PERRLA/Guides/APA 7/HIPAA

How to Cite HIPAA in APA 7

An APA 7 reference for HIPAA gives the act's full name, its public law number (Pub. L. No. 104-191), the volume and first page in the Statutes at Large (110 Stat. 1936), and the year in parentheses, with no author and no italics. The in-text citation is the act's name without "of 1996," plus the year: (Health Insurance Portability and Accountability Act, 1996). If you're writing about a Privacy Rule requirement, such as minimum necessary, cite the regulation in 45 C.F.R. instead, and if you read HHS's plain-language summary, cite that webpage.

The format

Name of Act, Pub. L. No. Number, Volume Stat. Page (Year). URL

PERRLA APA Experts · Updated October 22, 2026
Checked against the Publication Manual of the American Psychological Association, 7th edition. Every example is formatted by PERRLA's reference engine.

First, the easy way: PERRLA

In PERRLA, choose Statutes (under Legal References), then A federal statute. For the law as Congress passed it, pick Statute cited from Public Law and fill in the act's name, a shortened title for your in-text citations, the public law number (104-191), the Statutes at Large volume (110) and starting page (1936), and the year. Citing it from the U.S. Code instead? Pick Statute codified in the United States Code and fill in the title number (42) and the section. PERRLA adds the section symbol and turns a range typed into the section box, like 1320d-1320d-8, into the first section and et seq. for you.

Already have a U.S. Code citation, like 42 U.S.C. § 1320d? Paste it into PERRLA's reference search and PERRLA recognizes it as a federal statute and fills in the title number and section. Add the act's name, the shortened title, and the year yourself. A 45 C.F.R. citation comes back the same way, as a federal regulation with the title number and section filled in, so add the regulation's name and the year of the C.F.R. edition. For the Privacy Rule by hand, choose Government Reports & Regulations, then A federal regulation and A codified regulation.

HHS's HIPAA pages are webpages: paste the page's URL into the reference search, and PERRLA fills in HHS as the group author, the page title, and the link. Check two things before you add it. If the date comes in as the page's "Content last reviewed" date, clear it so the reference shows n.d. And make sure the title keeps Privacy Rule capitalized, since it's the rule's name. Adding it by hand? Choose Webpage and add the U.S. Department of Health and Human Services as a group author.

Not using PERRLA yet? Here is how to build the same reference by hand.

The parts of the reference

1. Name of the act

Start with the act's official name, exactly as the law gives it, including the year if the name has one. Capitalize it like a title, and don't italicize it. Use the full name in the reference, never just HIPAA.

Health Insurance Portability and Accountability Act of 1996

There's no author. A law's name sits in the author position, which is why the in-text citation uses the name too.

2. Public law number

After a comma, write Pub. L. No. and the law's number. The first part is the Congress that passed it (the 104th) and the second is its place in that Congress's laws (the 191st). The two parts are joined by a hyphen, not an en dash, because the number isn't a range.

Pub. L. No. 104-191

3. Statutes at Large

Next, give the volume of the United States Statutes at Large, the abbreviation Stat., and the page where the law begins. This is always the first page of the law, not the page you read or quoted.

110 Stat. 1936

You'll find the volume and page at the top of the law's first page, printed as 110 STAT. 1936, next to the public law number and the date it was approved.

4. Year

Put the year in parentheses, then a period. For a public law, that's the year it was enacted. HIPAA was signed on August 21, 1996.

(1996).

5. U.S. Code section (the other way to cite it)

Instead of the public law, you can point to where the law lives in the United States Code: the title number, U.S.C., the section symbol, and the section. HIPAA is spread across several titles. Its privacy and administrative simplification provisions start at Title 42, section 1320d, so a reference to those provisions uses that first section and et seq., Latin for "and the sections that follow."

42 U.S.C. § 1320d et seq.

Pick one form, public law or U.S. Code, not both. The public law cites the act as Congress passed it. The U.S. Code cites it as organized by subject.

6. URL

A link is optional for legal references, but one to an official copy helps your reader. GovInfo (govinfo.gov) from the U.S. Government Publishing Office and Congress.gov both carry the law as passed. Don't put a period after the URL.

https://www.govinfo.gov/content/pkg/PLAW-104publ191/pdf/PLAW-104publ191.pdf

Examples

HIPAA by its public law number

The act itself, cited the way Congress passed it. Use this form when your paper is about the law, its history, or what Congress required.

  • Parenthetical citation(Health Insurance Portability and Accountability Act, 1996)
  • Narrative citationHealth Insurance Portability and Accountability Act (1996)

HIPAA by its U.S. Code section

The same act, pointed to where its privacy and administrative simplification provisions sit in the U.S. Code. The act added sections 1320d through 1320d-8 to Title 42. Typed as a range in PERRLA's section box, it prints as the first section and et seq.

  • Parenthetical citation(Health Insurance Portability and Accountability Act, 1996)
  • Narrative citationHealth Insurance Portability and Accountability Act (1996)

The HIPAA Privacy Rule in the Code of Federal Regulations

The Privacy Rule is a regulation HHS wrote to carry out the law, so it gets a regulation reference, not a statute reference. Its core is Subpart E of 45 C.F.R. Part 164, sections 164.500 through 164.535 in the 2025 edition. Cite it when you write about what covered entities must do, like the minimum necessary standard in § 164.502(b).

  • Parenthetical citation(Privacy of Individually Identifiable Health Information, 2025)
  • Narrative citationPrivacy of Individually Identifiable Health Information (2025)

HHS's Summary of the HIPAA Privacy Rule webpage

The page most nursing students actually read. HHS is the author and runs the site, so there's no separate site name. The only date on the page is "Content last reviewed," which APA ignores, so the date is n.d.

