The HIPAA Privacy Rule is very clear on who may have access to a client’s medical information. Only health care providers who are involved in the client’s care are entitled to have access to the client’s information. Unless a client opts out, general condition updates and directory information are allowable. Friends, family, and colleagues of a client may not have access to medical information without the client’s permission. Penalties for individuals and institutions can be severe for violation of the Privacy Rule.