PERRLA/Guides/MLA 9/HIPAA

How to Cite HIPAA in MLA 9

An MLA 9 Works Cited entry for HIPAA, cited as Congress passed it, starts with United States, Congress, then Public Law 104-191 in plain type, then United States Statutes at Large in italics, vol. 110, 1996, and pp. 1936–2103, and ends with U.S. Government Publishing Office and the URL. The in-text citation is the first words of the entry, the government and the branch: (United States, Congress). Name the act itself, the Health Insurance Portability and Accountability Act, in your sentence, in plain type. If you read the Privacy Rule or HHS's summary page instead, cite that.

The format

United States, Congress. Public Law Number. United States Statutes at Large, vol. #, Year, pp. #–#. Website Name, URL.

PERRLA MLA Experts · Updated October 27, 2026
Checked against the MLA Handbook, 9th edition. Every example is formatted by PERRLA's reference engine.

First, the easy way: PERRLA

In PERRLA, choose Statutes (under Legal References), then A federal statute. For the law as Congress passed it, pick Statute cited from Public Law. Fill in the Public Law Number (104-191), the United States Statutes at Large Volume Numbers box (110), the Original Year (1996), and the URL (Web address). MLA gives every page the law fills, so type the whole range, 1936–2103, in Statute Starting Page Number. The MLA entry doesn't print the Name of the Statute or Act, so name the act in your sentence.

Citing it from the U.S. Code instead? Pick Statute codified in the United States Code, type 42 in the United States Code Title Number box, the first section (1320d) in United States Code Section Numbers, and the last one (1320d-8) in Ending Section Number. Put the year of the code edition you read (2024 on GovInfo) in Original Year. Already have a citation like 42 U.S.C. § 1320d? Paste it into PERRLA's reference search, and PERRLA recognizes it as a federal statute and fills in the title number and the section. Add the year yourself.

For the Privacy Rule, choose Government Reports & Regulations, then A federal regulation and A codified regulation. Type Department of Health and Human Services in Department, the subpart's name in Regulation Name or Number, 45 in the Code of Federal Regulations Volume Number box, the sections in Section Number, and the year of the edition in Year. HHS's summary page is a webpage: paste its URL into the reference search, and make sure the Website Name matches the group author, U.S. Department of Health and Human Services, so PERRLA starts the entry with the title.

Not using PERRLA yet? Here is how to build the same works cited entry by hand.

The parts of the works cited entry

1. Author: the government

A law's author is the government body that made it. MLA's legal examples name the government first, then the body, separated by a comma, and end with a period.

United States, Congress.

MLA 9 also lets you give an agency's name the way the source presents it, so either form is accepted. The U.S. Code on GovInfo names no author, so that entry starts with the code's name. The Privacy Rule's author is the department that wrote it: United States, Department of Health and Human Services.

2. Title: the public law number

For a law cited from the Statutes at Large, the law's number stands in the title spot: Public Law, then the number, then a period. The first part is the Congress that passed it (the 104th), and the second is its place in that Congress's laws (the 191st). They're joined by a hyphen, not a dash, because the number isn't a range.

Public Law 104-191.

Names of laws and codes go in plain type in MLA: capitalized like titles, but never italicized or put in quotation marks. The act's name, the Health Insurance Portability and Accountability Act of 1996, doesn't appear in this entry, so say it in your sentence.

3. Statutes at Large

The United States Statutes at Large is the official collection of every law Congress passes, so it's the container. Its name goes in italics, followed by vol. and the volume number, the year, and pp. with the pages the law fills.

United States Statutes at Large, vol. 110, 1996, pp. 1936–2103.

HIPAA starts on page 1936 and runs to 2103. MLA usually shortens the second page number to its last two digits, but here the hundreds change, so 2103 stays whole.

4. Website

If you read the law online, the website is a second container: its name in italics, a comma, and the URL without https://, ending with a period. MLA's own public law example names the U.S. Government Publishing Office here, the office that puts the Statutes at Large online.

U.S. Government Publishing Office, www.govinfo.gov/content/pkg/STATUTE-110/pdf/STATUTE-110-Pg1936.pdf.

The office now posts these PDFs on a site it calls GovInfo, so GovInfo in this spot is right too.

5. U.S. Code (the other way to cite it)

You can cite the law where it lives today, in the United States Code, organized by subject. The code's name starts the entry in plain type. Then come Title and the title number, the sections, the publisher, the year of the edition you read, and the URL.

United States Code. Title 42, sections 1320d–1320d-8, U.S. Government Publishing Office, 2024,

HIPAA's privacy and administrative simplification provisions are sections 1320d through 1320d-8 of Title 42. MLA cites the version you consulted, so the year is the code edition (2024 on GovInfo), not 1996.

6. The Privacy Rule

The Privacy Rule is a regulation HHS wrote to carry out the law, published in the Code of Federal Regulations. Its core is Subpart E of Part 164 of Title 45. The subpart's name is the title, in plain type with no quotation marks, the same as any law. Then come the code, the title number, the sections, the publisher, the edition year, and the URL.

Privacy of Individually Identifiable Health Information. Code of Federal Regulations, title 45, secs. 164.500–164.535,

The code comes out in a new edition every year, so use the year of the edition you read.

Examples

HIPAA as Congress passed it (the public law)

The act itself, read in the Statutes at Large on GovInfo. Use this form when your paper is about the law, its history, or what Congress required. The entry doesn't name the act, so name it in your sentence.

  • In-text citation(United States, Congress)
  • Narrative citationIn the Health Insurance Portability and Accountability Act, the United States Congress required …

HIPAA in the U.S. Code

The same law's privacy and administrative simplification provisions, read in the 2024 edition of the U.S. Code on GovInfo. The entry covers sections 1320d through 1320d-8, and the in-text citation points to the one section you used: here, section 1320d-2, which tells HHS to adopt standards for electronic health transactions.

  • In-text citation(United States Code, sec. 1320d-2)
  • Narrative citationThe United States Code directs HHS to adopt standards for electronic health transactions (sec. 1320d-2).

The HIPAA Privacy Rule in the Code of Federal Regulations

The Privacy Rule is a regulation, so it gets its own entry with HHS as the author. Its core is Subpart E of 45 C.F.R. Part 164, sections 164.500 through 164.535 in the 2025 edition. Cite it when you write about what covered entities must do, like the minimum necessary standard in section 164.502(b).

  • In-text citation(United States, Department of Health and Human Services, sec. 164.502(b))
  • Narrative citationThe Department of Health and Human Services limits most disclosures to the minimum necessary (sec. 164.502(b)).

HHS's Summary of the HIPAA Privacy Rule webpage

The page most nursing students actually read. HHS wrote the page and runs the site, so MLA starts the entry with the title and names HHS once, as the website. The only date on the page is "Content last reviewed March 14, 2025," and MLA uses a review date when that's what the page gives.

  • In-text citation("Summary")
  • Narrative citationHHS's "Summary of the HIPAA Privacy Rule" explains that …

In-text citations

An MLA 9 in-text citation uses the first words of the Works Cited entry, so for a law it's the government, not the act's name and not a year.

  • The public law: the government and the branch: (United States, Congress)
  • The U.S. Code: the code's name and the section you used, with a comma and sec. before the number: (United States Code, sec. 1320d-2)
  • The Privacy Rule: the government, the department, and the section: (United States, Department of Health and Human Services, sec. 164.502(b))
  • HHS's page: the title in quotation marks, shortened if it's long: ("Summary")
  • Name in your sentence: give only the section at the end, or no parentheses at all when there's nothing left to add: The United States Code directs HHS to adopt standards for electronic health transactions (sec. 1320d-2).

Write the act's name in plain type, never in italics. Spell it out the first time, as in "the Health Insurance Portability and Accountability Act of 1996 (HIPAA)," then use HIPAA after that. PERRLA keeps the branch or the department after United States, because MLA gives as much of the name as your reader needs when several entries start with United States.

