HIPAA
Also known as: Health Insurance Portability and Accountability Act, HIPAA compliance, PHI, Protected Health Information
HIPAA (the Health Insurance Portability and Accountability Act) is a US federal law passed in 1996 that establishes national standards for protecting individually identifiable health information, known as Protected Health Information (PHI).
It applies to health plans, healthcare providers, and healthcare clearinghouses (covered entities), as well as their business associates who handle PHI on their behalf. Violations can result in civil fines that, after annual inflation adjustments, range from about $140 to more than $70,000 per violation and, in serious cases, criminal prosecution.
HIPAA, explained at three levels
At home
HIPAA is the law that controls who can see your medical information and how doctors, hospitals, and insurers must protect it. Your doctor cannot share your diagnosis with your employer without your consent. You have the right to ask for a copy of your medical records. When a hospital is hacked and patient data leaks, HIPAA is why they are legally required to tell you.
At work
HIPAA applies to your organization if you are a healthcare provider, health plan, or clearinghouse, or if you are a vendor that handles protected health information on behalf of any of those entities (a business associate). It requires technical safeguards (encryption, access controls), administrative safeguards (policies, training, risk assessments), and physical safeguards (secured server rooms, workstation controls). A signed Business Associate Agreement (BAA) is mandatory before sharing PHI with any third-party vendor.
At home
Protected Health Information (PHI) is any individually identifiable information about a person's health status, care, or payment for care. The 18 HIPAA identifiers include name, address, birth date, and device identifiers, among others. De-identified data that has had all 18 identifiers removed falls outside HIPAA scope. The Minimum Necessary standard requires covered entities to use or disclose only the PHI needed to accomplish the intended purpose.
At work
The Security Rule applies specifically to electronic PHI (ePHI). Its safeguards include required specifications, such as unique user IDs, audit controls, and a written risk analysis updated when the environment changes, and 'addressable' ones, such as automatic logoff and encryption of ePHI, which an organization must implement or document a reasonable alternative for. A rule HHS proposed in January 2025 would make encryption mandatory, but as of late 2026 it had not been finalized. The Breach Notification Rule requires notification within 60 days of discovering a breach affecting 500 or more individuals in a state, and simultaneous notification to HHS and prominent media in that state.
At home
HIPAA enforcement is handled by the HHS Office for Civil Rights (OCR). Penalties are tiered by culpability: Tier 1 (did not know) starts at about $140 per violation; Tier 4 (willful neglect, uncorrected) reaches about $71,000 per violation, with an annual cap of roughly $2.1 million per violation category (figures are adjusted for inflation each year). The HITECH Act extended direct liability to business associates. State attorneys general can also enforce HIPAA in their jurisdictions.
At work
From a practitioner standpoint, the risk analysis is the cornerstone of HIPAA compliance: OCR audits consistently cite inadequate risk analysis as the top finding. A compliant risk analysis must identify threats and vulnerabilities to ePHI, assess likelihood and impact, and document mitigation measures. HIPAA does not prescribe specific technologies, which means organizations must justify their security choices against their specific risk profile. Mapping HIPAA Security Rule controls to NIST SP 800-66 provides a defensible framework and integrates with broader NIST-based security programs.
Real-world examples
At home
Marcus visited his GP and was later contacted by a pharma company with information about his condition. His GP's practice had sold patient data to a marketing firm without his written authorization. That is a HIPAA violation, and Marcus can file a complaint with the HHS Office for Civil Rights.
At work
Aisha's team at ClearView Health Analytics built a dashboard pulling patient data from three hospital systems. Before receiving any data, they signed a Business Associate Agreement with each hospital, confirmed data was encrypted in transit using TLS 1.2+, and implemented role-based access so analysts only saw the minimum fields needed for each report.
Common confusions
- HIPAA covers health information held by healthcare providers and their vendors: it does not apply to a wellness program your employer runs outside its group health plan, a consumer fitness app like Fitbit, or a general technology company that happens to store health-related information. If your app is not working with a covered entity under a BAA, HIPAA likely does not apply to it.
- A HIPAA violation does not automatically mean a data breach occurred. Violating the Minimum Necessary standard (such as a nurse accessing patient records for a patient they are not treating) is a HIPAA violation even if no data left the building. Equally, a breach can occur without a HIPAA violation if the breached entity had all required safeguards in place and the breach was nonetheless unpreventable.
- HIPAA does not give patients absolute privacy from everyone. It regulates covered entities specifically. A hospital can share PHI without patient consent for treatment, payment, and healthcare operations, and in limited cases for public health reporting, law enforcement, and national security. The law is about controlled disclosure, not total prohibition.
For analysts
In BA artefacts, HIPAA obligations typically appear as non-functional requirements in any system that stores or transmits patient data. Document which data elements constitute PHI, whether the vendor requires a BAA, and which Security Rule safeguards apply to each data flow. A common gap is treating HIPAA as a one-time checkbox rather than a continuous obligation: risk analyses must be repeated when systems change. Useful acceptance criterion: 'All ePHI must be encrypted at rest using AES-256 and in transit using TLS 1.2 or higher, verified by security testing before go-live.'
History & origin
HIPAA was signed into law in August 1996, primarily to allow workers to carry health insurance between jobs. The Privacy Rule took effect in 2003 and the Security Rule in 2005. The HITECH Act of 2009 significantly strengthened HIPAA by increasing penalties, extending obligations directly to business associates, and introducing the Breach Notification Rule, which requires covered entities to notify affected individuals and the Department of Health and Human Services within 60 days of discovering a breach involving 500 or more individuals.