45 CFR § 164.530

What does 45 CFR § 164.530 require?

45 CFR 164.530 is the administrative-requirements section of the HIPAA Privacy Rule — the people-side, policy-side, and documentation-side controls every covered entity must have in place to actually run a Privacy Rule program. Ten obligations: designate a Privacy Official; designate a contact person/office for complaints and notice questions; train the entire workforce on PHI policies and procedures (at hire, after material changes, after role changes); implement administrative, technical, and physical safeguards; provide a working complaint process and log every complaint and disposition; apply and document sanctions when workforce members violate privacy policies or the Rule; mitigate known harmful effects of improper uses or disclosures; never retaliate against people who exercise HIPAA rights, file complaints, or cooperate with OCR; never require individuals to waive HIPAA rights; have written policies and procedures; and retain those records for at least six years. The most-cited gaps in OCR HIPAA Privacy Rule enforcement actions are missing or inadequate workforce training records, missing complaint logs, missing sanction documentation, and policies that exist on paper but have no evidence of implementation. The §164.530(j) six-year retention requirement applies not only to the policies themselves but to every record OCR could ask for during an investigation — training rosters, sanction memos, complaint dispositions, mitigation actions, NPP receipts, and accounting-of-disclosures logs.

Who must comply with 45 CFR § 164.530?

All HIPAA covered entities (health plans, health care clearinghouses, and health care providers who transmit any health information in electronic form in connection with a HIPAA transaction). The administrative requirements apply across the full spectrum — solo medical practices, dental offices, community pharmacies, large hospital systems, health insurers, Medicare/Medicaid health plans, and group health plans. Business associates are bound by §164.530-style obligations through their business associate contracts under §164.504(e) — the BA must agree to safeguards, sanctions, training, and a complaint process consistent with the covered entity's. Hybrid entities (organizations with both covered and non-covered components) must implement §164.530 within the health-care component. Organized Health Care Arrangements may share certain Privacy Rule responsibilities under §164.506. Small-practice exception: NONE. §164.530 applies in full to a one-provider clinic. The Privacy Rule scales — a solo practice writes shorter, simpler policies than a 1,000-provider health system — but every element of §164.530 must be addressed and documented.

What happens if you violate 45 CFR § 164.530?

Civil Monetary Penalties under 45 CFR §160.404 (2026 inflation-adjusted): Tier 1 (unknowing) $137-$68,928 per violation; Tier 2 (reasonable cause, not willful neglect) $1,379-$68,928 per violation; Tier 3 (willful neglect, corrected within 30 days) $13,785-$68,928 per violation; Tier 4 (willful neglect, not timely corrected) $68,928 per violation. Annual cap per identical-provision category: $2,067,813. Each day a violation continues, and each individual whose PHI is affected, can be counted as a separate violation. HHS Office for Civil Rights (OCR) is the enforcement agency. OCR has multiple enforcement pathways triggered by §164.530 gaps: (1) individual complaints filed directly with OCR via the OCR Complaint Portal — OCR receives tens of thousands of HIPAA complaints per year and §164.530(d) requires every covered entity to have a complaint process and log; (2) Breach Notification Rule reports under §§164.400-414 — breaches affecting 500+ individuals are posted on the OCR public breach portal and trigger investigation; (3) compliance reviews and audits initiated by OCR; and (4) referrals from state attorneys general (who have concurrent HIPAA enforcement authority under HITECH §13410). Resolution agreements typically include 1-3 year corrective action plans with quarterly reporting, OCR-approved policy revisions, mandatory workforce retraining, and ongoing OCR monitoring. The §164.530(g) anti-retaliation provision is independently enforceable — retaliating against a workforce member who reports a HIPAA concern internally or to OCR is itself a Privacy Rule violation, on top of any underlying issue.

How to comply (implementation checklist)

1. 1Designate a Privacy Official in writing under §164.530(a)(1)(i). Document the role, authority, and reporting line. The Privacy Official can also serve as the Security Official (§164.308(a)(2)) — document the dual designation.
2. 2Designate a contact person or contact office to receive complaints and respond to questions about the Notice of Privacy Practices, per §164.530(a)(1)(ii). Publish the contact information in the NPP, on the entity's website, and in patient-facing materials.
3. 3Train all workforce members on PHI policies and procedures at hire (§164.530(b)(2)(i)(A)), within a reasonable time after material policy changes (§164.530(b)(2)(i)(B)), and when a workforce member's functions change (§164.530(b)(2)(i)(C)). Maintain per-employee training records — date, content modules, role-specific content, employee acknowledgment — for 6 years.
4. 4Document and implement administrative, technical, and physical safeguards per §164.530(c). For ePHI, these largely overlap with §164.308 / §164.310 / §164.312. For paper PHI and verbal disclosures, separate safeguards apply — minimum-necessary access, locked storage, private conversations, fax-coversheet practices, secure-disposal procedures.
5. 5Establish and publish a complaint process under §164.530(d). Implement a complaint log capturing date received, source, nature, investigation, disposition, and resolution. Workforce members must know how to receive and route complaints. Retain the log 6 years.
6. 6Maintain a written sanction policy under §164.530(e) that defines graduated sanctions for privacy violations — including unintentional disclosures, snooping, unauthorized access, social-media incidents, and willful misconduct. Document every sanction action — employee, date, violation, sanction applied, supervisor sign-off. Retain 6 years.
7. 7Define and document mitigation procedures under §164.530(f) — how the entity responds to known harmful effects of improper uses or disclosures, including notification of recipients, recovery of records, retraining, and technical containment. Maintain a mitigation log of actions taken.
8. 8Communicate and enforce the §164.530(g) anti-retaliation policy. Train managers explicitly on the prohibition against retaliating against workforce members who report HIPAA concerns or cooperate with OCR. Document the policy and training delivery.
9. 9Eliminate any waiver-of-rights language from intake forms, treatment agreements, payment forms, enrollment paperwork, or eligibility documents. §164.530(h) bars conditioning treatment, payment, enrollment, or eligibility on waiver of HIPAA rights.
10. 10Maintain a written, current set of privacy policies and procedures under §164.530(i). Map each policy section to the corresponding Privacy Rule citation. Version-control the policies. Retire and archive prior versions (still subject to 6-year retention).
11. 11Maintain all §164.530 records — policies, training rosters, complaint logs, sanction actions, mitigation actions, designations, NPPs, BAAs, authorization records, accounting-of-disclosures records — in written or electronic form for 6 years from the later of date of creation or last effective date (§164.530(j)).
12. 12Conduct an internal §164.530 audit at least annually — confirm Privacy Official designation is current, training is up-to-date for every workforce member, complaint log is being maintained, sanctions are being applied and documented, and 6-year retention is intact for all required records.

Common misinterpretations

• Misinterpretation: 'Training only needs to happen at hire.' Reality: §164.530(b)(2)(i) requires training (A) at hire for new workforce members joining after the compliance date, (B) within a reasonable period of time after a material change to the entity's privacy policies or procedures, AND (C) for each workforce member whose functions change in a manner that affects the workforce member's use or disclosure of PHI. OCR has cited entities for failing to retrain after policy updates and role changes. Industry standard and a practical bar: annual refresher training plus event-driven training.
• Misinterpretation: 'The Privacy Official and the Security Official have to be different people.' Reality: They do not. One person can serve as both Privacy Official (§164.530(a)(1)(i)) and Security Official (§164.308(a)(2)). In small and mid-size practices it is common — and acceptable — to combine the roles in one written designation, provided the individual has the authority, resources, and time to perform both functions. The designation must be in writing.
• Misinterpretation: 'Sanctions are required only for major intentional misconduct.' Reality: §164.530(e) requires sanctions for workforce members who fail to comply with privacy policies OR the Privacy Rule. The sanction policy must address a graduated response — verbal warning, written warning, retraining, suspension, termination, and referral to law enforcement when warranted — applicable to negligent disclosures, snooping in records, unauthorized access, social-media posts, and any other policy violations. OCR investigators ask to see (a) the written sanction policy and (b) documented evidence of sanctions actually applied. 'We have a policy but never had to use it' is rarely credible in any organization with more than a handful of workforce members.
• Misinterpretation: 'A complaint process means a phone number in the Notice of Privacy Practices.' Reality: §164.530(d) requires both a mechanism for individuals to make complaints AND documentation of all complaints received and their disposition. OCR-cited gaps include (a) no internal complaint log, (b) complaints received but not investigated, (c) complaints received but no resolution documented, (d) workforce unaware of the complaint contact, and (e) no complaint process for complaints submitted to anyone other than the contact person of record. The complaint log is a required §164.530(j) record retained for 6 years.
• Misinterpretation: 'Documentation requirements are policy-and-procedure documents only.' Reality: §164.530(j)(2) requires retention for 6 years of policies and procedures, AND any communication required to be in writing under the Privacy Rule, AND any action, activity, or designation required to be documented. That includes Privacy Official designations, training rosters and records, complaint logs and dispositions, sanction actions, mitigation actions, business associate agreements, Notice of Privacy Practices versions and acknowledgments, accounting-of-disclosures requests and responses, access-request decisions, restriction-request decisions, and authorization records. The 6-year clock runs from the later of (a) date of creation or (b) date last in effect — so a policy retired 5 years ago that was in effect for 4 years must be kept 6 years from the retirement date, not 6 years from origination.
• Misinterpretation: 'Mitigation is a best practice, not a requirement.' Reality: §164.530(f) requires the covered entity to mitigate, to the extent practicable, any harmful effect known to the covered entity of a use or disclosure of PHI in violation of its policies or the Privacy Rule. This is a separate, independent obligation from breach notification (§§164.400-414). Even when a disclosure does not meet the §164.402 breach definition (e.g., low probability of compromise after risk assessment), §164.530(f) still requires mitigation efforts — recovery of disclosed records, notifications to the recipient, internal retraining, technical controls — and OCR expects documentation of what mitigation was performed.

Real enforcement examples

Anonymized from public FMCSA enforcement summaries. Penalty amounts reflect assessed and final settled values where disclosed.

Frequently asked questions

Related regulations