Skip to main content
U.S. flag

An official website of the United States government

Return to Search

FAQ 192 What were the major modifications to the HIPAA Privacy Rule adopted in 2002

This is a FAQ explaining the major modifications to the HIPAA Rule.


Issued by: Office for Civil Rights (OCR)

What were the major modifications to the HIPAA Privacy Rule that the Department of Health and Human Services (HHS) adopted in August 2002?


Based on the information received through public comments, testimony at public hearings, meetings at the request of industry and other stakeholders, as well as other communications, HHS identified a number of areas in which the Privacy Rule, as issued in December 2000, would have had potential unintended effects on health care quality or access. As a result, HHS proposed modifications that would maintain strong protections for the privacy of individually identifiable health information, address the unintended negative effects of the Privacy Rule on health care quality or access to health care, and relieve unintended administrative burdens created by the Privacy Rule.

Final modifications to the Rule were adopted on August 14, 2002. Among other things, the modifications addressed the following aspects of the Privacy Rule:

  • Uses and disclosures for treatment, payment and health care operations, including eliminating the requirement for the individual’s consent for these activities;
  • The notice of privacy practices that covered entities must provide to patients;
  • Uses and disclosures for marketing purposes;
  • Minimum necessary uses and disclosures;
  • Parents as the personal representatives of unemancipated minors;
  • Uses and disclosures for research purposes; and
  • Transition provisions, including business associate contracts.

In addition to these key areas, the modifications included changes to certain other provisions where necessary to clarify the Privacy Rule, and a list of technical corrections intended as editorial or typographical corrections to the Privacy Rule.

For more information about the final modifications to the Privacy Rule, see Modifications to the Standards for Privacy of Individually Identifiable Health Information – Final Rule. exit disclaimer icon

Learn more about health information privacy.



Date Created: 12/19/2002
Last Updated: 12/11/2006

HHS is committed to making its websites and documents accessible to the widest possible audience, including individuals with disabilities. We are in the process of retroactively making some documents accessible. If you need assistance accessing an accessible version of this document, please reach out to the

DISCLAIMER: The contents of this database lack the force and effect of law, except as authorized by law (including Medicare Advantage Rate Announcements and Advance Notices) or as specifically incorporated into a contract. The Department may not cite, use, or rely on any guidance that is not posted on the guidance repository, except to establish historical facts.