A HIPAA Privacy Rule compliance program is the set of written policies, assigned roles, training, safeguards, complaint and sanctions procedures and records that a covered entity keeps to meet the administrative requirements of 45 CFR 164.530. Integral Healthcare Solutions (IHS) drafts that program for covered entities that have nothing in writing, or a set that no longer matches how they work. Your privacy official reviews, adopts and runs it. IHS is a consulting firm, not a law firm, and this page is not legal advice.
Last updated: November 2026
What is a HIPAA Privacy Rule compliance program?
It is the evidence that a covered entity meets 45 CFR 164.530, the section titled "Administrative requirements." We read the eCFR text current through its October 29, 2026 amendment date; page opened November 2, 2026: https://www.ecfr.gov/current/title-45/section-164.530.
| Paragraph | What it asks of a covered entity |
|---|---|
| 164.530(a)(1)(i) | Designate a privacy official responsible for developing and implementing the entity's policies and procedures. |
| 164.530(a)(1)(ii) | Designate a contact person or office to receive complaints, who can also give further information about matters covered by the notice required by 164.520. |
| 164.530(b)(1) and (b)(2)(i) | Train all workforce members as necessary and appropriate for their functions: by the compliance date, new members within a reasonable period after joining, and members affected by a material policy change within a reasonable period after it takes effect. |
| 164.530(c) | Keep appropriate administrative, technical and physical safeguards to protect the privacy of protected health information; reasonably safeguard it from intentional or unintentional uses or disclosures that violate the subpart, and limit incidental uses or disclosures that result from an otherwise permitted or required use or disclosure. |
| 164.530(d) | Provide a process for individuals to make complaints, and document each complaint received and its disposition, if any. |
| 164.530(e) | Have and apply appropriate sanctions against workforce members who fail to comply, subject to the exclusion stated in (e)(1), and document sanctions applied, if any. |
| 164.530(f) | Mitigate, to the extent practicable, any known harmful effect of a use or disclosure in violation of its policies or the subpart, by the entity or its business associate. |
| 164.530(g)(1) and (h) | Do not intimidate, threaten, coerce, discriminate against or retaliate against an individual for exercising a right established by the Privacy Rule or for participating in a process it provides, including filing a complaint; do not require an individual to waive those rights as a condition of treatment, payment, enrollment in a health plan, or eligibility for benefits. |
| 164.530(i) | Implement policies reasonably designed for the entity's size and activities and, whenever a change in law necessitates a change to its policies or procedures, promptly document and implement the revised policy or procedure. |
| 164.530(j) | Keep policies and required records in written or electronic form and retain them for six years from creation or from when last in effect, whichever is later. |
The takeaway: the section lists roles to name, procedures to write and records to keep; paragraph (j) makes the records a requirement. In IHS's reading, building the program is a document-and-evidence exercise, which is the part IHS drafts.
Who needs a written privacy program and what triggers it?
A covered entity needs one, because the section states duties of a covered entity. Paragraph (k) carves out one narrow case: an insured-only group health plan that creates or receives no protected health information beyond summary health information and enrollment data is not subject to paragraphs (a) through (f) and (i), to the extent both conditions hold, and stays subject to paragraph (j) for certain plan documents.
Usual triggers:
- A new service opens with no written privacy program.
- A complaint arrives, or a payer or customer asks for the policy set, and the written policies are missing or stale.
- A staffing change leaves the privacy official or complaint contact role empty.
- A change in the law or in your practices may mean policies, training and the notice need revising.
What do the notice of privacy practices and the accounting of disclosures add?
They are separate sections a Privacy Rule program must account for: 45 CFR 164.520 (notice of privacy practices) and 45 CFR 164.528 (accounting of disclosures), both opened November 2, 2026.
Notice. Except as provided in its paragraphs (a)(3) and (a)(4), an individual has a right to adequate notice of the uses and disclosures the entity may make. A provider with a direct treatment relationship gives it no later than the first service delivery, or in an emergency as soon as reasonably practicable, and except in an emergency makes a good faith effort to obtain written acknowledgment, documenting the effort and the reason if none is obtained. On a material change the entity must promptly revise and distribute the notice and, except when required by law, may not implement the change before the revised notice takes effect.
Accounting. An individual may request an accounting of disclosures made in the six years before the request, or a shorter period, except for the categories in paragraph (a)(1) of that section. The entity acts no later than 60 days after receiving the request, with one extension of no more than 30 days if, within those 60 days, it gives the individual a written statement of the reasons for the delay and the date by which it will provide the accounting. This page omits the notice's content elements, the health-plan and web-site notice rules, and the accounting exceptions.
How IHS helps
IHS runs the work in five steps: a gap assessment against each paragraph above; a map of your existing documents; drafting of what is missing; a training outline; and a readiness review of the finished file.
IHS drafts the privacy policy set, the two designations, the notice of privacy practices, the complaint procedure, the sanctions policy and record, the mitigation procedure, the training outline and attendance record, the accounting of disclosures procedure, and the documentation file with its retention schedule.
