HIPAA (Health Insurance Portability and Accountability Act)

A 1996 U.S. federal law governing how covered entities (health plans, healthcare clearinghouses, and providers who transmit health data electronically) and their business associates (contractors handling that data on a covered entity’s behalf) may use and disclose protected health information (PHI). Any patient portal, telehealth interface, appointment-booking form, or account system that touches PHI is designing against this standard, not just Fair Information Practices‘s general baseline.

Any patient portal, telehealth interface, appointment-booking form, or account system that touches PHI is designing against this standard, not just Fair Information Practices‘s general baseline.

Post and deliver a Notice of Privacy Practices

Covered entities must maintain a documented Notice of Privacy Practices and name a Privacy Official patients can contact with complaints — the healthcare-specific counterpart to a Privacy Policy. The notice has specific delivery and placement requirements beyond just existing: a provider with a direct treatment relationship must deliver it no later than a patient’s first visit, post it physically at each service location somewhere a patient can actually be expected to read it, and — the requirement most directly relevant to interface design — make it electronically available on any website the provider maintains for customer service or benefits information, not just handed over on paper. A provider must also make a good-faith effort to get a patient’s written acknowledgment that they received the notice, and a health plan must re-notify every enrollee that the notice is available at least once every three years, not just once at enrollment.

The same screen carries both requirements at once: the privacy notice’s acknowledgment sits above a records request that lets the patient pick exactly how, and to whom, those records get delivered.

Give patients access without making the request the barrier

Patients can request their own PHI in electronic or paper form, and a covered entity must fulfill that request within 30 days. If it uses certified electronic health record (EHR) technology, it must let the patient get records through that system’s own view/download/transfer feature at no charge. Patients can also ask to be reached at a particular contact point (e.g., a work number instead of home) rather than whatever’s on file by default.

A covered entity can require a written request and must verify who’s asking, but neither step may turn into an obstacle or an unreasonable delay. That rules out several common interface shortcuts:

Offer more than one way to ask. A provider can’t require a patient to come in person to request a mailed copy, to use a web portal (not every patient has ready access to one), or to send the request by post. A portal that already authenticates its users covers identity verification for requests made through it.
Deliver in the format the patient asks for. If a requested format is readily producible, provide it. That’s a question of the provider’s capability, not its preference. Records held electronically have to be available in some electronic form, and paper is a fallback only after the patient turns down every electronic format on offer. Electronic copies should be machine readable where possible. Mail and email should always be options. A patient’s own portable media, such as a USB drive, can be declined if the provider’s security risk analysis rules out connecting outside devices, as long as another electronic option is offered.
Honor an informed choice of unencrypted email. If a patient asks for records by plain email, briefly warn them that the records could be read in transit, confirm they still want it, and then send it.
Let patients send records onward. A signed request naming another provider, a family member, an app, or a personal health record as the recipient has to be honored. An electronic signature through a secure portal counts, and disagreeing with the patient’s choice of recipient isn’t grounds to refuse.
Treat the 30-day deadline as a ceiling, not a target. Near-immediate access through a portal is encouraged. Only one extension of up to 30 more days is allowed, with the reason and new date given in writing, and a slow request can be released in pieces if the patient prefers.
Never ask why, and never hold records back over an unpaid bill. A request needs no stated reason, and unpaid charges for care aren’t grounds to withhold access.
Explain any refusal plainly. A denial goes in writing, in plain language, stating the reason, any right to have it reviewed, and how to complain, and every record it doesn’t cover must still be released.

Disclose only the minimum necessary, and get authorization for the rest

Any disclosure of PHI beyond what a specific purpose requires should be trimmed to the minimum necessary information — a general design discipline of not surfacing or transmitting more than a screen or workflow actually needs. Disclosures outside routine treatment/payment/operations uses require the patient’s written authorization; this is the authorization-gate a health-adjacent form or portal has to build, distinct from ordinary Form Design consent checkboxes.

Any disclosure of PHI beyond what a specific purpose requires should be trimmed to the minimum necessary information — a general design discipline of not surfacing or transmitting more than a screen or workflow actually needs.

Design the interface around confidentiality, not just data security

Several Security Rule requirements are visible in the interface rather than purely backend concerns:

Restricting which staff accounts can see PHI at all — access control tied to job function, not a blanket internal audience.
Positioning shared-use workstations and monitors away from public sightlines.
Encrypting PHI in transit over open networks.

Uncertainty about what’s actually required has historically pushed providers toward an overcautious, unhelpfully guarded interface — a clear, unambiguous privacy-control design reduces that hesitation rather than adding to it.

Patterns

Principles

Trust and Credibility

Standards

Fair Information Practices

Sources

Health Insurance Portability and Accountability Act (Wikipedia) (CC BY-SA) is this page’s source for the covered-entities/business-associates scope, the 30-day access-request deadline, the minimum-necessary disclosure standard, and the Security Rule’s access-control and workstation-placement requirements above.

Summary of the HIPAA Privacy Rule (HHS.gov) (public domain) is HHS’s own official summary, the source for the Notice of Privacy Practices’ delivery/posting/electronic-availability requirements, the written-acknowledgment expectation, and the three-year health-plan re-notification cadence in Post and deliver a Notice of Privacy Practices.

Individuals' Right under HIPAA to Access their Health Information (HHS.gov) (public domain) is HHS’s guidance on the right of access itself, the source for the request-process rules in Give patients access without making the request the barrier, from the ban on portal-only or in-person-only requests and the portable-media condition to the plain-language denial requirements.