--- title: "HIPAA full text" canonical: "https://dposchool.com/hipaa" source: "https://uscode.house.gov/us/usc/119-136/t42/s1320d/" source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-22" language: "en" publisher: "DPO School" --- # HIPAA Navigator The full text of Health Insurance Portability and Accountability Act of 1996, administrative simplification (42 U.S.C. 1320d to 1320d-9), with the privacy provisions of the HITECH Act (42 U.S.C. 17921 to 17953) and the HIPAA Privacy, Security and Breach Notification Rules (45 CFR parts 160 and 164): 128 sections, one page each. 42 U.S.C. 1320d to 1320d-9 (HIPAA, administrative simplification): United States Code, current through Public Law 119-136 (October 22, 2026). Retrieved 30 October 2026. [Official source](https://uscode.house.gov/us/usc/119-136/t42/s1320d/) 42 U.S.C. 17921 to 17953 (HITECH Act, privacy): United States Code, current through Public Law 119-136 (October 22, 2026). Retrieved 30 October 2026. [Official source](https://uscode.house.gov/us/usc/119-136/t42/s17921/) 45 CFR parts 160 and 164 (Privacy, Security and Breach Notification Rules): eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. [Official source](https://www.ecfr.gov/current/title-45/part-160) ## 42 U.S.C. 1320d to 1320d-9 (HIPAA, administrative simplification) ### Chapter 7: SOCIAL SECURITY - [42 U.S.C. 1320d Definitions](https://dposchool.com/hipaa/section/1320d) - [42 U.S.C. 1320d–1 General requirements for adoption of standards](https://dposchool.com/hipaa/section/1320d-1) - [42 U.S.C. 1320d–2 Standards for information transactions and data elements](https://dposchool.com/hipaa/section/1320d-2) - [42 U.S.C. 1320d–3 Timetables for adoption of standards](https://dposchool.com/hipaa/section/1320d-3) - [42 U.S.C. 1320d–4 Requirements](https://dposchool.com/hipaa/section/1320d-4) - [42 U.S.C. 1320d–5 General penalty for failure to comply with requirements and standards](https://dposchool.com/hipaa/section/1320d-5) - [42 U.S.C. 1320d–6 Wrongful disclosure of individually identifiable health information](https://dposchool.com/hipaa/section/1320d-6) - [42 U.S.C. 1320d–7 Effect on State law](https://dposchool.com/hipaa/section/1320d-7) - [42 U.S.C. 1320d–8 Processing payment transactions by financial institutions](https://dposchool.com/hipaa/section/1320d-8) - [42 U.S.C. 1320d–9 Application of HIPAA regulations to genetic information](https://dposchool.com/hipaa/section/1320d-9) ## 42 U.S.C. 17921 to 17953 (HITECH Act, privacy) ### Chapter 156: HEALTH INFORMATION TECHNOLOGY - [42 U.S.C. 17921 Definitions](https://dposchool.com/hipaa/section/17921) - [42 U.S.C. 17931 Application of security provisions and penalties to business associates of covered entities; annual guidance on security provisions](https://dposchool.com/hipaa/section/17931) - [42 U.S.C. 17932 Notification in the case of breach](https://dposchool.com/hipaa/section/17932) - [42 U.S.C. 17933 Education on health information privacy](https://dposchool.com/hipaa/section/17933) - [42 U.S.C. 17934 Application of privacy provisions and penalties to business associates of covered entities](https://dposchool.com/hipaa/section/17934) - [42 U.S.C. 17935 Restrictions on certain disclosures and sales of health information; accounting of certain protected health information disclosures; access to certain information in electronic format](https://dposchool.com/hipaa/section/17935) - [42 U.S.C. 17936 Conditions on certain contacts as part of health care operations](https://dposchool.com/hipaa/section/17936) - [42 U.S.C. 17937 Temporary breach notification requirement for vendors of personal health records and other non-HIPAA covered entities](https://dposchool.com/hipaa/section/17937) - [42 U.S.C. 17938 Business associate contracts required for certain