Law note · United States
HIPAA Privacy Rule
cite 45 CFR Part 164, Subpart E (Sections 164.500-164.534)
stage In effect
since 2003-04-14
reviewed 2026-08-23
Restricts covered entities (health plans, health care clearinghouses, and most health care providers) and their business associates from using or disclosing protected health information except as the Rule permits or requires, and conditions most non-routine disclosures on individual authorization.
Its de-identification safe harbor is the one place federal law names biometric identifiers, including voice prints and full-face photographic images, as identifiers that must be stripped before health data is treated as de-identified.
What it asks of an app
- Do not use or disclose protected health information except as the Privacy Rule permits or requires, and limit use and disclosure to the minimum necessary.
- Strip biometric identifiers, including voiceprints and full-face photographic images, before treating health data as de-identified.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, high_risk_decisions
Primary source: eCFR, current regulatory text, 45 CFR Part 164 Subpart E