HIPAA compliance

What is HIPAA compliance?

HIPAA compliance refers to meeting the standards set by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), a U.S. law designed to protect patient health information. At its core, HIPAA compliance ensures that protected health information (PHI) such as names, medical records, Social Security numbers, and insurance details is handled securely and only shared when legally permitted. These rules apply to covered entities (like healthcare providers, insurers, and clearinghouses) and business associates (vendors who handle PHI on behalf of covered entities).

How HIPAA compliance works

Compliance is built around four main rules:

• Privacy Rule: Governs how PHI can be used and disclosed, giving patients rights over their health information.

• Security Rule: Requires administrative, physical, and technical safeguards to protect electronic PHI (ePHI).

• Breach Notification Rule: Mandates timely reporting of data breaches to affected individuals and authorities.

• Omnibus Rule: Extends compliance obligations to business associates and strengthens enforcement. 

Organizations achieve compliance through risk assessments, documented policies, staff training, encryption, and secure data handling practices. The Department of Health and Human Services (HHS) and its Office for Civil Rights (OCR) enforce these standards through audits and penalties for violations.

Who needs to be HIPAA compliant?

HIPAA applies to covered entities and business associates:

• Covered entities include healthcare providers, health plans, and healthcare clearinghouses.

• Business associates are vendors or contractors who work with covered entities and have access to protected health information (PHI), such as billing services or IT providers.

If your organization falls into either category, you’re legally required to follow HIPAA’s privacy and security rules.

Why is HIPAA compliance important?

HIPAA is critical for protecting patient privacy, preventing identity theft, and building trust between healthcare organizations and patients. It also standardizes electronic health transactions, reducing administrative complexity and improving efficiency. Non-compliance can lead to severe fines of up to $2 million per violation category and reputational damage. For patients, HIPAA guarantees rights such as accessing and correcting their medical records, ensuring transparency and control over personal health data.

Who needs to comply with HIPAA?

Any organization that creates, stores, or transmits PHI electronically, including healthcare providers, insurers, and their business associates.

What counts as PHI?

Any information that can identify a patient and relates to their health status, treatment, or payment, such as names, addresses, medical records, and even email addresses.

Is email HIPAA compliant?

Only if it uses encryption and meets HIPAA security standards. Regular email without safeguards can violate HIPAA.

Do health apps have to follow HIPAA?

Not always. Apps like fitness trackers or symptom checkers may not be covered unless they’re connected to a healthcare provider.

What happens if you violate HIPAA?

Penalties vary for minor infractions to significant sums (in the millions) for serious infractions and/or willful neglect. Criminal charges and consequences like loss of patient trust may also occur.