The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that established national standards for certain health-information transactions and for protecting individually identifiable health information. HIPAA is not a single privacy law with one universal rule. Its requirements are spread across several regulations, each addressing a different part of health-information protection.
People commonly refer to the five HIPAA Rules:
The Privacy Rule
The Security Rule
The Breach Notification Rule
The Enforcement Rule
The Omnibus Rule
The first four are distinct regulatory frameworks. The Omnibus Rule is somewhat different: it was a major 2013 rulemaking package that amended several existing HIPAA rules and implemented important provisions of the Health Information Technology for Economic and Clinical Health (HITECH) Act and the Genetic Information Nondiscrimination Act (GINA).⁵
1. The HIPAA Privacy Rule
The HIPAA Privacy Rule establishes standards for protecting protected health information (PHI). PHI is individually identifiable health information held or transmitted by a covered entity or business associate in any form or medium, subject to specific regulatory exclusions.¹
Who must follow the Privacy Rule?
The Privacy Rule applies primarily to:
Health plans
Health care clearinghouses
Health care providers that conduct certain covered electronic transactions
Business associates that perform specified services for covered entities or handle PHI on their behalf
These organizations are often called covered entities and business associates.
HIPAA does not automatically apply to every organization that possesses health information. For example, an organization may hold sensitive health information without being a HIPAA covered entity or business associate. Other federal or state laws may nevertheless apply.
Uses and disclosures of PHI
The Privacy Rule generally limits how covered entities may use or disclose PHI. In many circumstances, an organization may use or disclose PHI without obtaining a separate written authorization for activities involving:
Treatment
Payment
Health care operations
Certain public-health activities
Oversight activities authorized by law
Judicial and administrative proceedings
Law-enforcement purposes under specified conditions
Serious and imminent threats to health or safety
Workers’ compensation matters
Uses or disclosures outside the rule’s permissions generally require the individual’s valid written authorization. An authorization should identify the information to be disclosed, the person or class of people authorized to make the disclosure, the recipient, the purpose, and an expiration date or event.¹
The minimum necessary standard
The minimum necessary standard generally requires covered entities to limit many uses, disclosures, and requests for PHI to the amount reasonably needed for the purpose. The standard is not applied in every situation. For example, it generally does not apply to disclosures made to or requested by a health care provider for treatment, disclosures made to the individual, or disclosures made pursuant to an authorization.¹
“Minimum necessary” does not necessarily mean the smallest conceivable amount of information. It means that the organization should establish reasonable policies and procedures for limiting information based on the purpose of the use or disclosure.
Individual rights under the Privacy Rule
The Privacy Rule gives individuals several important rights, including the right to:
Inspect and obtain copies of many PHI records
Request an amendment to information they believe is inaccurate or incomplete
Receive an accounting of certain disclosures
Request restrictions on certain uses and disclosures
Request confidential communications by alternative means or at alternative locations
Receive a notice describing the organization’s privacy practices
The right of access is broad but not unlimited. Certain categories of information may be excluded or subject to special procedures, including some psychotherapy notes and information prepared for legal proceedings.¹
The Privacy Rule also includes special provisions for minors, personal representatives, deceased individuals, and individuals who are the subject of certain public-health or law-enforcement requests.
Privacy does not mean absolute secrecy
HIPAA does not prohibit every disclosure of health information. It creates a legal structure for permitted, required, and prohibited disclosures. A health care provider may often share relevant information with another provider for treatment without obtaining a separate authorization, but that permission does not eliminate the obligation to use reasonable safeguards and follow the applicable limits.
2. The HIPAA Security Rule
The HIPAA Security Rule protects electronic protected health information (ePHI). It requires covered entities and business associates to implement safeguards that protect the:
Confidentiality of ePHI
Integrity of ePHI
Availability of ePHI
The Security Rule applies to electronic PHI, not to PHI in every format. Paper records and spoken communications may still be protected by the Privacy Rule, but they are not themselves ePHI merely because they concern health information.²
Three categories of safeguards
The Security Rule organizes safeguards into three broad categories.