entities](https://dposchool.com/hipaa/section/17938) - [42 U.S.C. 17939 Improved enforcement](https://dposchool.com/hipaa/section/17939) - [42 U.S.C. 17940 Audits](https://dposchool.com/hipaa/section/17940) - [42 U.S.C. 17941 Recognition of security practices](https://dposchool.com/hipaa/section/17941) - [42 U.S.C. 17951 Relationship to other laws](https://dposchool.com/hipaa/section/17951) - [42 U.S.C. 17952 Regulatory references](https://dposchool.com/hipaa/section/17952) - [42 U.S.C. 17953 Studies, reports, guidance](https://dposchool.com/hipaa/section/17953) ## 45 CFR parts 160 and 164 (Privacy, Security and Breach Notification Rules) ### Part 160: GENERAL ADMINISTRATIVE REQUIREMENTS #### Subpart A: General Provisions - [45 CFR 160.101 Statutory basis and purpose](https://dposchool.com/hipaa/section/160.101) - [45 CFR 160.102 Applicability](https://dposchool.com/hipaa/section/160.102) - [45 CFR 160.103 Definitions](https://dposchool.com/hipaa/section/160.103) - [45 CFR 160.104 Modifications](https://dposchool.com/hipaa/section/160.104) - [45 CFR 160.105 Compliance dates for implementation of new or modified standards and implementation specifications](https://dposchool.com/hipaa/section/160.105) #### Subpart B: Preemption of State Law - [45 CFR 160.201 Statutory basis](https://dposchool.com/hipaa/section/160.201) - [45 CFR 160.202 Definitions](https://dposchool.com/hipaa/section/160.202) - [45 CFR 160.203 General rule and exceptions](https://dposchool.com/hipaa/section/160.203) - [45 CFR 160.204 Process for requesting exception determinations](https://dposchool.com/hipaa/section/160.204) - [45 CFR 160.205 Duration of effectiveness of exception determinations](https://dposchool.com/hipaa/section/160.205) #### Subpart C: Compliance and Investigations - [45 CFR 160.300 Applicability](https://dposchool.com/hipaa/section/160.300) - [45 CFR 160.302 \[Reserved\]](https://dposchool.com/hipaa/section/160.302) - [45 CFR 160.304 Principles for achieving compliance](https://dposchool.com/hipaa/section/160.304) - [45 CFR 160.306 Complaints to the Secretary](https://dposchool.com/hipaa/section/160.306) - [45 CFR 160.308 Compliance reviews](https://dposchool.com/hipaa/section/160.308) - [45 CFR 160.310 Responsibilities of covered entities and business associates](https://dposchool.com/hipaa/section/160.310) - [45 CFR 160.312 Secretarial action regarding complaints and compliance reviews](https://dposchool.com/hipaa/section/160.312) - [45 CFR 160.314 Investigational subpoenas and inquiries](https://dposchool.com/hipaa/section/160.314) - [45 CFR 160.316 Refraining from intimidation or retaliation](https://dposchool.com/hipaa/section/160.316) #### Subpart D: Imposition of Civil Money Penalties - [45 CFR 160.400 Applicability](https://dposchool.com/hipaa/section/160.400) - [45 CFR 160.401 Definitions](https://dposchool.com/hipaa/section/160.401) - [45 CFR 160.402 Basis for a civil money penalty](https://dposchool.com/hipaa/section/160.402) - [45 CFR 160.404 Amount of a civil money penalty](https://dposchool.com/hipaa/section/160.404) - [45 CFR 160.406 Violations of an identical requirement or prohibition](https://dposchool.com/hipaa/section/160.406) - [45 CFR 160.408 Factors considered in determining the amount of a civil money penalty](https://dposchool.com/hipaa/section/160.408) - [45 CFR 160.410 Affirmative defenses](https://dposchool.com/hipaa/section/160.410) - [45 CFR 160.412 Waiver](https://dposchool.com/hipaa/section/160.412) - [45 CFR 160.414 Limitations](https://dposchool.com/hipaa/section/160.414) - [45 CFR 160.416 Authority to settle](https://dposchool.com/hipaa/section/160.416) - [45 CFR 160.418 Penalty not exclusive](https://dposchool.com/hipaa/section/160.418) - [45 CFR 160.420 Notice of proposed