Achieving compliance with all of HIPAA’s requirements is a major challenge—and understanding exceptions and fringe cases adds another layer of complexity and stress. 

Failing to understand HIPAA exceptions can lead to violations of HIPAA, other federal laws, or state laws. It can also lead to additional negative outcomes, like withholding important documents and information from journalists out of fear and confusion that it is covered under HIPAA, as reported in a landmark story by the Reporters Committee for the Freedom of the Press.

To help you avoid consequences like these, we’ve summarized the major exemptions to the Health Insurance Portability and Accountability Act (HIPAA) and exceptions to its rules. Most of these are exceptions to the HIPAA Privacy Rule,  but some are exceptions to the General Rule, the Breach Notification Rule, and Minimum Necessary Rule.

1. HIPAA Privacy Rule exceptions (specifically related to permitted uses and disclosures of PHI)

The HIPAA Privacy Rule permits covered entities to use and/or disclose personal health information (PHI) without patient authorization for treatment, payment, and healthcare operations (TPO). Aside from TPO, the rule only permits uses and disclosures under very specific circumstances. 

Below is a quick rundown of these exceptions, which are described in more detail in 45 CFR § 164.512.

• Required by law
• Public health activities (such as reporting to a state health department or the CDC) 
• Victims of abuse, neglect, or domestic violence
• Health oversight activities, such as audits
• Legal proceedings
• Law enforcement purposes
• Medical research
• Workers compensation 
• Essential government functions (such as protecting the health and safety of inmates or employees in a correctional institution)
• Psychotherapy notes in limited circumstances (such as its own training or to defend itself in legal proceedings brought by the individual)
• Marketing in limited circumstances (such as communications for care coordination for the individual or to recommend alternative treatments)
• To inform next of kin, identify a body, determine cause of death, or for a medical examiner/coroner
• To facilitate organ donation or transplants
• To prevent serious threat to a person or the public’s health or safety

Even in these situations where a HIPAA release form is not required, disclosures must be documented in an Accounting of Disclosures log. 

Below we’ll take a closer look at some of the most notable exceptions to this rule (like law enforcement exceptions) and to other HIPAA rules.

2. State law exceptions 

Initially, when HIPAA was passed by Congress and went into effect, there was some confusion around who it applied to and when to comply—particularly for healthcare organizations in states that already had data privacy laws. This is still a point of misunderstanding today. 

45 CFR § 160.103 is meant to address that confusion. The general rule states that, in most cases when HIPAA contradicts state law, HIPAA supersedes that law. However, there are three exceptions in which a provision of the state law would supersede HIPAA:

• The state law provides stronger data privacy provisions or patient rights: Typically only the case for a certain subset of health information in specific circumstances (e.g. HIV-related information needed for emergency care or when handled by pharmacists. 
• The state law provides for reporting information to public health agencies: For example, therapists conducting psychotherapy sessions are required by state laws to warn of imminent harm or report cases of abuse.
• The state law requires a health plan to report information for the purpose of audits, monitoring, or licensure: For example, if a state law requires information from a health plan for the purpose of management audits, financial audits, program monitoring and evaluation, or the licensure or certification of facilities or individuals, then it supersedes HIPAA.

Note that even in these cases when state law supersedes HIPAA, an entity that provides more PHI than the minimum necessary can still be found in violation of HIPAA.

3. Federal law exceptions

Similar to state law exceptions, there are cases in which other federal laws may supersede HIPAA. For example, public schools, colleges, and other educational institutions must comply with Family Educational Rights and Privacy Act (FERPA). If these entities provide medical services for students and staff as a benefit of employment, they are not usually considered covered entities under HIPAA.

However, medical teaching universities that have an educational institution that provides healthcare services to the public are considered hybrid entities and must implement safeguards to isolate and protect FERPA-covered information and so the same for HIPAA-covered PHI. 

Another example is how the Federal Substance Abuse Confidentiality Requirements does not allow for certain uses and disclosures of PHI allowed by the HIPAA Privacy Rule (described in 42 CFR Part 2).

4. Law enforcement exceptions

Some state laws preempt HIPAA and require covered entities to disclose PHI to law enforcement without the patient’s authorization in specific circumstances, such as reporting gunshots, stab wounds, or other violent injuries.  

Other exceptions related to law enforcement purposes include:

• To comply with a court order or court-ordered warrant, a subpoena or summons issued by a judicial officer
• To comply with a grand jury subpoena
• To respond to an administrative request, such as an administrative subpoena or summons or a civil or an authorized investigative demand
• To respond to a request for PHI for purposes of identifying or locating a suspect, fugitive, material witness or missing person (although disclosures must be limited)
• To report child abuse or neglect
• To respond to a request for PHI about an adult victim of a crime, and the victim agrees (e.g. in cases of adult abuse, neglect, or domestic violence)
• To alert law enforcement of potential criminal activity when responding to a situation on premises or to an off-site medical emergency or death of an individual under suspicious cirumcstances 
• To prevent or lessen a serious and imminent threat to the health or safety of an individual or the public

5. PHI exceptions

HIPAA applies to individually identifiable health information known as protected health information (PHI). 

