Everything you need to know about HIPAA compliance. Learn the Privacy Rule, Security Rule, Breach Notification requirements, and more.
The Health Insurance Portability and Accountability Act (HIPAA) was enacted by Congress in 1996. While originally focused on health insurance portability, HIPAA has evolved to become the primary federal law protecting patient health information.
HIPAA establishes national standards for:
The HIPAA Privacy Rule establishes national standards for protecting individuals' medical records and other personal health information (PHI).
**2026 Update:** New NPP requirements take effect February 2026, requiring clearer language and additional disclosures about patient rights.
The HIPAA Security Rule establishes standards for protecting electronic Protected Health Information (ePHI). It requires three types of safeguards:
**Risk Assessment Requirement:** Organizations must conduct regular risk assessments to identify vulnerabilities and implement appropriate controls.
The HIPAA Breach Notification Rule requires covered entities to notify affected individuals, HHS, and in some cases the media following a breach of unsecured PHI.
An impermissible use or disclosure of PHI that compromises its security or privacy. A breach is presumed unless you can demonstrate low probability of compromise.
**Documentation:** Maintain documentation of all breaches and notifications for 6 years.
A covered entity is any organization that electronically transmits health information in connection with certain transactions.
**Key Point:** If you're a covered entity, you must comply with all HIPAA rules, train your workforce, and ensure your business associates also comply.
A business associate is a person or organization that performs functions involving the use or disclosure of PHI on behalf of a covered entity.
Every business associate relationship requires a written BAA that specifies:
**Important:** A covered entity is responsible for ensuring their BAs comply with HIPAA. Regular vendor assessments are recommended.
**Subcontractors:** Business associates must also have BAAs with their subcontractors who handle PHI.
**Protected Health Information (PHI)** is individually identifiable health information that is transmitted or maintained in any form.
1. Names
2. Geographic data (smaller than state)
3. Dates (except year) related to an individual
4. Phone numbers
5. Fax numbers
6. Email addresses
7. Social Security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate/license numbers
12. Vehicle identifiers and serial numbers
13. Device identifiers and serial numbers
14. Web URLs
15. IP addresses
16. Biometric identifiers
17. Full-face photos
18. Any other unique identifying number or code
PHI that is created, received, maintained, or transmitted electronically. This includes:
Health information with all 18 identifiers removed (Safe Harbor) or certified by an expert (Expert Determination) is not considered PHI and is not protected by HIPAA.
HIPAA violations can result in significant civil and criminal penalties enforced by the HHS Office for Civil Rights (OCR).
|------|-------------|---------|---------|
Can also bring civil actions on behalf of state residents for HIPAA violations.
OCR is increasingly aggressive with enforcement. Small practices are not exempt - several have faced six-figure settlements.
Take the HIPAA Basics quiz to earn your certificate and verify your understanding.
Take the Quiz