determination](https://dposchool.com/hipaa/section/160.420) - [45 CFR 160.422 Failure to request a hearing](https://dposchool.com/hipaa/section/160.422) - [45 CFR 160.424 Collection of penalty](https://dposchool.com/hipaa/section/160.424) - [45 CFR 160.426 Notification of the public and other agencies](https://dposchool.com/hipaa/section/160.426) #### Subpart E: Procedures for Hearings - [45 CFR 160.500 Applicability](https://dposchool.com/hipaa/section/160.500) - [45 CFR 160.502 Definitions](https://dposchool.com/hipaa/section/160.502) - [45 CFR 160.504 Hearing before an ALJ](https://dposchool.com/hipaa/section/160.504) - [45 CFR 160.506 Rights of the parties](https://dposchool.com/hipaa/section/160.506) - [45 CFR 160.508 Authority of the ALJ](https://dposchool.com/hipaa/section/160.508) - [45 CFR 160.510 Ex parte contacts](https://dposchool.com/hipaa/section/160.510) - [45 CFR 160.512 Prehearing conferences](https://dposchool.com/hipaa/section/160.512) - [45 CFR 160.514 Authority to settle](https://dposchool.com/hipaa/section/160.514) - [45 CFR 160.516 Discovery](https://dposchool.com/hipaa/section/160.516) - [45 CFR 160.518 Exchange of witness lists, witness statements, and exhibits](https://dposchool.com/hipaa/section/160.518) - [45 CFR 160.520 Subpoenas for attendance at hearing](https://dposchool.com/hipaa/section/160.520) - [45 CFR 160.522 Fees](https://dposchool.com/hipaa/section/160.522) - [45 CFR 160.524 Form, filing, and service of papers](https://dposchool.com/hipaa/section/160.524) - [45 CFR 160.526 Computation of time](https://dposchool.com/hipaa/section/160.526) - [45 CFR 160.528 Motions](https://dposchool.com/hipaa/section/160.528) - [45 CFR 160.530 Sanctions](https://dposchool.com/hipaa/section/160.530) - [45 CFR 160.532 Collateral estoppel](https://dposchool.com/hipaa/section/160.532) - [45 CFR 160.534 The hearing](https://dposchool.com/hipaa/section/160.534) - [45 CFR 160.536 Statistical sampling](https://dposchool.com/hipaa/section/160.536) - [45 CFR 160.538 Witnesses](https://dposchool.com/hipaa/section/160.538) - [45 CFR 160.540 Evidence](https://dposchool.com/hipaa/section/160.540) - [45 CFR 160.542 The record](https://dposchool.com/hipaa/section/160.542) - [45 CFR 160.544 Post hearing briefs](https://dposchool.com/hipaa/section/160.544) - [45 CFR 160.546 ALJ's decision](https://dposchool.com/hipaa/section/160.546) - [45 CFR 160.548 Appeal of the ALJ's decision](https://dposchool.com/hipaa/section/160.548) - [45 CFR 160.550 Stay of the Secretary's decision](https://dposchool.com/hipaa/section/160.550) - [45 CFR 160.552 Harmless error](https://dposchool.com/hipaa/section/160.552) ### Part 164: SECURITY AND PRIVACY #### Subpart A: General Provisions - [45 CFR 164.102 Statutory basis](https://dposchool.com/hipaa/section/164.102) - [45 CFR 164.103 Definitions](https://dposchool.com/hipaa/section/164.103) - [45 CFR 164.104 Applicability](https://dposchool.com/hipaa/section/164.104) - [45 CFR 164.105 Organizational requirements](https://dposchool.com/hipaa/section/164.105) - [45 CFR 164.106 Relationship to other parts](https://dposchool.com/hipaa/section/164.106) #### Subpart B \[Reserved\] #### Subpart C: Security Standards for the Protection of Electronic Protected Health Information - [45 CFR 164.302 Applicability](https://dposchool.com/hipaa/section/164.302) - [45 CFR 164.304 Definitions](https://dposchool.com/hipaa/section/164.304) - [45 CFR 164.306 Security standards: General rules](https://dposchool.com/hipaa/section/164.306) - [45 CFR 164.308 Administrative safeguards](https://dposchool.com/hipaa/section/164.308) - [45 CFR 164.310 Physical safeguards](https://dposchool.com/hipaa/section/164.310) - [45 CFR 164.312 Technical safeguards](https://dposchool.com/hipaa/section/164.312) - [45 CFR 164.314 Organizational