How we research HIPAA requirements
You are being asked to trust HIPAA summaries from a company that also wants to sell you the documents. That is a fair thing to be skeptical about, so here is exactly how this content is produced, which figures came from which rule, and where we refuse to guess.
Who writes this
Larry Osakwe is the founder of HIPAA Binder. He is not a lawyer, a certified compliance professional, or a former OCR investigator. He builds the HIPAA document sets this site sells, and traces every regulatory claim on it to the CFR section or the HHS publication that creates it.
That matters for how you should read these pages. The value here is not professional judgment about your practice, it is that someone traced each requirement back to the section that creates it and showed you the citation, so you can check the claim yourself in about a minute.
The rules we hold ourselves to
The CFR, not a compliance blog
Rule citations here are read from the current 45 CFR text and from HHS's own publications. Because hhs.gov blocks automated retrieval, we pull the codified text through the eCFR API and rule preambles through the Federal Register rather than substituting a secondary summary that we cannot check.
Penalty figures come from the rule that set them
The amounts on our penalty-tiers page ($145 minimum, $73,011 per-violation maximum, $2,190,294 calendar-year cap) were read directly from HHS's Annual Civil Monetary Penalties Inflation Adjustment at 91 FR 3665, published January 28, 2026. They adjust annually, so the page says which adjustment it reflects instead of implying the number is permanent.
A dated requirement gets its date and its scope
The February 16, 2026 compliance date from the 42 CFR Part 2 final rule (89 FR 12472) is real, but the rule says persons subject to that regulation must comply, and the NPP change it drove covers notice about part 2 records. It binds part 2 programs and covered entities that handle part 2 records, not every HIPAA practice. Separately, the 2024 reproductive-health NPP amendments were vacated nationwide by a federal court in June 2025 and no longer apply, though that ruling left the substance-use-disorder NPP changes standing. Saying only the date, without who it binds, would push a practice into paperwork it may not owe.
We say what documents cannot do
A binder does not make a practice compliant. Our own pages say that the documents are the paperwork layer, that they do not handle PHI, and that they do not guarantee compliance. Any vendor telling you a template alone makes you HIPAA compliant is selling you something we are not.
We correct ourselves in public
An earlier version of this site described a document as attorney-reviewed when it had not been. That claim was removed, and there is now an automated check that fails our build if credential language like that reappears anywhere in this copy.
Tell us when we are wrong
Email larry@hipaabinder.com with the page and the citation. Corrections to a cited claim get priority over everything else we are working on.
Found something wrong?
HIPAA penalty amounts adjust every year and HHS reissues its model notices when the rules change. If a citation here does not say what we claim it says, that is the most useful email you can send us.
What this site is not
HIPAA Binder produces self-prepared compliance documents from the information you provide. We are not a law firm, are not affiliated with HHS or the Office for Civil Rights, and do not guarantee HIPAA compliance or any audit outcome. Confirm current requirements with HHS and, where appropriate, a licensed attorney.