HIPAA

What is HIPAA?

The Health Insurance Portability and Accountability Act of 1996 is a US federal law. Its Administrative Simplification provisions led the Department of Health and Human Services (HHS) to issue national rules for protecting health information. These rules are codified mainly in 45 CFR Parts 160 and 164:

• the Privacy Rule: uses and disclosures of protected health information (PHI) and individuals’ rights;
• the Security Rule: safeguards for electronic PHI (ePHI);
• the Breach Notification Rule: notice after breaches of unsecured PHI;
• the Enforcement Rule: investigations and civil money penalties.

The HITECH Act of 2009 strengthened HIPAA. It made business associates directly liable, created breach notification requirements and increased penalties. Those changes were implemented through the 2013 Omnibus Rule.

Purpose and objectives

HIPAA’s privacy and security rules aim to protect individuals’ health information while still allowing the flow of information needed for high-quality care, payment and public health. The Security Rule is deliberately flexible and scalable. It sets outcomes, and organisations choose measures appropriate to their size, complexity, capabilities and risks.

Who does it apply to?

Many technology vendors become business associates simply by hosting or processing PHI for a covered entity, even if they never look at the data.

Core requirements

Privacy Rule

The Privacy Rule sets when PHI may be used or disclosed without authorisation, for example for treatment, payment and health care operations, and when authorisation is required. It includes the minimum necessary standard, the Notice of Privacy Practices, and individual rights such as access to records and requesting amendments.

Security Rule

The Security Rule requires covered entities and business associates to ensure the confidentiality, integrity and availability of ePHI. Its safeguards fall into three groups:

Each standard has implementation specifications that are either required or addressable. Addressable does not mean optional: the organisation must assess it, then implement it or document an equivalent alternative.

The risk analysis is the foundation. HHS guidance describes it as an accurate and thorough assessment of the potential risks and vulnerabilities to ePHI. Missing or inadequate risk analysis is among the most frequently cited problems in OCR enforcement.

Breach Notification Rule

A breach is an impermissible use or disclosure that compromises the security or privacy of PHI. It is presumed to be a breach unless a documented risk assessment shows a low probability that the PHI has been compromised. When unsecured PHI is breached:

• individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery;
• HHS must be notified. For breaches affecting 500 or more individuals, at the same time as individuals. For smaller breaches, in an annual log within 60 days of the end of the calendar year;
• prominent media outlets must be notified when a breach affects more than 500 residents of a state or jurisdiction;
• business associates must notify the covered entity.

PHI encrypted in line with HHS guidance is not “unsecured”, so it falls outside these notification duties.

Enforcement

The HHS Office for Civil Rights (OCR) investigates complaints and breach reports, conducts compliance reviews, and can agree resolution agreements with corrective action plans or impose civil money penalties. Penalties are tiered by culpability and adjusted annually for inflation. Criminal violations are referred to the Department of Justice. State attorneys general may also bring civil actions under HIPAA.

Implementation lifecycle

1. Determine status. Are you a covered entity, a business associate, or neither for each line of business?
2. Locate PHI. Inventory systems, data flows and vendors that touch PHI or ePHI.
3. Risk analysis. Enterprise-wide, covering all ePHI, and kept up to date.
4. Risk management plan. Prioritise and implement safeguards.
5. Policies and procedures. Privacy, security and breach response, kept for six years.
6. Business associate agreements. Upstream and downstream.
7. Workforce training and sanctions policy.
8. Periodic evaluation. Technical and non-technical, after environmental or operational changes.

Evidence and documentation

The rules require documentation to be kept for six years from creation or last effective date. OCR commonly requests risk analyses and risk management plans, policies and procedures, training records, BAAs, access and audit log reviews, incident and breach records, contingency and backup testing evidence, and the Notice of Privacy Practices.

The proposed Security Rule update

In January 2025 HHS published a notice of proposed rulemaking to strengthen the Security Rule. Proposals included removing the addressable/required distinction, requiring written asset inventories and network maps, mandating encryption and multi-factor authentication with limited exceptions, and setting specific timeframes for restoring systems and for compliance audits. It is a proposal: see the open questions on this page.

Common misconceptions and pitfalls

• “We’re HIPAA certified.” There is no such government certification.
• “Our cloud provider handles HIPAA.” The provider may sign a BAA, but the shared responsibility for configuration, access and monitoring remains.
• Narrow risk analyses that cover only the EHR and leave out email, backups, laptops and SaaS tools.
• Treating addressable specifications as optional.
• Missing the 60-day outer limit while waiting for a complete investigation.

Relationship with other frameworks