Resource Library

For the average health care provider or health plan, the Privacy Rule requires activities, such as:

• Notifying patients about their privacy rights and how their information can be used.
• Adopting and implementing privacy procedures for its practice, hospital, or plan.
• Training employees so that they understand the privacy procedures. 
• Designating an individual to be responsible for seeing that the privacy procedures are adopted and followed.
• Securing patient records containing individually identifiable health information so that they are not readily available to those who do not need them.