Please follow http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary.