by Quick answer: HIPAA compliance means following the US federal rules that protect patients’ health information. It applies to healthcare providers, health plans and clearinghouses (covered entities) and to the vendors that handle their data (business associates). You comply by completing a documented risk analysis, putting administrative, physical and technical safeguards in place, training your workforce, signing business associate agreements and being ready to respond to breaches.
What is HIPAA?
The Health Insurance Portability and Accountability Act (HIPAA) was passed in 1996. Its original goals were to make health insurance portable between jobs and to reduce administrative cost, but it is best known today for the rules it created to protect sensitive patient information, called protected health information (PHI).
Those rules are enforced by the Office for Civil Rights (OCR) at the US Department of Health and Human Services (HHS). Four rules matter most in day-to-day compliance:
- The Privacy Rule controls how PHI may be used and disclosed and gives patients rights over their records.
- The Security Rule sets out safeguards for electronic PHI (ePHI).
- The Breach Notification Rule says who must be told, and when, if PHI is compromised.
- The Enforcement Rule describes investigations, penalties and procedures.
Who must comply with HIPAA?
HIPAA applies to two groups, and the second group catches many technology companies by surprise.
Covered entities
- Healthcare providers who transmit health information electronically in connection with standard transactions, such as billing insurers: doctors, dentists, hospitals, clinics, pharmacies, therapists and labs.
- Health plans: insurers, HMOs, employer-sponsored plans and government programmes such as Medicare and Medicaid.
- Healthcare clearinghouses: organisations that convert health data between formats.
Business associates
A business associate is any person or company that creates, receives, maintains or transmits PHI on behalf of a covered entity. Typical examples are cloud hosting providers, billing and coding companies, IT managed service providers, electronic health record vendors, document shredding services, law firms and consultants with access to patient data. Business associates are directly liable for compliance with the Security Rule and parts of the Privacy and Breach Notification Rules, and they must sign a Business Associate Agreement (BAA) with the covered entity. Their own subcontractors that touch PHI must sign BAAs too.
What counts as PHI?
PHI is individually identifiable health information that relates to a person’s past, present or future health, healthcare or payment for healthcare. HIPAA lists 18 types of identifiers that make information identifiable, including:
- Names and geographic details smaller than a state
- Dates related to an individual (birth, admission, discharge)
- Phone numbers, fax numbers and email addresses
- Social Security, medical record, health plan and account numbers
- Device identifiers, IP addresses and web URLs
- Biometric identifiers and full-face photographs
- Any other unique identifying number or code
When this information is created, stored or sent electronically, it is ePHI, and the Security Rule applies. Information that has been properly de-identified is not PHI.
The Privacy Rule in practice
The Privacy Rule applies to PHI in any form: paper, spoken or electronic. It allows use and disclosure without patient authorisation for treatment, payment and healthcare operations, and for certain public interest purposes. Other uses, such as marketing, generally require written authorisation. The “minimum necessary” standard says you should use and disclose only the information needed for the task.
Patients have enforceable rights: to receive a notice of privacy practices, to access and obtain copies of their records (generally within 30 days), to request corrections, to receive an accounting of certain disclosures and to request restrictions or confidential communications.
The Security Rule in practice
The Security Rule is designed to be flexible and scalable: a solo practice and a hospital system must meet the same standards, but they can implement them differently. It is organised into three types of safeguards.
Administrative safeguards
- A documented, organisation-wide security risk analysis and risk management plan
- A designated security official
- Workforce training, sanctions and access management procedures
- Contingency planning: backups, disaster recovery and emergency mode operations
- Periodic evaluation of your safeguards
- Business associate agreements
Physical safeguards
- Facility access controls
- Workstation use and security policies
- Device and media controls, including disposal and re-use
Technical safeguards
- Unique user identification and automatic logoff
- Access control, including emergency access procedures
- Audit controls that record activity in systems containing ePHI
- Integrity controls and person or entity authentication
- Transmission security, including encryption where reasonable and appropriate
Specifications are either “required” or “addressable”. Addressable does not mean optional. You must implement the control, implement an equivalent alternative, or document why neither is reasonable.
Breach notification
If unsecured PHI is acquired, accessed, used or disclosed in a way the Privacy Rule does not permit, it is presumed to be a breach unless a risk assessment shows a low probability of compromise. You must notify affected individuals without unreasonable delay and within 60 days of discovery. Breaches affecting 500 or more people must also be reported to HHS within the same period and, where more than 500 residents of a state are affected, to prominent media in that state. Smaller breaches are logged and reported to HHS annually. Business associates must notify the covered entity.
Data that is encrypted to recognised standards is considered “secured”, which is one of the strongest reasons to encrypt laptops, phones and backups.
How to start a HIPAA compliance programme
- Appoint accountable people. Name a privacy officer and a security officer. In small organisations one person may do both.
- Map your data. List every system, device, vendor and process that touches PHI.
- Complete a security risk analysis. Identify threats and vulnerabilities, rate the risk and record your decisions.
- Build a remediation plan. Prioritise by risk, assign owners and dates, and track completion.
- Write practical policies. Cover access, incident response, device use, retention, sanctions and breach notification.
- Train staff. At hire and at least annually, with short refreshers and phishing simulations.
- Manage vendors. Inventory business associates, sign BAAs and review their security.
- Test your response. Run a tabletop exercise for a ransomware or lost-laptop scenario.
- Document and review. Keep records for six years and revisit the programme at least annually.
