Can You Make a Patient Waive Their HIPAA Rights? A Guide to § 164.530(h)

HIPAA protects individuals’ privacy by granting them specific rights over their protected health information (PHI). Section 164.530(h) of the Privacy Rule strictly prohibits covered entities from requiring a patient to waive their HIPAA rights as a condition of receiving treatment, payment, enrollment in a health plan, or eligibility for benefits. Yet many small practices unknowingly violate this rule through poorly written forms, improper intake procedures, or misunderstandings. This guide provides clarity on what § 164.530(h) requires, what common missteps to avoid, and how to ensure your practice is fully compliant.

Imagine a patient being told, “You have to sign this waiver if you want to be seen.” The patient complies, not realizing they’re being asked to give up their right to access their records or to file a privacy complaint. HIPAA’s § 164.530(h) exists to prevent precisely this situation.

This rule ensures that covered entities and their business associates do not coerce or manipulate patients into surrendering rights that the law guarantees them. For small practices, understanding this prohibition is essential for maintaining both legal compliance and patient trust.

This section of the HIPAA Privacy Rule clearly states:

“A covered entity may not require an individual to waive any of the rights under this subpart as a condition of the provision of treatment, payment, enrollment in a health plan, or eligibility for benefits.”

In other words:

• A patient’s HIPAA rights cannot be waived as a condition to receive care

• This applies to all rights under the Privacy Rule, such as:

• Right of access to medical records

• Right to request restrictions

• Right to file complaints

• Right to receive notices of privacy practices

A waiver can take many forms, including:

• A form that says “You waive your right to access your PHI”

• A clause in a treatment agreement that says “Patient agrees not to file HIPAA complaints”

• A verbal statement like “If you want treatment here, you need to give up your privacy rights”

These are all violations, even if the patient agrees.

In 2022, a small dental practice required patients to sign an intake form that included the following clause:

“By signing below, the patient agrees not to file any HIPAA complaints related to their care at this office.”

A patient, dissatisfied with the quality of care and the unauthorized disclosure of their PHI, proceeded to file a complaint with the Office for Civil Rights (OCR). During the investigation, OCR found the waiver clause and determined that the dental office had violated HIPAA’s prohibition against requiring individuals to waive their rights, as established under § 164.530(h).

Key findings included:

• The waiver clause was part of a mandatory form required for treatment.

• Patients received no explanation of their HIPAA rights during the intake process.

• Staff were unaware that such a clause was unlawful and enforceable under federal law.

Outcome:

The dental office was required to:

• Remove the illegal clause from all forms.

• Revise its patient documentation to ensure compliance.

• Retrain staff on HIPAA rights and lawful patient communication.

• Enter into a resolution agreement that included a $30,000 financial settlement.

Lesson:

Even a single sentence in a routine form can undermine patient rights and trigger significant regulatory consequences. Small practices must review all written materials for compliance and ensure that no language, however subtle implies a waiver of HIPAA protections.

If you’re a solo provider or run a small clinic, here’s what this rule requires of you:

• Never condition care on waiving HIPAA rights

• Review all intake, registration, and consent forms for hidden waivers

• Train your team to avoid improper verbal statements

• Avoid clauses that may appear to limit patient rights, even indirectly

Can a patient voluntarily give up a right under HIPAA?

No. A patient can authorize certain disclosures, but they cannot waive core HIPAA rights under pressure or as a condition of care.

What if the waiver is just “suggested” but not required?

Even implied coercion can trigger a violation. If the patient feels compelled to sign a waiver to receive treatment, that still violates the spirit and letter of § 164.530(h).

Can patients choose to not exercise a right (like not accessing records)?

Yes, as long as it’s voluntary and not coerced or required by the provider.

What if a third-party vendor included a waiver in their forms?

Your practice is still responsible. Under HIPAA, covered entities are accountable for the actions of their business associates and vendors involving PHI.

• 45 CFR § 164.530(h): Prohibition on Waiver of Rights

• HHS Guidance on Individual Rights

• OCR FAQs on HIPAA Rights

• OCR Resolution Agreements and Case Examples

Section 164.530(h) of the HIPAA Privacy Rule reinforces a fundamental truth: patients cannot be asked to waive their HIPAA rights as a condition for receiving treatment, payment, or access to their own health information. These rights are legally protected and non-negotiable no healthcare provider, regardless of size or resources, has the authority to override them.

Unfortunately, small practices may unintentionally violate this rule by using outdated forms with waiver language, failing to train staff properly, or misunderstanding the difference between voluntary authorization and coercion. Even subtle language like “we cannot treat you unless you agree to this” can cross the line and create compliance risk.

To remain compliant and foster patient trust, practices should take the following steps:

• Remove any waiver or rights-limiting language from intake forms, financial agreements, or consent documents.

• Train all staff clinical, administrative, and billing on how to communicate HIPAA rights clearly and respectfully.

• Use properly formatted HIPAA authorizations when a patient voluntarily agrees to share information beyond standard treatment, payment, or healthcare operations.

• Respect and reinforce patient rights at every point of contact, making privacy a visible and respected part of your practice culture.

By ensuring these protections, your practice not only avoids regulatory penalties but also strengthens its ethical commitment to patient-centered care.