What Keel scores in 45 CFR Part 164, and what it does not

Part 164 prints 41 numbered sections. Keel scores duties from 21 of them. The other 20 are out, along with 17 paragraphs inside sections that are scored. This page is all of them by number, so you can disagree with a specific line instead of with a total.

The rule

A paragraph of Part 164 is scored where it imposes a duty, or states a prohibition, that binds without the organization first electing to perform an optional act. It is not scored where its operative effect is to authorize an act, together with the conditions attached to that authorization, or where it is a definition or an applicability provision.

What the rule is not. "It says may" is not the test, and reading it that way is the mistake this register was rebuilt to correct. §164.520(d), §164.522(a)(2), §164.522(b)(2), §164.502(g)(5), §164.504(e)(3), §164.504(e)(4) and §164.514(h)(2) all say "may" and are all scored, because each is a permission attached to a duty the organization already holds and sets the terms on which that duty may be discharged. Equally, §164.508 says "may not use or disclose ... without an authorization" and is still out, because the duty it states only reaches an organization that has chosen to make the disclosure.

Out of scope is not the same as inapplicable. Out of scope is not the same as inapplicable. Every provision of Part 164 binds a covered entity or business associate that falls within it, and a workspace scoring 100% here has not been told it may ignore the authorization rules. What Keel scores is the set of duties that bind whether or not the organization ever elects the act, because those are the ones a readiness percentage can honestly be measured against.

The near misses

Each of these states an obligation in words a reader would recognize as a duty, and is still out. They are the calls most worth checking first, which is why they are named rather than absorbed into the counts above.

• §164.105 Conditions an act the organization elects to perform
  Organizational requirements.

  Reads "The covered entity that is a hybrid entity must ensure that a health care component of the entity complies with the applicable requirements of this part", and (c) requires the designation to be documented and retained for six years. It is out because every duty in it is conditioned on a designation the entity elects to make: a hybrid entity is defined as one "that designates health care components", and (b) opens "may designate themselves". An entity that designates nothing is bound by none of it. This section was in no register in the repo until 2026-09-03, and the one place it was written down filed it under definitions, which it is not.

• §164.508 Conditions an act the organization elects to perform
  Uses and disclosures for which an authorization is required.

  Reads "a covered entity may not use or disclose protected health information without an authorization that is valid under this section", and (a)(2) and (a)(3)(i) read "must obtain an authorization". Keel justified excluding it by its opening verb until 2026-08-27, and the verb does not say what that justification claimed. The exclusion stands on the ratified rule instead: the duty only reaches an organization that has already chosen to make a disclosure of this kind.

• §164.509 Conditions an act the organization elects to perform
  Uses and disclosures for which an attestation is required.

  Reads "may not use or disclose ... without obtaining an attestation that is valid". Same shape as §164.508 and out for the same reason, and it carries the same withdrawn justification. Added to Part 164 by the 2024 reproductive health care privacy rule, 89 FR 33063.

• §164.514(g) Conditions an act the organization elects to perform
  Uses and disclosures for underwriting and related purposes.

  A "may only use or disclose" attached to underwriting, which is an elective activity, so it is out. Contrast §164.502(a)(5)(i), which IS scored: that one is an absolute "shall not" binding a health plan whether or not it ever underwrites. The difference between those two paragraphs is the whole rule in one comparison, which is why this is the closest call on the page.

• §164.106 Points at duties outside the part Keel models
  Relationship to other parts.

  Reads "covered entities and, where provided, business associates, are required to comply with the applicable provisions of parts 160 and 162". That is a real duty, and it is out because what it requires lies in Parts 160 and 162, which this framework does not model. Scoring it would put a row in the denominator whose content is not on the page.

• §164.504(e)(1)(i) Restates a duty Keel already scores elsewhere
  Business associate contracts: the pointer paragraph.

  Not an exclusion and listed here so nobody reads its absence as one. It says the contract must meet (e)(2), (e)(3) or (e)(5), each of which is a scored row already, so a row for it would score the pointer alongside the things it points at. Its siblings (e)(1)(ii) and (e)(1)(iii) ARE scored: they bind different parties and were added under D339.

• §164.502(c) Restates a duty Keel already scores elsewhere
  Uses and disclosures of protected health information subject to an agreed upon restriction.

  Out as a duplicate rather than as a permission, which is a different claim and a weaker one: it is only honest if §164.522(a)(1) actually states the prohibition. The summary on that row was rewritten in the same edit that made this call, for exactly that reason.

Out entirely, by section

Section headings are the CFR's own and are quoted rather than paraphrased. Subpart B of Part 164 is [Reserved] and contains nothing to score.

Out by paragraph, inside sections that are scored

This is the half that stops "§164.502 is in scope" from licensing any subset of it. A ref here matches no scored row, and moving one off the list is a change to the register rather than to a page.

• §164.502(a)(1) Conditions an act the organization elects to perform

  The list of uses and disclosures a covered entity is permitted to make.

• §164.502(c) Restates a duty Keel already scores elsewhere

  Restates the prohibition §164.522(a)(1)(iii) already carries, which Keel scores; scoring both would ask a workspace to satisfy one obligation twice.

• §164.502(d) Conditions an act the organization elects to perform

  Authorizes creating de-identified data, and states that the Privacy Rule does not apply to it.

• §164.502(j) An exemption from liability rather than an obligation

  The whistleblower and crime-victim safe harbors: "is not considered to have violated".

• §164.504(a) Says who is bound, or what a word means

  Definitions for the section.

• §164.504(b) States authority or severability, or is [Reserved]

  [Reserved] in the published text.

• §164.504(c) States authority or severability, or is [Reserved]

  [Reserved] in the published text.

• §164.504(d) States authority or severability, or is [Reserved]

  [Reserved] in the published text.

• §164.514(a) Says who is bound, or what a word means

  Defines information that is not individually identifiable.

• §164.514(b) Conditions an act the organization elects to perform

  The two de-identification methods, which an organization reaches only by choosing to de-identify.

• §164.514(c) Conditions an act the organization elects to perform

  The re-identification code, on the same footing as the methods it belongs to.

• §164.514(e) Conditions an act the organization elects to perform

  The limited data set and data use agreement regime.

• §164.514(f) Conditions an act the organization elects to perform

  Fundraising communications.

• §164.514(g) Conditions an act the organization elects to perform

  Restricts underwriting information where the coverage was not placed. The closest call in this list, and it is argued in full below.

• §164.520(a)(3) Says who is bound, or what a word means

  States to whom the rest of §164.520(a) applies.

• §164.520(a)(4) Says who is bound, or what a word means

  States to whom the rest of §164.520(a) applies.

• §164.530(k) Says who is bound, or what a word means

  States which group health plans the rest of §164.530 reaches. Ruled out 2026-08-17 by Chris, and the reason the count was 92 rather than 93 at the time.

Where the inventory came from

45 CFR Part 164 as published by the eCFR, version 2026-08-01, sha256 233fec3a. Section headings on this page are the CFR’s own and are quoted rather than paraphrased. The scope calls are Keel’s, applying the rule above to the published regulation; they were ratified by Chris as D313, D314, D338 and D339, and they have had no external legal review. Subpart B of Part 164 is [Reserved] and contains nothing to score.

Think one of these belongs in scope? That is the point of publishing it, so tell us which line. The full framework is at HIPAA.