Term

HIPAA

US law protecting health information.

The Health Insurance Portability and Accountability Act sets standards for the protection of electronic protected health information (ePHI). It includes a Privacy Rule, Security Rule, and Breach Notification Rule.

HIPAA, explained

The Health Insurance Portability and Accountability Act became law in the United States in 1996. The parts that matter to security and compliance teams are its Administrative Simplification rules, issued by the Department of Health and Human Services (HHS) and enforced by the HHS Office for Civil Rights (OCR). The first question with HIPAA is always the same: are you covered at all?

Covered entity or business associate

Role, Who it includes, Example comparison
Role	Who it includes	Example
Covered entity	Health plans, health care clearinghouses, and health care providers that conduct certain standard transactions electronically	A hospital, a health insurer, a clinic that bills insurers electronically
Business associate	A person or organization that creates, receives, maintains, or transmits protected health information on behalf of a covered entity	A cloud EHR vendor, a medical billing company, a SaaS analytics provider for a health plan
Subcontractor	A business associate's own vendor handling that PHI; treated as a business associate	The hosting provider used by the EHR vendor

A health app that consumers use on their own, with no covered entity involved, may fall outside HIPAA entirely, though other laws can still apply. Conversely, a technology company with no clinical activity becomes subject to HIPAA obligations the moment it handles PHI for a covered entity. Since the HITECH Act of 2009, business associates are directly liable for complying with the Security Rule.

Three rules, three different jobs

Privacy Rule: governs how protected health information (PHI) in any form, including paper and speech, may be used and disclosed, and gives individuals rights such as access to their records. It includes the minimum necessary standard.
Security Rule: applies only to electronic PHI (ePHI) and requires administrative, physical, and technical safeguards to protect its confidentiality, integrity, and availability.
Breach Notification Rule: requires notification to affected individuals, HHS, and in larger breaches the media, following a breach of unsecured PHI.

How the Security Rule is structured

The Security Rule is organized into standards, each with implementation specifications that are either required or addressable. Addressable does not mean optional. It means you must assess whether the specification is reasonable and appropriate for your environment; if it is, implement it, and if not, document why and implement an equivalent alternative where reasonable. Auditors and OCR investigators look for that documented reasoning.

Safeguard category, Examples of standards comparison
Safeguard category	Examples of standards
Administrative	Security management process including risk analysis, workforce security, security awareness training, contingency planning
Physical	Facility access controls, workstation security, device and media controls
Technical	Access control, audit controls, integrity, person or entity authentication, transmission security

Breach notification timelines

Individuals: without unreasonable delay and no later than 60 calendar days after discovery.
HHS, 500 or more individuals affected: within the same 60-day window.
HHS, fewer than 500 individuals: may be logged and reported annually, within 60 days of the end of the calendar year.
Media: required when a breach affects more than 500 residents of a state or jurisdiction.
Business associates: must notify the covered entity, within the timeframe set by regulation and their business associate agreement.

For how HIPAA safeguards map to a working control set, see the HIPAA framework page and the healthcare industry page.

FAQ

Frequently asked questions

Is there an official HIPAA certification?

No. HHS does not certify or endorse any HIPAA certification. Third parties offer assessments and attestations, and frameworks such as HITRUST CSF or SOC 2 reports mapped to HIPAA can provide useful assurance, but none of them is a government certification of HIPAA compliance. Compliance is demonstrated through your own safeguards, documentation, and risk analysis.

What is a business associate agreement?

A business associate agreement, or BAA, is a contract required between a covered entity and a business associate, and between a business associate and its subcontractors. It sets out permitted uses of PHI, requires appropriate safeguards, and obliges the business associate to report breaches. Handling PHI without one is itself a compliance failure.

Does encryption exempt a breach from notification?

Breach notification applies to unsecured PHI. PHI encrypted in line with HHS guidance, with the key not compromised, is not considered unsecured, so its loss generally does not trigger notification. Encryption is an addressable specification under the Security Rule, but this safe harbor is a strong practical reason to implement it.

Does HIPAA apply to all health data?

No. HIPAA applies to protected health information held by covered entities and their business associates. Health data collected by organizations outside that relationship, such as some consumer wellness apps or employers acting outside a health plan, may not be covered by HIPAA, although state privacy laws or FTC rules may still apply.

Keep exploring