- Authorizations (30)
                              - Business Associates (41)
                              - Compliance Dates (2)
                              - Covered Entities (14)
                              - Decedents (9)
                              - Disclosures for Law Enforcement Purposes (5)
                              - Disclosures for Rule Enforcement (1)
                              - Disclosures in Emergency Situations (2)
                              - Disclosures Required by Law (6)
                              - Disclosures to Family and Friends (28)
                              - Disposal of Protected Health Information (6)
                              - Facility Directories (7)
                              - Family Medical History Information (3)
                              - FERPA and HIPAA (10)
                              - Group Health Plans (3)
                              - Incidental Uses and Disclosures (10)
                              - Judicial and Administrative Proceedings (8)
                              - Minimum Necessary (14)
                              - Notice of Privacy Practice (20)
                              - Preemption of State Law (10)
                              - Privacy Rule: General Topics (12)
                              - Protected Health Information (2)
                              - Public Health Uses and Disclosures (13)
                              - Research Uses and Disclosures (20)
                              - Right to an Accounting of Disclosures (8)
                              - Right to File a Complaint (1)
                              - Right to Request a Restriction (4)
                              - Safeguards (13)
                              - Security Rule (24)
                              - Smaller Providers and Businesses (145)
                              - Student Immunizations (8)
                              - Transition Provisions (3)
                              - Treatment, Payment, and Health Care Operations Disclosures (30)
                              - Workers Compensation Disclosures (5)
                              - Limited Data Set (6)
                              - Marketing (17)
                              - Marketing - Refill Reminders (16)
                              - Personal Representatives and Minors (12)
                              - Right to Access and Research (58)
                              - Mental Health (35)
                              - Health Information Technology (41)
                              - Telehealth (11)

                      -   
                      -   
                      -   
                      -   
                      -   

# Does the HIPAA Privacy Rule require hospitals and doctors' offices to be retrofitted, to provide private rooms, and soundproof walls to avoid any possibility that a conversation is overheard? 

## Answer:

No, the Privacy Rule does not require these types of structural changes be made to facilities.

Covered entities must have in place appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information. This standard requires that covered entities make reasonable efforts to prevent uses and disclosures not permitted by the Rule. The Department does not consider facility restructuring to be a requirement under this standard.

For example, the Privacy Rule does not require the following types of structural or systems changes:
                    - Private rooms.
                    - Soundproofing of rooms.
                    - Encryption of wireless or other emergency medical radio communications which can be intercepted by scanners.
                    - Encryption of telephone systems.

Covered entities must implement reasonable safeguards to limit incidental, and avoid prohibited, uses and disclosures. The Privacy Rule does not require that all risk of protected health information disclosure be eliminated. Covered entities must review their own practices and determine what steps are reasonable to safeguard their patient information. In determining what is reasonable, covered entities should assess potential risks to patient privacy, as well as consider such issues as the potential effects on patient care, and any administrative or financial burden to be incurred from implementing particular safeguards. Covered entities also may take into consideration the steps that other prudent health care and health information professionals are taking to protect patient privacy.

Examples of the types of adjustments or modifications to facilities or systems that may constitute reasonable safeguards are:
                    - Pharmacies could ask waiting customers to stand a few feet back from a counter used for patient counseling.
                    - In an area where multiple patient-staff communications routinely occur, use of cubicles, dividers, shields, curtains, or similar barriers may constitute a reasonable safeguard. For example, a large clinic intake area may reasonably use cubicles or shield-type dividers, rather than separate rooms, or providers could add curtains or screens to areas where discussions often occur between doctors and patients or among professionals treating the patient.
                    - Hospitals could ensure that areas housing patient files are supervised or locked.  	 

Date Created: 12/19/2002Last Updated: 03/14/2006

Content last reviewed December 28, 2022