HIPAA Privacy Rule 164.530gh: No intimidating or retaliatory acts; no waiver of rights as a condition of treatment, payment, enrollment or eligibility

A covered entity may not intimidate, threaten, coerce, discriminate against or take other retaliatory action against anyone exercising a Privacy Rule right or participating in a Privacy Rule process, and may not require an individual to waive a Privacy Rule right as a condition of treatment, payment, enrollment in a health plan or eligibility for benefits, per 164.530(g) and (h).