Administrative safeguards
Administrative safeguards are policies, procedures, and organizational practices designed to manage security risks. Examples include:
Conducting a risk analysis
Implementing a risk-management process
Establishing workforce security procedures
Controlling access to ePHI
Providing security-awareness and training programs
Creating incident-response procedures
Establishing contingency plans
Periodically evaluating the effectiveness of security measures
A risk analysis is not a one-time paperwork exercise. An organization should identify where ePHI is created, received, maintained, or transmitted; evaluate reasonably anticipated threats and vulnerabilities; assess the likelihood and potential impact of identified risks; and document how those risks will be addressed.²
Physical safeguards
Physical safeguards concern the protection of facilities, workstations, and electronic devices. They can include:
Facility-access controls
Procedures for handling visitors
Workstation-use policies
Workstation security
Policies for the disposal and reuse of electronic media
Controls for the movement of devices and media
Physical security remains relevant even in organizations that use cloud services or remote work. A stolen laptop, an exposed workstation, or improperly discarded storage device can create a security incident.
Technical safeguards
Technical safeguards are technology-based controls that protect ePHI and regulate access to electronic systems. Examples include:
Unique user identification
Emergency access procedures
Automatic logoff or similar session controls
Encryption or other transmission protections
Audit controls
Mechanisms for authenticating users or systems
Measures that help protect the integrity of electronic information
Some Security Rule specifications are described as required, while others are described as addressable. “Addressable” does not mean optional in the ordinary sense. An organization must assess whether the safeguard is reasonable and appropriate in its environment. If it does not implement the safeguard, it must document why and implement an equivalent alternative where reasonable and appropriate.²
The Security Rule is risk-based
HIPAA does not prescribe one identical cybersecurity system for every organization. The appropriate safeguards depend on factors such as:
The organization’s size and complexity
Its technical capabilities
The cost of a safeguard
The probability and potential impact of risks
The nature and extent of ePHI handled
Risk-based flexibility does not excuse inaction. An organization should be able to show that it identified relevant risks, selected reasonable safeguards, and revisits its security program when systems, threats, or business practices change.
3. The HIPAA Breach Notification Rule
The Breach Notification Rule addresses certain unauthorized uses or disclosures of unsecured PHI. It requires covered entities and business associates to notify affected parties after a qualifying breach.³
What is a breach?
A breach generally involves the unauthorized acquisition, access, use, or disclosure of PHI in a way that compromises the security or privacy of the information. The rule includes exceptions, such as certain unintentional acquisitions, access, or uses made in good faith within the scope of authority, and certain disclosures where the recipient could not reasonably retain the information.³
A breach of secured PHI may not trigger notification if the information has been rendered unusable, unreadable, or indecipherable to unauthorized people through methods recognized by the Department of Health and Human Services, such as appropriate encryption or destruction.⁶
The risk assessment
Under the current breach framework, an impermissible use or disclosure is generally presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the PHI was compromised through a documented risk assessment. The assessment must consider, at minimum:
The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification.
The unauthorized person to whom the disclosure was made or who used or received the information.
Whether the PHI was actually acquired or viewed.
The extent to which the risk was mitigated.³
The analysis should be documented. Simply concluding that an incident was “probably harmless” is not a substitute for evaluating the required factors.
Required notifications
When notification is required, affected individuals generally must be notified without unreasonable delay and no later than 60 calendar days after discovery of the breach. The notice should explain what happened, the types of information involved, steps individuals can take to protect themselves, what the organization is doing to investigate and mitigate the incident, and how affected individuals can obtain additional information.³
A covered entity must also notify the Secretary of Health and Human Services. Breaches affecting 500 or more residents of a state or jurisdiction generally require notification to prominent media outlets serving that area. Breaches affecting fewer than 500 individuals may generally be reported to HHS annually, but individual notifications are still subject to the applicable deadline.³
Business-associate responsibilities
If a business associate discovers a breach, it must notify the covered entity as required by the regulations and by the parties’ business associate agreement. The covered entity remains responsible for meeting its own notification obligations, although the parties may coordinate the work.
