A working gap checklist for the HIPAA Privacy Rule (45 CFR Part 164, Subpart E): uses and disclosures, authorizations, minimum necessary, the Notice of Privacy Practices, individual rights, business associates, and administrative requirements. It also tracks the 2024 reproductive health amendments, most of which were vacated nationwide in Purl v. HHS while the Part 2 notice changes survived and became binding in February 2026. Check items off as you confirm them; your progress saves in this browser.
Privacy Rule obligations here are tagged Required (applies to every covered entity) or Conditional (applies only if you engage in the activity, such as marketing, fundraising, or operating as a hybrid entity). Items from the 2024 reproductive health rulemaking carry a status flag: the Part 2 notice changes are binding since February 16, 2026, while the attestation and prohibition provisions were vacated nationwide in Purl v. HHS and appear here as monitor items, not obligations.
Applies to every covered entity handling PHI. No activity trigger; these must be implemented as specified under 45 CFR Part 164, Subpart E.
Binding only if the activity applies to you: marketing, fundraising, sale of PHI, facility directories, hybrid entity or group health plan structures, and similar triggers.
Items badged "New · Feb 2026" survived Purl v. HHS and are binding. Items badged "Vacated" are not currently enforceable; they remain listed so you can track the litigation and decide what to keep voluntarily.
This checklist compiles the HIPAA Privacy Rule (45 CFR Part 164, Subpart E) and the current status of the "HIPAA Privacy Rule to Support Reproductive Health Care Privacy" final rule (89 FR 32976, April 26, 2024) after Purl v. HHS (N.D. Tex., June 18, 2025), for general compliance-learning purposes. Items badged "Vacated" are not currently binding; litigation and agency responses can change their status, so verify before acting on them. This is not legal advice. Brandon Goulter is not an attorney, and using this checklist creates no professional advisory relationship. Verify current requirements against primary sources (45 CFR Part 164 and the Federal Register) and confirm your own program's compliance with a licensed attorney before relying on this checklist. Checked items are stored only in your browser's local storage, nothing is transmitted or saved to any server.