Common HIPAA violations
- No risk analysis, or one that is years out of date
- Unencrypted laptops, phones or backup media that are lost or stolen
- Employees accessing records without a job-related reason (“snooping”)
- Failing to sign BAAs with vendors
- Delays in giving patients access to their records
- Sending PHI through unsecured email, text or consumer messaging apps
- Improper disposal of paper records or devices
- Failing to remove access when staff leave
Penalties for non-compliance
Civil penalties are tiered according to culpability: from lack of knowledge, to reasonable cause, to wilful neglect that is corrected, to wilful neglect that is not corrected. Per-violation amounts and annual caps are adjusted for inflation each year, and at the top tier annual caps run into the millions of dollars, so check current HHS figures. Criminal penalties, including fines and imprisonment, apply to knowingly obtaining or disclosing PHI in violation of the law. Beyond fines, organisations commonly face multi-year corrective action plans, monitoring, legal costs and damage to patient trust. State attorneys general can also bring HIPAA actions.
Common HIPAA myths
- “There’s a HIPAA certification.” There is no official government certification. Third-party assessments can support your programme but do not make you “certified”.
- “Our cloud provider is HIPAA compliant, so we are.” The provider secures its platform; you remain responsible for configuration, access and policies.
- “We’re too small.” Size does not exempt you. OCR has settled cases with small practices.
- “HIPAA stops us sharing information with patients’ families.” The rules allow certain disclosures to family members involved in care, in line with patient preferences.
Key takeaways
- HIPAA applies to covered entities and their business associates, including many technology vendors.
- The security risk analysis is the foundation, and the most common gap in enforcement actions.
- Safeguards must be documented. If it isn’t written down, it is hard to prove.
- Encrypt devices and backups, control access and train people.
- Know your breach notification duties before you need them.
HIPAA in different settings
The rules are the same everywhere, but the practical issues vary by setting, and it helps to recognise your own. Small medical and dental practices typically rely on a cloud practice-management system, a patient portal and a handful of vendors, so their biggest risks are weak passwords, shared logins at the front desk, unencrypted laptops and email used to send records. Behavioural health providers hold especially sensitive notes, and some information may also be protected by additional federal rules for substance use disorder records, so access controls and consent management need extra care. Billing and revenue-cycle companies are business associates handling large volumes of claims data, which makes access logging, subcontractor management and breach readiness critical. Software and cloud companies that host or process PHI must be able to demonstrate their safeguards to customers through assessments, penetration tests and, increasingly, SOC 2 or HITRUST reports. Employers that sponsor health plans have obligations for the plan data they hold, which must be kept separate from ordinary employment records.
Handling patient requests: a workable process
Patient rights are one of the most frequently investigated areas, and most violations come from process failure rather than bad intent. A reliable workflow has four parts. First, a single intake point, such as a form and a named mailbox, so requests are not lost between departments. Second, identity verification proportionate to the sensitivity of the request. Third, a clear timeline, with the acknowledgement and fulfilment dates logged, because access requests generally must be answered within 30 days. Fourth, a standard way to deliver records in the format the patient asks for, including electronically where it is readily producible, with an explanation of any fee that is permitted. Train front-desk and records staff on these steps, and include them in your privacy officer’s quarterly checks.
What an investigation or audit looks like
If a patient complaint, a breach report or a random audit brings you to the attention of the Office for Civil Rights, you will receive a data request that typically asks for your risk analysis, policies and procedures, training records, business associate agreements, evidence of access controls and logs, and documentation of the incident and your response. Investigators look for two things: whether you had the required safeguards in place before the event, and whether you responded appropriately afterwards. Organisations that can produce current, dated, signed documents and a clear timeline of actions usually fare far better than those assembling paperwork under pressure. Many cases end with technical assistance or a resolution agreement that includes a corrective action plan and several years of reporting.
Modern technology questions that come up
- Email and text: email is permitted if you take reasonable safeguards such as encryption or patient-approved unencrypted communication after being warned of the risk; routine texting should use secure messaging tools.
- Cloud services: you may use cloud storage and applications if a business associate agreement is in place and you configure access, encryption and logging properly.
- AI tools and chatbots: entering PHI into a tool is a disclosure to a vendor, so it requires a BAA and a risk assessment; consumer tools that train on inputs are not appropriate.
- Remote work: remote staff must follow the same safeguards, including managed devices, secure connections and private environments.
- Websites and apps: analytics and advertising trackers on patient-facing pages can create impermissible disclosures if they transmit identifiers to third parties.
Frequently Asked Questions
What is HIPAA compliance in simple terms?
It means protecting patient health information by following the HIPAA Privacy, Security and Breach Notification Rules: limiting who can see data, securing it with technical, physical and administrative safeguards, and reporting breaches properly.
Does HIPAA apply to small practices?
Yes. Size does not exempt you. The Security Rule is scalable, so safeguards can be proportionate to your size and risk, but you must still meet every standard.
Is a HIPAA-compliant cloud provider enough?
No. The provider secures its infrastructure and signs a BAA, but you remain responsible for how you configure and use the service, who has access and what policies you follow.
How often should we do a risk analysis?
Regularly, and whenever your environment changes significantly, such as new systems, vendors, locations or an incident. Most organisations perform a full review at least annually.
What are the penalties for HIPAA violations?
Civil penalties range from relatively small per-violation amounts to millions of dollars per year for the most serious wilful neglect, plus possible criminal penalties and corrective action plans.
Do employees need HIPAA training?
Yes. All workforce members who handle PHI must be trained, at onboarding and periodically, with the training documented.
Need help getting HIPAA-ready?
We help healthcare organisations and their vendors build a defensible, documented programme, from risk analysis to policies and training. Explore our HIPAA compliance services →