requirements](https://dposchool.com/hipaa/section/164.314) - [45 CFR 164.316 Policies and procedures and documentation requirements](https://dposchool.com/hipaa/section/164.316) - [45 CFR 164.318 Compliance dates for the initial implementation of the security standards](https://dposchool.com/hipaa/section/164.318) - [45 CFR Appendix A to Subpart C of Part 164 Security Standards: Matrix](https://dposchool.com/hipaa/section/appendix-a-to-subpart-c-of-part-164) #### Subpart D: Notification in the Case of Breach of Unsecured Protected Health Information - [45 CFR 164.400 Applicability](https://dposchool.com/hipaa/section/164.400) - [45 CFR 164.402 Definitions](https://dposchool.com/hipaa/section/164.402) - [45 CFR 164.404 Notification to individuals](https://dposchool.com/hipaa/section/164.404) - [45 CFR 164.406 Notification to the media](https://dposchool.com/hipaa/section/164.406) - [45 CFR 164.408 Notification to the Secretary](https://dposchool.com/hipaa/section/164.408) - [45 CFR 164.410 Notification by a business associate](https://dposchool.com/hipaa/section/164.410) - [45 CFR 164.412 Law enforcement delay](https://dposchool.com/hipaa/section/164.412) - [45 CFR 164.414 Administrative requirements and burden of proof](https://dposchool.com/hipaa/section/164.414) #### Subpart E: Privacy of Individually Identifiable Health Information - [45 CFR 164.500 Applicability](https://dposchool.com/hipaa/section/164.500) - [45 CFR 164.501 Definitions](https://dposchool.com/hipaa/section/164.501) - [45 CFR 164.502 Uses and disclosures of protected health information: General rules](https://dposchool.com/hipaa/section/164.502) - [45 CFR 164.504 Uses and disclosures: Organizational requirements](https://dposchool.com/hipaa/section/164.504) - [45 CFR 164.506 Uses and disclosures to carry out treatment, payment, or health care operations](https://dposchool.com/hipaa/section/164.506) - [45 CFR 164.508 Uses and disclosures for which an authorization is required](https://dposchool.com/hipaa/section/164.508) - [45 CFR 164.509 Uses and disclosures for which an attestation is required](https://dposchool.com/hipaa/section/164.509) - [45 CFR 164.510 Uses and disclosures requiring an opportunity for the individual to agree or to object](https://dposchool.com/hipaa/section/164.510) - [45 CFR 164.512 Uses and disclosures for which an authorization or opportunity to agree or object is not required](https://dposchool.com/hipaa/section/164.512) - [45 CFR 164.514 Other requirements relating to uses and disclosures of protected health information](https://dposchool.com/hipaa/section/164.514) - [45 CFR 164.520 Notice of privacy practices for protected health information](https://dposchool.com/hipaa/section/164.520) - [45 CFR 164.522 Rights to request privacy protection for protected health information](https://dposchool.com/hipaa/section/164.522) - [45 CFR 164.524 Access of individuals to protected health information](https://dposchool.com/hipaa/section/164.524) - [45 CFR 164.526 Amendment of protected health information](https://dposchool.com/hipaa/section/164.526) - [45 CFR 164.528 Accounting of disclosures of protected health information](https://dposchool.com/hipaa/section/164.528) - [45 CFR 164.530 Administrative requirements](https://dposchool.com/hipaa/section/164.530) - [45 CFR 164.532 Transition provisions](https://dposchool.com/hipaa/section/164.532) - [45 CFR 164.534 Compliance dates for initial implementation of the privacy standards](https://dposchool.com/hipaa/section/164.534) - [45 CFR 164.535 Severability](https://dposchool.com/hipaa/section/164.535) This is reference material, not legal advice. ## For AI agents - Machine-readable index: https://dposchool.com/hipaa/llms.txt - JSON API: https://dposchool.com/hipaa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents