The Privacy Rule proposal dates from 10 December 2020. It would cut the access response period to 15 days.
Three permanent clocks sit under all of this:
- 30 days - Answer an access request, with one 30-day extension.
- 60 calendar days - Notify individuals of a breach.
- 6 years - Retain policies, assessments, and action records.
What does a HIPAA or state privacy violation cost in 2026?
Federal civil money penalties sit in four tiers under 45 CFR 160.404. These are the base amounts in the regulation. HHS raises them each year for inflation under 45 CFR part 102, so today's limits are higher.
- No knowledge - $100 to $50,000 per violation.
- Reasonable cause - $1,000 to $50,000 per violation.
- Willful neglect, cured in 30 days - $10,000 to $50,000 per violation.
- Willful neglect, not cured - At least $50,000 per violation.
- Annual cap - $1,500,000 per tier for identical violations.
State consumer health data laws can add their own penalties. They are covered in the consumer apps section below. Check each statute for its current amounts.
The OCR breach portal listed 772 large breaches for 2025. It listed 747 breaches and more than 168 million records for 2023. If you run a small clinic, see HIPAA compliance cost for a small practice in 2026.
What do the Privacy, Security and Breach Notification rules require?
The Privacy Rule limits how PHI may be used and gives individuals rights. Under 45 CFR 164.524, you must act on an access request within 30 days. You can extend that by 30 more days, with written reasons and an expected completion date. You may charge a reasonable, cost-based fee for copying labour, media, postage, and a summary.
The Breach Notification Rule sets the clock after an impermissible use or disclosure. Under 45 CFR 164.404, you must notify each affected individual without unreasonable delay. The deadline is 60 calendar days after discovery. Discovery is the first day the breach is known, or should have been known. The notice must be plain language, and states what happened and how to reach you.
The Documentation Rule in 45 CFR 164.316 closes the loop. Policies and procedures must be written, and electronic counts. Documentation is retained for 6 years from creation, or from the last effective date. You update it when conditions change the security of ePHI. The attack side is covered in healthcare cybersecurity threats and how to protect against them.
Do you need a business associate agreement for every vendor that touches patient data?
A business associate is any vendor that handles ePHI for you. Under 45 CFR 164.308(b), you must get satisfactory assurances first. The written contract is a Required specification. In practice, that contract is a business associate agreement, or BAA.
A business associate must obtain equivalent assurances from its subcontractors. You do not need assurances from those subcontractors directly. You still answer for the ePHI. Check what the tool holds before you sign anything.
Since 16 February 2026, Part 2 programs carry the same contract duties. Vendor review sits next to other assurance work, such as SOC 2 compliance cost for startups in 2026.
Does HIPAA cover consumer health apps, wearables and data brokers?
Usually not. HIPAA covers PHI held by covered entities and business associates. A direct-to-consumer app is typically neither. That gap is where state law steps in.
Washington's My Health My Data Act, 2023 Wash. Laws 191, protects consumer health data. That includes data used to infer a consumer's mental or physical health status. Consent is required before you collect or share it. A breach of the Act is also a breach of the Washington Consumer Protection Act. The Attorney General can enforce it, and individuals can bring private claims under that law. Selling consumer health data needs a valid authorization, and you keep a copy for six years. The Washington Attorney General's guidance has the detail. The consent duties apply to most businesses from 31 March 2024, and to small businesses from 30 June 2024.
Nevada's SB 370 took effect on 1 July 2024. It requires affirmative, voluntary consent. The state Attorney General enforces it under Nevada's consumer protection law. Selling the data needs a separate written authorization in both states.
Both statutes exempt covered entities that process data consistently with HIPAA. A wearable app that sells data to an advertiser has no exemption. Check that before you assume the HIPAA compliance requirements are the only ones that apply. Other states add layers, such as CCPA compliance cost for California businesses in 2026. The Nevada details come from a June 2023 Future of Privacy Forum chart written while the bill was pending. Check the current statute before relying on them.
Next steps
Work through the HIPAA compliance requirements in order.
- List your data - Note where PHI, ePHI, Part 2 records, and consumer data live.
- Find your Required specs - The 14 Required ones are your floor. Document the other 22.
- Run a risk analysis - It is Required, and audits look there first.
- Fix vendor contracts - Put a BAA in place for every vendor that touches ePHI.
- Check state exposure - Washington and Nevada reach consumer data.
Required or addressable is only the first question. The full answer covers three federal rules and a deadline list running into 2027. Two state laws reach consumer data. Most of the work is written down, so record each decision and the reason behind it.
Photo: stevepb, Pixabay Content License, via Pixabay (https://pixabay.com/photos/wheelchair-disability-injured-749985/)
Fazlur Rahman