A business associate agreement should address, among other matters, permitted uses and disclosures, safeguards, reporting of incidents and breaches, subcontractor obligations, access to records, amendments, and return or destruction of PHI.² ⁵
4. The HIPAA Enforcement Rule
The Enforcement Rule establishes procedures for investigating and enforcing compliance with the HIPAA Privacy, Security, and Breach Notification Rules.⁴
The HHS Office for Civil Rights may receive complaints, conduct compliance reviews, investigate incidents, request records, interview personnel, and seek corrective action. An investigation may examine not only whether an incident occurred but also whether the organization had appropriate policies, training, risk analyses, safeguards, documentation, and response procedures.
Possible consequences
Potential consequences include:
Voluntary compliance
Technical assistance
Corrective-action plans
Resolution agreements
Civil money penalties
Referral to the Department of Justice in appropriate circumstances
The amount of a civil money penalty depends on factors established by law and regulation, including the nature and extent of the violation, the resulting harm, the history of compliance, the financial condition of the entity, and the level of culpability.⁴
The regulations distinguish among different levels of culpability, including situations involving reasonable cause and willful neglect. Willful neglect generally means conscious, intentional failure or reckless indifference to the obligation to comply.⁴
HIPAA also includes criminal penalties for certain knowing violations involving individually identifiable health information. Criminal enforcement is handled by the Department of Justice rather than by HHS alone.⁷
Complaints and investigations
An individual may file a complaint with HHS regarding an alleged violation of the Privacy, Security, or Breach Notification Rule. A complaint is not the same as a private lawsuit under HIPAA. HIPAA generally does not create a private federal right of action allowing individuals to sue directly for damages solely because a HIPAA violation occurred. State laws may provide separate remedies, depending on the circumstances.
5. The HIPAA Omnibus Rule
The Omnibus Rule, published in 2013, amended multiple HIPAA regulations. It implemented provisions of the HITECH Act and made other changes to privacy, security, breach-notification, and enforcement requirements.⁵
It is therefore more precise to describe the Omnibus Rule as a comprehensive amendment package rather than as a fifth independent category of HIPAA obligation.
Business associates became more directly accountable
One of the most important changes was the expansion of direct HIPAA responsibility for business associates and certain subcontractors. Business associates may be directly liable for requirements such as:
Complying with applicable Security Rule requirements
Complying with certain Privacy Rule requirements
Reporting breaches
Entering into appropriate arrangements with covered entities or other business associates
Making records available to HHS during an investigation
A written business associate agreement remains important, but an agreement does not shield a business associate from obligations imposed directly by HIPAA.⁵
Changes to breach analysis
The Omnibus Rule changed the breach framework by establishing a presumption that an impermissible use or disclosure of unsecured PHI is a breach unless the organization demonstrates a low probability that the PHI was compromised through a documented risk assessment.⁵
This replaced a more permissive approach under which entities could consider whether the incident posed a significant risk of financial, reputational, or other harm.
Changes involving authorizations and marketing
The Omnibus Rule also modified requirements involving:
Marketing communications
The sale of PHI
Authorizations for certain communications
Fundraising communications
Requests for restrictions on disclosures to health plans
For example, the regulations generally require authorization for the sale of PHI, subject to specified exceptions. The rule also addressed situations in which an individual pays a health care provider in full out of pocket and requests that information not be disclosed to a health plan for payment or health care operations.⁵
Genetic information
The Omnibus Rule incorporated protections related to genetic information under GINA. It revised the HIPAA Privacy Rule’s treatment of genetic information and made related adjustments to the definition of health information and the prohibition on certain uses and disclosures.⁵
How the five rules work together
The five rules address different questions:
Rule | Core question |
|---|---|
Privacy Rule | When may PHI be used or disclosed, and what rights does the individual have? |
Security Rule | How must electronic PHI be protected? |
Breach Notification Rule | What must happen after certain unauthorized uses or disclosures? |
Enforcement Rule | How are violations investigated and penalties imposed? |
Omnibus Rule | How were the HIPAA rules expanded and amended, especially after HITECH? |
They should not be treated as five independent checklists. A single incident can implicate several rules at once.