You supply the person who adopts the documents, an accurate account of how information moves through your practice, your current notice, your workforce list, and counsel for legal questions. Your privacy official and counsel approve every draft. IHS does not take possession of protected health information for this work; it works from your policies and your description of your workflows, not from patient records.
The real limit: IHS is not your privacy official, does not decide whether a use or disclosure is permitted, and does not communicate with any regulator on your behalf. IHS drafts; you adopt and run it.
IHS was founded in 2002 and is led by Thomas G. Goddard, JD, PhD, former Chief Operating Officer and General Counsel of URAC. This program sits in IHS's compliance services line, alongside accreditation consulting and program development.
What to have ready
Each item ties to a paragraph cited above.
- The name of the person who will act as privacy official (paragraph (a)(1)(i)).
- The person or office that will receive complaints (paragraph (a)(1)(ii)).
- Your workforce list with roles (paragraph (b)).
- Existing privacy policies, however informal, and when they last changed (paragraph (i)).
- A plain description of the safeguards in place for paper, electronic records and conversations (paragraph (c)).
- Any complaint you have received and what happened to it (paragraph (d)).
- Any record of staff discipline for privacy lapses, and any known improper disclosure and the steps taken after it (paragraphs (e) and (f)).
- Your current notice of privacy practices and any acknowledgment forms you collect (164.520).
- Where privacy records are kept and for how long (paragraph (j)).
If you want to start, the introductory call is free and is where IHS learns what you already have.
How it compares
IHS treats the Privacy Rule program as a separate build from the Security Rule risk analysis; see our page on it. Breach response, right of access and business associate contracts are also separate: see breach notification, right of access and business associate management. The privacy policy on this web site is a different document: it covers what integralhs.com collects from visitors, not a HIPAA program.
Buying template policies is another route. Paragraph (i)(1) asks for policies reasonably designed for the entity's size and activities, so in IHS's reading a template is a starting point that still has to be fitted to your practice. IHS does not tell you which route to take.
What does a HIPAA Privacy Rule compliance program cost?
The cost has three parts. Government fees: the section text we opened attaches no fee to adopting a privacy program. Consulting fees: IHS does not publish a price for this work and scopes each engagement after a free introductory call. Your own staff time: in IHS's reading, your privacy official and department leads explain how each function handles protected health information and review each draft.
What this is not
- It is not legal advice. IHS is a consulting firm, not a law firm.
- It is not a privacy official for hire; your organization names that person.
- It is not a guarantee about how any regulator will view your program, and IHS does not submit anything to or communicate with a regulator for you.
Frequently asked questions
What is a HIPAA Privacy Rule compliance program?
It is the written policies, assigned roles, workforce training, safeguards, complaint process, sanctions, mitigation steps and records that a covered entity keeps to meet the administrative requirements in 45 CFR 164.530. Integral Healthcare Solutions (IHS) drafts these documents for your privacy official to review and adopt.
Does a small practice need a privacy official?
If the practice is a covered entity, yes. Paragraph (a)(1)(i) says a covered entity must designate a privacy official responsible for developing and implementing its policies and procedures. Paragraph (i)(1) asks that policies fit the entity's size and the type of activities it performs with protected health information, so a small practice can keep a smaller program, but the designation itself is required.
How often does staff have to be trained under the Privacy Rule?
Paragraph (b)(2)(i) requires training by the entity's compliance date, for each new member within a reasonable period after joining, and for each member whose functions are affected by a material policy change, within a reasonable period after the change becomes effective. The paragraphs we read set no fixed interval such as every year, so IHS does not tell clients that annual training is required by this section. IHS drafts the outline; your privacy official sets the schedule.
How long do we keep privacy documentation?
Six years. Paragraph (j)(2) says the entity must retain the required documentation for six years from the date it was created or the date it last was in effect, whichever is later.
What are sanctions under 164.530 and who decides?
Paragraph (e)(1) says a covered entity must have and apply appropriate sanctions against workforce members who fail to comply with its privacy policies or the requirements of the subpart, and (e)(2) requires it to document the sanctions applied, if any. The standard excludes actions that are covered by and meet the conditions of 164.502(j) or paragraph (g)(2); counsel advises how that applies. The text names no person who decides, so your policy should name that role.
Who adopts the policies, the consultant or the practice?
The practice. Your privacy official adopts every document IHS drafts, because in IHS's reading paragraph (a)(1)(i) places responsibility for the entity's policies and procedures on that role. IHS is not the privacy official and does not act as one.
Does IHS see our patients' records or protected health information?
No. IHS drafts from your description of how information moves through your practice and does not take possession of protected health information for this work, so do not send patient records. Your privacy official and counsel approve the drafts.
Does a consultant give legal advice on HIPAA?
IHS does not. IHS is a consulting firm, not a law firm. Whether your organization is a covered entity, and whether a particular use or disclosure is permitted, are questions for your counsel.