Summary

• HIPAA notices remain the dominant form of current privacy action, especially in health systems and public agencies.
• The notices consistently allow use of protected health information for treatment, payment, operations, public health, and other legally required disclosures.
• Patients and clients are repeatedly given rights to access records, request corrections, restrict some uses, and receive accounting of disclosures.
• Several notices add stronger limits for sensitive categories such as substance use, mental health, sexual assault, HIV/AIDS, and reproductive health data.
• Health information exchange participation appears as a recurring issue, often with explicit opt-out language or disclosure controls.
• One notice explicitly describes AI-enabled tools used with human oversight, suggesting growing operational use of AI inside health data workflows.
• Breach notification and complaint pathways remain standard features, indicating a compliance-heavy privacy posture rather than a disputed or unstable policy environment.