Almost everything people believe about HIPAA is wrong, starting with the belief that it applies to everyone who holds health information. This article explains who is actually covered, what protected health information is, and the surprisingly broad set of disclosures the rule permits without any patient permission at all. It covers the right of access — the most frequently violated provision in the statute — including the deadline, the fee limits, and the format a patient can insist on. It explains the security requirements for electronic records, the breach notification obligations and their deadlines, and what enforcement actually looks like, including the fact that there is no private lawsuit for a HIPAA violation. It covers the substance use disorder records rule that is stricter than HIPAA, the state laws that are stricter still, and the information blocking rules that now push in the opposite direction. Readers finish knowing what they can demand, what they must disclose, and what to do in the first seventy-two hours of a breach.