This guide states the law of health information privacy and security. Part 1 covers the statutory and regulatory architecture and defines the regulated universe of covered entities and business associates. Parts 2 and 3 cover protected health information, de-identification, the uses and disclosures permitted without authorization, the minimum necessary standard, and the requirements of a valid authorization. Part 4 covers individual rights, including the right of access with its thirty-day deadline and fee limits, amendment, accounting, restrictions, and confidential communications. Parts 5 and 6 cover the Security Rule and the breach notification framework, including the four-factor risk assessment and the notification deadlines. Parts 7 and 8 cover enforcement, penalties, the absence of a private right of action, and the business associate contracting chain. Later parts address substance use disorder records under Part 2, state preemption, information blocking and interoperability, and the research, marketing, employment, and constitutional regimes that operate alongside HIPAA.