In this case, you usually have to agree, unless a law requires you to share it.

Patients usually have the right to get their medical and billing records, with some limited exceptions. An unpaid bill is not a reason to refuse. You usually have 30 calendar days to respond. This time limit may get shorter in the future. HHS planned a proposal on response times for November 2026. An older proposal from 2021 would have cut the time to 15 days.So your office should handle record requests separately from billing disputes. Also, patients do not use legal words. A patient may just say, “Can you send me everything showing what I paid last year?” Your staff should know this is a records request. Sending another bill is not enough.

What the Security Rule means for your practice

The Privacy Rule is about who can see information. The Security Rule is about keeping electronic information safe and usable. HHS describes three main goals:

Confidentiality: people without permission cannot see the data.
Integrity: no one changes or deletes the data without permission.
Availability: your team can get to the data when they need it.
All three goals matter in billing. Suppose someone changes a charge without permission. That is an integrity problem. Now suppose the billing system stops working for two days at the end of the month, and no one can find claim documents. That is an availability problem, and it can slow down payments for a week.

Administrative, physical, and technical safeguards

The security rules follow three types of protocols. These are administrative protections, planing and training on the changing rules and regulations. Physical safeguards include protecting the building and the things inside it. Not only that, but technical data protection is also considered a mandatory part.

Think about a biller who works from home. A secure connection helps. But it does not show if family members use the same laptop. It also does not show where downloaded reports are saved. Your risk assessment and policies should answer these questions.

How both rules apply to everyday billing

✓ Sending records for a denial appeal

Before you upload anything, check a few basic things. Is the request real? Is this the correct patient account? Who will receive the records? What does this appeal actually need?Next, think about how you send the records. Use an approved system. Check who can open the file on the other side. Make sure you can prove later what you sent and where.Both steps are important. Sending an encrypted file to the wrong payer is still a privacy problem. Sending the right file by regular email is still a security problem.

Now think back to the example at the start. The practice should investigate the wrong upload, save the evidence, and follow its incident plan. It should also find out why the system made it so easy to pick the wrong payer. If it does not fix that, the same mistake may happen again.

✓ Printing and mailing a statement

The statement in your billing software is ePHI. When you print it, it’s paper PHI. It’s still covered by the Privacy Rule therefore it has to be put in the right envelope. It shouldn’t be sitting in an open tray all day. The electronic copy and the system are still protected under the Security Rule. However, the paper version is not covered.

To learn more, read what counts as PHI in medical billing.

✓ Reviewing a downloaded A/R report

A practice manager may download an aging report to check old unpaid accounts. This is normal. But where does the report go next? It may get saved on a personal laptop or a personal cloud account. Then even an authorized person has created a risk. It is easier to decide where reports should be saved before anyone downloads them.

✓ Handling a billing system outage

When the billing system is down, people tend to do fast repairs. Staff are unable to view balances or prepare appeals. Perhaps someone starts logging work in a spreadsheet. Soon patient data will be stored in places where no one intended it to be. Prepare for outages in advance. How will personnel be given vital information? Record temporary work. Also make sure more than one person knows where the working backup is kept.

Where the two rules overlap

» Permission and minimum necessary are different questions

HIPAA allows you to use and share patient information for payment. You do not need extra permission from the patient. This tells you that a billing task is allowed. However, it does not reveal how much information you will need to perform the task. Well, that is another part. Where the minimum necessary rules apply, and people look at what their job requires. For instance, a payment poster does not need the same access as a coder. For more information, please do check our HIPAA compliance guide where we have explained everything in detail.

» Risk analysis must cover more than the EHR

Many practices protect their EHR well. But patient data also sits in spreadsheets, scanned files, shared email inboxes, and old vendor connections. The Security Rule says your risk analysis must cover all electronic patient information. That includes data you create, receive, store, or send. Here is a simple test. Pick one electronic appeal. Ask where each version was saved, from the first draft to the payer’s confirmation. You may get different answers from different people.

» Encryption protects the file, not the decision

Under the current Security Rule, encryption is “addressable.” Many people think this means optional. It does not. You must decide if encryption is reasonable for your practice. If it is, you must use it. If it is not, you must write down why and explain what you use instead. Also remember that encryption only protects the file. It cannot stop someone from sending the file to the wrong person.HHS has a proposed update to the Security Rule, but it is still only a proposal. HHS moved its target date to July 2027. For now, the current rule still applies.

» Outsourcing does not remove your duties

An outside billing company that handles patient information is usually a business associate. It is directly responsible under the Security Rule and parts of the Privacy Rule. But your practice still has its own duties too. Choosing a company is a hard nut to crack. You can ask every billing partner about their workflow. Ask how your staff would send an appeal file. Also ask them who would be taking responsibility if the file goes missing. Plus, also inquire about the software usage.

» The Breach Notification Rule works with both

A privacy problem or a security problem can lead to a breach review. HIPAA generally treats an improper use or sharing of patient information as a breach. This is true unless an exception applies or a written review shows a low chance that the information was compromised. A blocked login attempt is usually not a breach. But a paper statement mailed to the wrong patient can be a breach, even with no hacking at all. Staff should report anything unusual right away. Then your privacy and security leaders should decide what to do. HHS breach guidance has more details.

A simple review you can do this month

Select a workflow such as record requests or appeals. Spend 20 minutes with the people who do this. Ask who can get the information and how they decide how much to send. Ask where electronic copies are kept. What happens if the typical procedure breaks down?

Problems often happen when work passes from one person to another. For example, the billing team may think the practice handles patient requests, while the practice thinks the billing company handles them. Or an employee leaves, and their EHR login is turned off on their last day. But their payer portal login keeps working for six more months. Give each task a clear owner. Then write down the process where staff can easily find it.

Put both rules into the same workflow

Your billing staff should never have to guess. They should know what they can share and the safe way to send it. And if something goes wrong, they should know who to call.

Streamline Your Compliance with Swift Billing Solutions

Swift Billing Solutions handles billing for independent practices at a flat 3% of collections. There are no setup fees and no long-term contracts. Want a second opinion? Choose one of your real workflows, such as an appeal or a records request. We will walk through it with you and show you where each rule applies and who owns each step. Contact Swift Billing Solutions to get started.

Frequently asked questions

Does the Privacy Rule apply to electronic records?

Yes. Electronic patient information is covered by both the Privacy Rule and the Security Rule.

Does the Security Rule apply to paper records?

No. HHS clearly says the Security Rule does not cover paper records or spoken information. However, the Privacy Rule still covers them.

Is security compliance only an IT job?

No. IT handles a big part of it, but staff habits also matter. So do office access, vendor contracts, and written procedures.

Is an insurance ID number PHI?

On a patient account or claim, treat it as PHI. Health plan beneficiary numbers are on the list of 18 identifiers.

Does printing a record remove HIPAA protection?

No. The printed copy is still protected by the Privacy Rule. The electronic copy still needs Security Rule protection.

Can a practice follow one rule and still break the other?

Yes. A practice can have strong encryption and still send records to the wrong person. It can also have good sharing policies but weak computer security.

Who enforces the Privacy and Security Rules?

The HHS Office for Civil Rights enforces both rules. To learn about penalties, see what a violation can cost in our HIPAA compliance guide.

Recent Blogs