HIPAA and Health Information Privacy in the United States
Reviewed October 21, 2026
An introduction to U.S. health information privacy, individual rights, and the responsibilities of organizations subject to HIPAA.
This overview is educational. Consult the current rules, official U.S. Department of Health and Human Services (HHS) guidance, and qualified legal counsel for a specific situation.
Understanding HIPAA
Who HIPAA covers
HIPAA applies to covered entities and business associates. Covered entities include health plans, health care clearinghouses, and health care providers that conduct specified electronic transactions. Health information is not automatically covered simply because it appears in an app or portfolio.
Individual rights and complaints
Individuals generally have rights to access their protected health information, request amendments, and receive information about privacy practices, subject to the rules and exceptions. Privacy or security concerns can be raised with the organization or the HHS Office for Civil Rights.
Uses, disclosures, and authorization
HIPAA permits certain uses and disclosures without an individual’s authorization, including qualifying treatment, payment, and health care operations. Other purposes may require a valid authorization. A portfolio sharing choice does not replace an organization’s assessment of its legal authority.
Protecting electronic health information
The Security Rule requires regulated organizations to assess risks and apply administrative, physical, and technical safeguards to electronic protected health information. Responsibilities include appropriate access controls, workforce practices, and business associate arrangements.
Breach notification
A breach of unsecured protected health information can trigger notification duties. Covered entities notify affected individuals, HHS, and sometimes the media; business associates notify the covered entity. Applicable exceptions, risk assessments, and deadlines must be evaluated.
CareCard and HIPAA
A user-controlled CareCard Portfolio does not by itself establish HIPAA coverage. Responsibilities depend on the information, services, legal roles, and applicable agreements. This overview does not certify CareCard’s compliance or an organization’s use of the platform.