  • Parenthetical citation(U.S. Department of Health and Human Services [HHS], n.d.)
  • Narrative citationThe U.S. Department of Health and Human Services (HHS, n.d.)
  • Later citations(HHS, n.d.)

In-text citations

A law's in-text citation uses its name and year, because the name is in the author spot. Drop "of 1996" from the name in the citation so the year appears once. Statute names aren't italicized, in the reference or in your sentences.

  • Parenthetical: (Health Insurance Portability and Accountability Act, 1996)
  • Narrative: the Health Insurance Portability and Accountability Act (1996) requires…
  • The Privacy Rule: (Privacy of Individually Identifiable Health Information, 2025)
  • HHS's webpage: (U.S. Department of Health and Human Services [HHS], n.d.) the first time, then (HHS, n.d.)

Using "HIPAA" in your sentences is fine. Define it the first time you name the act, as in "the Health Insurance Portability and Accountability Act of 1996 (HIPAA)," then write HIPAA after that. Keep the act's name in the parenthetical citations, since that's what your reader matches to the references page.

Pointing to one part of the law? Name it in your sentence: Section 264 of HIPAA directed HHS to recommend privacy standards, and 45 C.F.R. § 164.502(b) sets the minimum necessary standard.

Common mistakes

  • U.S. Department of Health and Human Services. (1996). Health Insurance Portability and Accountability Act.Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936 (1996).A law isn't a report by an agency. APA cites statutes in legal form: no author, no italics, and the public law or U.S. Code location instead of a publisher. HHS didn't write HIPAA. Congress passed it.
  • (Health Insurance Portability and Accountability Act of 1996, 1996)(Health Insurance Portability and Accountability Act, 1996)Leave the year out of the name in the in-text citation so it appears once. In PERRLA, that's what the Shortened Title box is for. Leave it blank and the full name, year and all, goes into every citation.
  • Pub. L. No. 104–191Pub. L. No. 104-191A public law number is the Congress and the law's number, joined by a hyphen. An en dash means a range, and this isn't one.
  • (Health Insurance Portability and Accountability Act, 1996) after a sentence about the minimum necessary standard(Privacy of Individually Identifiable Health Information, 2025)The act told HHS to write privacy standards. The standards themselves, like minimum necessary, are in the regulation. Cite the source that actually says what you're claiming.
  • U.S. Department of Health and Human Services. (2025, March 14). Summary of the HIPAA Privacy Rule.U.S. Department of Health and Human Services. (n.d.). Summary of the HIPAA Privacy Rule.March 14, 2025 is the page's "Content last reviewed" date. APA ignores review dates, because a page that was reviewed wasn't necessarily changed.

Quick checklist

  • Act's full name, in title case, not italic
  • Pub. L. No. 104-191 with a hyphen, or 42 U.S.C. § 1320d et seq., not both
  • 110 Stat. 1936: the page where the law begins
  • The year in parentheses
  • In text: the name without "of 1996" and the year
  • Privacy Rule requirements cited to 45 C.F.R., HHS summaries cited as webpages

Questions students ask

Do I cite HIPAA or the HIPAA Privacy Rule?

Cite whichever one says what you're claiming. HIPAA is the 1996 law. It told HHS to set privacy standards. The Privacy Rule is the regulation HHS wrote, and it holds the details nurses work with: who's covered, what counts as protected health information, and when it can be shared. Papers about patient privacy in practice usually cite the Privacy Rule, and some cite both.

Can I write (HIPAA, 1996) in my paper?

Use HIPAA freely in your sentences once you've defined it, but keep the act's name in parenthetical citations: (Health Insurance Portability and Accountability Act, 1996). APA's abbreviation shortcut in citations is for group authors, like HHS. A law's name isn't an author, so the safe choice is the name your reader will find on the references page.

Should I use the public law number or the U.S. Code?

Either is correct in APA 7. The public law cites HIPAA as Congress passed it, in one piece, and it's the easier one for an act scattered across several titles of the code. The U.S. Code cites it where it lives today, organized by subject, and it's the better choice when you're writing about one specific section.

How do I cite the HIPAA Security Rule or the Breach Notification Rule?

The same way as the Privacy Rule, as codified regulations in 45 C.F.R. Part 164. The Security Rule is Subpart C (sections 164.302 through 164.318), and breach notification is Subpart D (sections 164.400 through 164.414). Use the subpart's heading as the title and the year of the C.F.R. edition you read.

What about the HITECH Act?

The HITECH Act, which strengthened HIPAA's privacy and security rules in 2009, doesn't have its own public law number. It's Title XIII of Division A of the American Recovery and Reinvestment Act of 2009 (Pub. L. No. 111-5). Cite it as a federal statute the same way as HIPAA: its own name, the Health Information Technology for Economic and Clinical Health Act, then Pub. L. No. 111-5, the Statutes at Large page where HITECH begins (123 Stat. 226), and 2009.

Does HIPAA go on my references page?

Yes. Laws and regulations get full reference entries in APA 7, alphabetized by their first word with everything else. That's different from the U.S. Constitution, which is cited in the text only.

Rules checked against the Publication Manual of the American Psychological Association (7th ed.), Chapter 11 (legal references), including Sections 11.5 (statutes) and 11.7 (regulations), Sections 8.21 and 9.11 (group authors), and the APA Style website's webpage reference guidance on review dates. Example sources verified against the law's text on GovInfo (Pub. L. No. 104-191, approved August 21, 1996, beginning at 110 Stat. 1936), the 2024 edition of the U.S. Code, the 2025 edition of 45 C.F.R. Part 164, and the HHS page itself.

PERRLA builds HIPAA's reference in legal form from the public law number or the U.S. Code section, with the shortened title ready for your in-text citations.

Try PERRLA free for 7 days