Under 45 CFR § 160.103, certain types of individually identifiable health information are not considered PHI and therefore are not protected by HIPAA. The four exceptions are:

• FERPA-covered education records: Health information contained within education records that are covered by the Family Educational Rights and Privacy Act (FERPA) are not PHI. Example: student immunization records maintained by a school nurse as part of the school’s records.
• Treatment records excluded under FERPA: Records described in 20 U.S.C. § 1232g(a)(4)(B)(iv) — those created and used solely for treatment of a student by a physician, psychologist, or similar professional — are excluded, provided they are not shared beyond treatment providers.
• Employment records held by a covered entity as an employer: Information maintained by a covered entity in its role as an employer is not PHI. Example: employee health information used for FMLA leave or workers’ compensation. 
• Records of individuals deceased more than 50 years: Individually identifiable health information of a person who has been deceased for more than 50 years is no longer considered PHI.

These four exceptions recognize that certain contexts (education, employment, historical records) already have their own privacy protections or no longer pose a meaningful risk to privacy.

6. Military exceptions

There are two notable HIPAA exceptions related to military treatment facilities and the Department of Defense (DoD).

First, military treatment facilities are HIPAA covered entities, but there are exceptions that do not apply to other types of covered entities. 

These exceptions are special circumstances in which these facilities can disclose the PHI of service members to appropriate military command authorities. These disclosures must fall under the authorized activities detailed in the Military Command Exception, outlined in the Department of Defense Health Information Privacy Regulation (DoD 6025.18-R). 

These activities include but are not limited to:

• fitness for duty determinations
• fitness to perform a particular assignment, or
• the service member’s ability to carry out any other activity essential for the military mission.

This exception does not require DoD healthcare providers to disclose PHI to commanders for these reasons; it only permits the disclosure. There are circumstances in which the provider would be required to notify the commander, including if they believe there is a serious risk of harm to self, to others, or to the mission as a result of their condition or treatment of their condition. 

The second HIPAA exception related to the military is listed in 45 CFR 164.500(d): HIPAA rules do not apply to the Department of Defense or any other federal agency or private sector organization working on its behalf when providing healthcare to overseas foreign national beneficiaries.

7. Financial institution exceptions

Despite the definition of a business associate in 45 CFR 160.103—which mentions a person who provides financial services to or for a covered entity—HIPAA does not generally apply to banking and financial institutions. 

Section 1179 of the Social Security Act [42 U.S.C. 1320d–8], also known as the HIPAA exemption for financial institutions, states that HIPAA rules do not apply to financial institutions that perform traditional banking and payment-related functions—such as processing checks, credit card transactions, or electronic fund transfers—on behalf of healthcare providers or patients.

However, this exception is limited. In a response to comments in the 2013 Final Rule, HHS clarified that Section 1179 exempts only “certain activities of financial institutions from the HIPAA Rules” and that a financial institution performing additional functions beyond these standard payment processing activities may be considered a business associate under HIPAA. For example, a bank or payment processor that manages accounts receivable, performs medical billing services, or handles patient data on behalf of a healthcare provider would not be exempt and would need to comply with HIPAA rules.

8. Health plan exceptions

While HIPAA generally applies to most health plans that transmit electronic protected health information (ePHI), several types are excluded. The three exceptions are:

• Small, employer-administered group plans: Group health plans with fewer than 50 participants that are administered solely by the employer that established and maintains the plan are not covered entities under HIPAA.
• Certain government-funded programs: Programs whose main purpose is not to provide or pay for healthcare (such as food assistance programs) or whose primary activity is directly providing care (such as community health centers or grant-making agencies) are exempt.
• Specific insurance entities: Insurers that provide only workers’ compensation, automobile insurance, or property and casualty insurance are not subject to HIPAA.

9. HIPAA Breach Notification Rule exceptions

There are a few scenarios that technically fall under the definition of a healthcare data breach, yet the U.S. Department of Health and Human Services (HHS) makes exceptions for them. According to 45 CFR 164.402, breaches exclude:

1. Unintentional access or use of PHI by an employee, made in good faith and within the scope of their authority
2. Accidental disclosure of PHI between authorized persons
3. The organization confidently believes that the person who obtained or accessed the PHI will not retain or compromise the data

If any of the three exceptions are true, then PHI is not considered “breached” and the covered entity isn’t required to notify affected parties or HHS under the Breach Notification Rule.

10. HIPAA Minimum Necessary Rule exceptions

In 45 CFR 164.502(b), the HHS outlines six exceptions to the Minimum Necessary Rule:

1. Healthcare providers making requests for PHI to provide treatment to a patient
2. Patients making requests for copies of their own medical records
3. Requests for PHI when there is a valid authorization
4. Requests for PHI that are required for compliance with the HIPAA Transactions Rule or other HIPAA Administrative Simplification Rules
5. Requests for disclosure of PHI to HHS for complaint investigation, compliance review, or enforcement
6. Requests for PHI that are otherwise required by law

If you are ever unsure whether HIPAA rules apply, it’s best to consult with a healthcare attorney or HIPAA compliance professional.

HIPAA Exceptions List

Understanding where HIPAA does and doesn’t apply can be challenging given the number of overlapping rules, definitions, and special cases. To make it easier, we’ve summarized the key exceptions and exemptions covered in this article below.

Use this table as a quick reference list to see which entities, records, and activities fall outside HIPAA’s scope and under what circumstances.

This post was originally published in February 2023 and has been updated on October 7, 2025 for comprehensiveness.