For example, suppose an employee sends patient records to the wrong recipient:
The Privacy Rule may be relevant because the disclosure was unauthorized.
The Security Rule may be relevant if electronic safeguards, access controls, or procedures were inadequate.
The Breach Notification Rule may require an assessment and possible notifications.
The Enforcement Rule governs how HHS could investigate the organization.
The Omnibus Rule may be relevant to the direct responsibilities of a business associate involved in the incident.
What HIPAA does not mean
Several common statements about HIPAA are inaccurate or incomplete.
“HIPAA means no one can discuss a patient”
Not necessarily. HIPAA permits many disclosures for treatment, payment, health care operations, public health, and other purposes established by regulation. The relevant question is whether the disclosure is permitted, required, or prohibited under the applicable rule.
“HIPAA applies to every health-related business”
Not automatically. HIPAA applies to covered entities and business associates as defined by the statute and regulations. Other privacy laws may apply to organizations outside HIPAA.
“Encryption is the entire HIPAA Security Rule”
No. Encryption can be an important safeguard, but the Security Rule also addresses risk analysis, workforce procedures, access management, physical security, audit controls, contingency planning, incident response, and other administrative, physical, and technical safeguards.
“A small organization does not need a formal HIPAA program”
Size may affect what safeguards are reasonable and appropriate, but it does not eliminate the need to comply when an organization is covered by HIPAA. A small practice may use a simpler compliance program than a large hospital system, but it still needs appropriate policies, training, risk analysis, safeguards, documentation, and response procedures.
Practical compliance questions
A covered entity or business associate should be able to answer questions such as:
What PHI and ePHI does the organization create, receive, maintain, or transmit?
Who is authorized to access it, and why?
Has the organization completed and documented a current risk analysis?
Are access rights reviewed and removed when no longer needed?
Are workforce members trained on privacy and security responsibilities?
Are business associate agreements current?
Is there a written incident-response and breach-assessment process?
Can the organization provide individuals with access to their records within the required framework?
Are paper and electronic records disposed of securely?
Are policies reviewed when technology, staffing, vendors, or workflows change?
Documentation is especially important. HIPAA compliance is not judged solely by an organization’s stated intentions. Policies, training records, risk analyses, access reviews, incident reports, and corrective actions help demonstrate how the organization actually manages protected information.
Final takeaway
The five HIPAA Rules are best understood as parts of one regulatory framework:
The Privacy Rule governs PHI uses, disclosures, and individual rights.
The Security Rule protects electronic PHI.
The Breach Notification Rule addresses qualifying breaches of unsecured PHI.
The Enforcement Rule establishes investigation and penalty procedures.
The Omnibus Rule strengthened and amended the other rules, particularly by expanding business-associate responsibilities and implementing HITECH-related requirements.
HIPAA compliance is therefore more than keeping records confidential. It involves privacy policies, technical and physical safeguards, workforce practices, vendor oversight, individual rights, breach response, documentation, and continuing risk management.
Notes
U.S. Department of Health and Human Services, “Standards for Privacy of Individually Identifiable Health Information,” Code of Federal Regulations, title 45, part 160 and part 164, subparts A and E, current edition.
U.S. Department of Health and Human Services, “Security Standards for the Protection of Electronic Protected Health Information,” Code of Federal Regulations, title 45, part 160 and part 164, subparts A and C, current edition.
U.S. Department of Health and Human Services, “Notification in the Case of Breach of Unsecured Protected Health Information,” Code of Federal Regulations, title 45, part 164, subpart D, current edition.
U.S. Department of Health and Human Services, “Compliance and Investigations,” Code of Federal Regulations, title 45, part 160, subparts C, D, and E, current edition.
U.S. Department of Health and Human Services, “Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules,” Federal Register 78, no. 17 (January 25, 2013): 5566–5702.
U.S. Department of Health and Human Services, “Guidance Specifying the Technologies and Methodologies That Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals,” Federal Register 74, no. 55 (March 23, 2009): 12462–12464.
Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, §§ 1176–1177, 110 Stat. 1936 (1996), codified as amended at 42 U.S.C. §§ 1320d-5 and 1320d-6.