The Health Insurance Portability and Accountability Act (HIPAA) is a US federal law whose rules set national standards for protecting health information. In practice, “HIPAA” usually means the rules issued under it by the Department of Health and Human Services (HHS): the Privacy Rule, the Security Rule and the Breach Notification Rule. They apply to health plans, healthcare clearinghouses and most healthcare providers, and to the vendors that handle protected health information (PHI) for them. For a technology buyer, HIPAA mostly shows up as a question about vendors: which ones touch PHI, whether they will sign a business associate agreement, and how they protect the data. This entry is an overview, not legal advice.
At a glance
- HIPAA applies to covered entities (health plans, clearinghouses and most providers) and to business associates, the vendors that handle PHI on their behalf.
- The Privacy Rule limits how PHI is used and shared; the Security Rule requires safeguards for electronic PHI; the Breach Notification Rule sets who must be told after a breach.
- A vendor handling PHI generally needs a business associate agreement (BAA), and its own subcontractors need one with it.
- There is no official HIPAA certification; compliance is shown through risk analysis, policies, contracts and evidence of controls.
- Many US states have their own health privacy and breach laws on top of HIPAA, so check what applies with counsel.
What problem it solves
Health information is among the most sensitive data an organization holds, and it moves constantly between providers, insurers, billing firms, labs, software platforms and IT providers. Before HIPAA’s rules, protection varied widely and patients had little say over how their records were used.
HIPAA sets a common floor: limits on use and disclosure, patient rights such as access to their records, required safeguards for electronic data and a duty to report breaches. For a mid-market buyer, the practical problem is narrower. A hospital customer sends a BAA to sign, a clinic group wants to move its phones or file storage to the cloud, or a security incident raises the question of whether it is reportable.
How it works
Protected health information. PHI is individually identifiable health information, covering health status, care or payment, held or sent by a covered entity or business associate. It overlaps with personally identifiable information (PII) but is defined by HIPAA’s own rules. Data properly de-identified under the rule’s methods is outside HIPAA.
Privacy Rule. Sets when PHI may be used or shared without the patient’s authorization, such as for treatment, payment and healthcare operations, requires the minimum necessary information for many uses, and gives patients rights to access and amend their records.
Security Rule. Requires administrative, physical and technical safeguards for ePHI, starting with a documented risk assessment. Some specifications are required and others are addressable, meaning implemented where reasonable or replaced by a documented alternative. HHS has proposed significant changes to this rule; confirm the current status before planning around it.
Breach Notification Rule. After a breach of unsecured PHI, covered entities notify affected individuals without unreasonable delay and within an outer limit set by the rule, notify HHS, and for larger breaches notify the media. Business associates notify the covered entity. See data breach for the broader picture.
Enforcement. The HHS Office for Civil Rights investigates complaints and breaches, and state attorneys general can also bring actions.
Covered entities, business associates and the rules
HIPAA has no compliance levels or certification tiers. Its closest structure is the role an organization plays, which decides which rules apply and how obligations flow through contracts.
| Role | Who it is | What applies | What a buyer or vendor typically shows |
|---|---|---|---|
| Covered entity | Health plans, healthcare clearinghouses, and providers that conduct certain transactions electronically | Privacy, Security and Breach Notification Rules | Risk analysis, policies, notice of privacy practices, signed BAAs |
| Business associate | A vendor that creates, receives, maintains or transmits PHI for a covered entity, such as a billing firm, cloud host, EHR platform or managed IT provider | Security Rule and parts of the Privacy and Breach Notification Rules, plus its BAA; directly liable for its own failures | Signed BAA, risk analysis, security evidence such as a SOC 2 report or a healthcare-focused certification |
| Subcontractor | A business associate’s own vendor that handles PHI, such as the data center behind a SaaS platform | Treated as a business associate, with a BAA between it and the business associate | BAA with the business associate, security evidence |
Penalty tiers. Civil penalties are set in four tiers by culpability: the organization did not know and could not reasonably have known; reasonable cause; willful neglect that was corrected in time; and willful neglect that was not. Amounts rise with each tier and are adjusted for inflation, so check current figures with HHS or counsel. Criminal penalties for knowingly obtaining or disclosing PHI are handled separately by the Department of Justice.
When it matters for buyers
- When a healthcare customer asks you to sign a BAA. Understand what you are agreeing to, including breach reporting and subcontractor terms.
- When choosing cloud, UCaaS, contact center, backup or managed IT services. If PHI will pass through or rest on the service, the provider generally needs to sign a BAA, and the specific product must be covered.
- When an incident happens. A lost device or ransomware attack can trigger a breach assessment and notification duties.
- When building a compliance program. HIPAA safeguards map well to broader data security compliance and governance, risk and compliance (GRC) work.
Our governance, risk and compliance overview covers advisors and platforms that track risk analysis, BAAs and evidence.
Questions to ask vendors
- Will you sign a BAA, and which of your products and services does it cover?
- Do you use subcontractors that handle our PHI, and do you have BAAs with them?
- Where is our PHI stored, including backups, logs, call recordings and support tools?
- What independent evidence of your controls can you share, and is it scoped to the service we would buy?
- How quickly will you tell us about a security incident or breach involving our data?
- Which safeguards do you run, and which configuration, access and encryption settings are our responsibility?
- How is our PHI returned or destroyed when the contract ends?
How it differs from PCI DSS
PCI DSS is an industry standard for payment card data, enforced through contracts with card brands and banks, with defined merchant levels and annual validation. HIPAA is a federal law for health information, enforced by regulators, with obligations based on an organization’s role rather than its volume and no formal validation report. Both expect risk-based security controls, and a healthcare organization that takes card payments usually needs to meet both.
Problems this helps with
- A healthcare customer wants us to sign a business associate agreement
- Not sure whether our cloud, phone or IT vendors can handle patient data
- Worried a lost laptop or ransomware attack would be a reportable breach
- Proving to a hospital or health plan that we protect their patients' data
