Where to Find EPA, FDA, OSHA, SEC, FTC and HIPAA Regulations

You typed "OSHA regulations" and got a stack of summaries. Where is the rule itself? Every federal agency's binding rules sit in the Code of Federal Regulations (CFR). That is the collection of agency rules, sorted into numbered titles. OSHA is in Title 29, the EPA in Title 40, the FDA in Title 21, the SEC in Title 17, the FTC in Title 16, and the HIPAA rules in Title 45 with HHS. At the top of each part, an Authority line names the statute that lets the agency make that rule.

Written and checked on 12 October 2026. This is general information, not legal advice; check the cited statute or opinion before relying on it.

Official text, as of 12 October 2026

Citation: 29 C.F.R. 1904.39, OSHA's rule on reporting a work-related death or serious injury.

What it says, verbatim: "Within eight (8) hours after the death of any employee as a result of a work-related incident, you must report the fatality to the Occupational Safety and Health Administration (OSHA), U.S. Department of Labor."

Read from: the eCFR page for section 1904.39. The eCFR is the government's daily-updated online copy. Our guide to what the eCFR is and whether it is official explains when to check the yearly edition.

What changed in 2025 and 2026: we found no change. The eCFR's version history for this section shows no amendment after January 1, 2017.

TL;DR

• One agency, one home chapter. The table below shows where seven big agencies keep their rules.
• A rule is in the CFR. Guidance is on a website. FAQs and letters explain a rule. They are not the rule.
• Some agencies live in many places. EPA and HHS span several titles and chapters. Title 21 also holds the DEA.
• Read the Authority line. It names the statute behind the rule. The Source line names the Federal Register notice that created it.

The short map

Here are seven agencies, where their rules sit, and a few parts a business may meet. Part titles and Authority lines are copied from the eCFR as it stood on October 8, 2026.

A title is a numbered subject book. A chapter is a section inside it, usually one agency's rules. A part is one set of rules on a topic, and a subpart is a smaller group inside a part.

Rule, statute and guidance are three different things

A statute is a law passed by a legislature. It sits in the US Code. A regulation is the agency's binding text, written under power a statute gave it. It sits in the CFR. Guidance is the agency's explanation: FAQs, letters, manuals. It sits on the agency's website. The SEC's own rules page, for example, lists "Policy Statements," "Staff Guidance" and "No-Action Letters" apart from its rulemaking.

Our guides on statutes versus regulations and USC versus CFR go deeper. To see how much weight guidance carries, read whether agency guidance has the force of law.

How to find the rule itself

1. Pick the title and chapter from the map.
2. Confirm by agency. The eCFR's help page says that "browsing by agency allows you to view a table showing which titles and chapters pertain to the work of each federal agency." The Agencies page has that table.
3. Read the Authority and Source lines at the top of the part.
4. Check the date. The EPA's page says regulations are "codified annually" and calls the eCFR "an up-to-date, unofficial version." Check the yearly edition before you cite a rule in a filing.

A worked example: from a section up to its statute

Take 29 C.F.R. 1904.39 again. It sits in Part 1904, "Recording and Reporting Occupational Injuries and Illnesses." That part is in Title 29, Subtitle B, Chapter XVII, which is OSHA's. The Authority line of Part 1904 starts with 29 U.S.C. 657. The Source line says 66 FR 6122, January 19, 2001, so the Federal Register notice that created the part is easy to find.

Section 657 of Title 29 is headed "Inspections, investigations, and recordkeeping." You can read it in the 2023 Code edition on govinfo.gov. In two steps, you went from a rule to the law that lets OSHA write it.

One agency is rarely one place

The eCFR's agency table lists EPA in Title 40 Chapters I, IV and VII. It also lists EPA in Titles 2, 5, 41 and 48. HHS is in Title 45 Subtitle A, and also Titles 2, 5 and 48. The FDA and the Centers for Medicare & Medicaid Services (CMS) appear under HHS, in Title 21 and Title 42. Title 21 also holds the DEA in Chapter II. A search of Title 21 is not an FDA search.

The FDA says it publishes its regulations in the Federal Register, the government's daily journal of rules and notices. The codified part is then published "under Title 21 of Code of Federal Regulations." Its rules page also says the FDA is "part of the Department of Health and Human Services."

HIPAA is not one rule

People say "the HIPAA rule" as if it were one document. HHS says the official versions are in 45 C.F.R. Parts 160, 162 and 164. In Part 160, Subpart C covers compliance and investigations, Subpart D covers civil money penalties and Subpart E covers hearings. In Part 164, Subpart C holds the security standards for electronic health information. Subpart D covers breach notification. Subpart E covers privacy. Our post on HHS and OCR guidance walks through the guidance side.

There is a twist. In August 2009, two agencies each issued a breach notice rule under the same law, the American Recovery and Reinvestment Act of 2009. HHS published an interim final rule on August 24, 2009 (74 FR 42740). The FTC published a final rule the next day, August 25, 2009 (74 FR 42962), which became 16 C.F.R. Part 318. HHS says it later finalized its breach rule in an Omnibus rule. The HHS notice and the FTC notice are both on the Federal Register site.

The FTC part says it "does not apply to HIPAA-covered entities, or to any other entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity." The FTC amended Part 318 on May 30, 2024 (89 FR 47054). Read the current text before you decide which rule fits a business. Then ask counsel.

What goes wrong

• Reading the FAQ as if it were the rule.
• Searching only Title 40 for "EPA," or only Title 21 for "FDA."
• Treating "HIPAA" as one document. Penalties are in Part 160 and privacy is in Part 164, Subpart E.
• Skipping the Authority and Source lines, and missing which statute and which notice stand behind the part.
• Citing the eCFR in a filing when the yearly edition is the official copy.

Before you rely on a rule, ask: which edition or date am I reading? Is there a newer Federal Register notice? Does this agency have a second chapter that applies? Is there a state version?

This guide is part of US Law Data: The Complete Guide, a map of where US law comes from and how to use it.

FAQ

Where are OSHA regulations?

OSHA's rules are in Title 29 of the CFR, Chapter XVII. OSHA says its standards "are divided into separate standards for General Industry, Construction, and Maritime." Part 1910 is titled Occupational Safety and Health Standards, and Part 1926 holds the construction rules.

Where are EPA regulations?

Mostly in Title 40, Chapter I. The eCFR also lists EPA in Chapters IV and VII and in Titles 2, 5, 41 and 48. Use the Agencies page to see every spot.

Where are FDA regulations?

In Title 21, Chapter I. The FDA is part of HHS. Title 21 also holds the DEA's rules, so check the chapter.

Where are SEC rules and regulations?

In Title 17, Chapter II. Part 240 holds the general rules under the Securities Exchange Act of 1934. The SEC's rules page links an index of its proposed and final rules.

Where are the FTC's rules?

In Title 16, Chapter I. The FTC's legal library lists its rules. A rule page such as the one for the Health Breach Notification Rule points to the CFR part, here Part 318.

Where are HIPAA regulations?

In Title 45, Parts 160, 162 and 164. The privacy rule is Part 164, Subpart E, and the security rule is Subpart C. Breach notice is Subpart D.

What is the difference between a regulation and agency guidance?

A regulation is binding text in the CFR. Guidance is the agency's explanation on its website. Our post on federal agency guidance shows how the two relate.

For the US statutes, regulations and court rules these laws sit in, see the US primary law API.

Priyansh Khodiyar

Co-Founder & CTO

Priyansh leads engineering and AI at Vaquill AI: the pipelines that pull statutes, regulations and court rules from every US jurisdiction's official publisher, and the REST API, MCP server and open dataset that serve them.