Common mistakes

  • Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936 (1996).United States, Congress. Public Law 104-191. United States Statutes at Large, vol. 110, 1996, pp. 1936–2103.The first form is legal citation style, which APA uses. MLA follows its own template for laws: the government as author, the law's number as the title, and the Statutes at Large as the container.
  • (Health Insurance Portability and Accountability Act, 1996)(United States, Congress)MLA in-text citations match the first words of the Works Cited entry and never take the year. Name the act in your sentence instead.
  • The Health Insurance Portability and Accountability Act requires …The Health Insurance Portability and Accountability Act requires …Names of laws, acts, and codes are capitalized like titles but set in plain type, with no italics and no quotation marks.
  • (United States Code 1320d-2)(United States Code, sec. 1320d-2)A page number follows the name with no comma, but a section number takes a comma and the label sec. so your reader knows it isn't a page.
  • United States Code. Title 42, sections 1320d–1320d-8, U.S. Government Publishing Office, 1996,United States Code. Title 42, sections 1320d–1320d-8, U.S. Government Publishing Office, 2024,MLA cites the version you read. The 2024 edition of the code is what's on GovInfo now, even though Congress passed the law in 1996.
  • U.S. Department of Health and Human Services. (n.d.). Summary of the HIPAA Privacy Rule."Summary of the HIPAA Privacy Rule." U.S. Department of Health and Human Services, 14 Mar. 2025,That's APA. MLA starts with the title in quotation marks when the agency wrote the page and runs the site, uses the page's review date, and never writes n.d.

Quick checklist

  • Public law: United States, Congress, then Public Law 104-191
  • Statutes at Large in italics, vol. 110, 1996, pp. 1936–2103
  • U.S. Code: Title 42 and the sections, with the year of the edition you read
  • Names of laws and codes in plain type, never italics
  • In text: (United States, Congress), with sec. and the section when you point to one
  • Privacy Rule requirements cited to 45 C.F.R., HHS's summary cited as a webpage

Questions students ask

Do I cite HIPAA or the HIPAA Privacy Rule?

Cite the one that says what you're claiming. HIPAA is the 1996 law, and it told HHS to set privacy standards. The Privacy Rule is the regulation HHS wrote, and it holds the details nurses work with, like what counts as protected health information and when it can be shared. Papers about patient privacy in practice usually cite the Privacy Rule, and some cite both.

Can I write (HIPAA) as my in-text citation?

No. The in-text citation has to match the first words of the Works Cited entry, and that entry starts with United States. Use HIPAA freely in your sentences once you've spelled out the act's name.

Should I cite the public law or the U.S. Code?

Cite the version you actually read. The public law is the act as Congress passed it, in one piece. The U.S. Code is the law as it stands today, organized by subject, and it's the better choice when you're writing about one section. MLA's advice for the code is to cite the code in your Works Cited list and point to the title and section in your text.

How do I cite the HIPAA Security Rule or the Breach Notification Rule?

The same way as the Privacy Rule, as regulations in 45 C.F.R. Part 164 with HHS as the author. The Security Rule is Subpart C (sections 164.302 through 164.318), and breach notification is Subpart D (sections 164.400 through 164.414). Use the subpart's name as the title and the year of the edition you read.

What about the HITECH Act?

The HITECH Act, which strengthened HIPAA's privacy and security rules in 2009, doesn't have its own public law number. It's part of the American Recovery and Reinvestment Act of 2009, Public Law 111-5, in volume 123 of the Statutes at Large. Cite Public Law 111-5 the same way as HIPAA, and name the Health Information Technology for Economic and Clinical Health Act in your sentence.

My instructor wants legal citations like 42 U.S.C. § 1320d. Is that MLA?

The MLA Style Center describes a hybrid method for readers who know legal citation: the legal citation takes the place of the author and title, and the rest of the entry follows the MLA template. It's meant for specialist readers, so use it only if your instructor asks for it.

Rules checked against the MLA Handbook (9th ed.), chapter 5 (the core elements, containers, and government authors) and chapter 6 (in-text citations), and the MLA Style Center's posts Documenting Legal Works in MLA Style (laws and codes in plain type, the public law and U.S. Code examples, citing the version you consulted, and the hybrid method) and How to Cite a State Law. Example sources verified on GovInfo (Public Law 104-191 at 110 Stat. 1936–2103 in the granule record; the 2024 edition of the U.S. Code, Title 42, sections 1320d and 1320d-2; the 2025 edition of 45 C.F.R., issued 1 Oct. 2025) and on the HHS page itself (title and review date, 23 Oct. 2026 archived copy).

PERRLA builds HIPAA's Works Cited entry from the public law number or the U.S. Code section, ready for your MLA paper.

Try PERRLA free for 7 days