What Is HIPAA Law, Compliance, Violations, Privacy & Security Rules

According to the U.S. Department of Health & Human Services (HHS), the Health Insurance Portability and Accountability Act (HIPAA) sets national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge. The Office for Civil Rights (OCR) enforces HIPAA and has collected millions of dollars in penalties from organizations that fail to comply.

What Is HIPAA?

HIPAA stands for Health Insurance Portability and Accountability Act of 1996. President Bill Clinton signed HIPAA into law on August 21, 1996. The main goal was to protect Americans’ health information while improving the efficiency of the healthcare system.

In simple terms:

HIPAA is a federal law that protects your medical information from being shared without your permission.

Your medical information includes:

• Doctor visit records
• Lab results
• Prescription history
• Insurance information
• Mental health treatment records
• Billing information

HIPAA applies nationwide across all 50 states, including Washington D.C. and U.S. territories.

Why HIPAA Was Created?

HIPAA was created for two main reasons:

1. To Protect Workers’ Health Insurance

Before 1996, changing jobs could mean losing health insurance coverage. Insurance companies could deny coverage due to pre-existing conditions like diabetes, asthma, or cancer.

HIPAA limited how insurance companies could deny coverage and improved “portability,” meaning people could move from one job to another without losing healthcare access.

2. To Protect Medical Privacy

The rise of electronic medical records in the 1990s increased the risk of unauthorized access to patient data. Paper files were being replaced by digital systems.

Congress recognized that:

• Hospitals were sharing data electronically
• Insurance companies were transmitting billing records
• Technology was advancing faster than privacy laws

HIPAA was created to establish national standards for protecting sensitive health information.

What Is HIPAA Law?

HIPAA law includes several rules and regulations issued by the Department of Health and Human Services (HHS). The most important parts include:

• HIPAA Privacy Rule
• HIPAA Security Rule
• HIPAA Breach Notification Rule
• Enforcement Rule

These rules define:

• Who must protect patient data
• What type of information is protected
• How that information must be secured
• What happens when data is exposed

What Is Protected Under HIPAA?

HIPAA protects Protected Health Information (PHI). PHI includes any information that:

1. Identifies a person
2. Relates to their health condition, treatment, or payment

Examples of PHI:

• Full name
• Social Security number
• Date of birth
• Medical diagnosis
• X-ray images
• Email address linked to medical treatment
• Insurance policy number

There are 18 specific identifiers defined by HIPAA, including phone numbers, biometric identifiers, and vehicle license numbers.

Who Must Follow HIPAA Law?

HIPAA applies to three main groups:

1. Covered Entities

These include:

• Hospitals
• Doctors
• Dentists
• Chiropractors
• Pharmacies
• Health insurance companies
• Medicare and Medicaid providers

2. Business Associates

A business associate is a company that handles PHI on behalf of a healthcare provider.

Examples include:

• Medical billing companies
• IT service providers for hospitals
• Cloud storage companies
• Law firms handling medical claims

Business associates must sign a Business Associate Agreement (BAA) and comply with HIPAA regulations.

3. Subcontractors

Subcontractors that handle PHI must comply as well.

Learn More: What Is Civil Asset Forfeiture? Where the Money Goes?

What Is HIPAA Compliance?

HIPAA compliance means following all federal regulations designed to protect patient information.

Organizations must:

• Conduct risk assessments
• Implement physical safeguards
• Use administrative safeguards
• Apply technical safeguards
• Train employees
• Maintain documentation

HIPAA compliance is not optional. It is legally required for covered entities and business associates.

What Is the HIPAA Privacy Rule?

The HIPAA Privacy Rule took effect in April 2003.

It regulates:

• How PHI can be used
• How PHI can be disclosed
• Patients’ rights regarding their health information

Key Rights Under the Privacy Rule

Patients have the right to:

• Access their medical records
• Request corrections
• Receive an accounting of disclosures
• Request restrictions on sharing
• Obtain confidential communications

Healthcare providers must provide records within 30 days of a request.

What Is the HIPAA Security Rule?

The HIPAA Security Rule became effective in 2005. It focuses specifically on electronic Protected Health Information (ePHI).

The Security Rule requires three types of safeguards:

1. Administrative Safeguards

• Risk analysis
• Workforce training
• Assigned security responsibility
• Access management

2. Physical Safeguards

• Locked server rooms
• Controlled facility access
• Workstation security

3. Technical Safeguards

• Encryption
• Password protection
• Access controls
• Audit logs

Organizations must evaluate vulnerabilities regularly.

What Is a HIPAA Violation?

A HIPAA violation occurs when PHI is accessed, used, or disclosed without authorization. Examples include:

• Posting patient information on social media
• Leaving medical records in a public place
• Sending PHI to the wrong email address
• Failing to encrypt patient data
• Hacking due to poor cybersecurity

Even accidental disclosures can be violations.

HIPAA Violation Penalties

The Office for Civil Rights (OCR) enforces HIPAA. Penalties depend on the level of negligence.

Civil Penalties (2024 figures adjusted annually for inflation)

• Minimum: $137 per violation
• Maximum: $68,928 per violation
• Annual cap: Over $2 million per violation category

Example:

In 2018, Anthem Inc. paid $16 million to settle HIPAA violations after a data breach exposed nearly 79 million individuals’ data.

Criminal penalties include:

• Fines up to $250,000
• Prison sentences up to 10 years

HIPAA Breach Notification Rule

Organizations must notify:

• Affected individuals
• HHS
• Media outlets (if breach affects more than 500 residents of a state)

Notification must occur within 60 days of discovering the breach.

Common Causes of HIPAA Violations

• Employee negligence
• Weak passwords
• Phishing attacks
• Lost laptops
• Unencrypted devices
• Improper disposal of records

Healthcare data is valuable on the black market. A medical record can sell for $250 or more, according to cybersecurity research.

HIPAA Compliance Checklist

Healthcare organizations should:

1. Conduct annual risk assessments
2. Encrypt devices and emails
3. Train staff yearly
4. Sign Business Associate Agreements
5. Develop incident response plans
6. Perform internal audits

HIPAA and Technology

Cloud computing, telehealth, and AI tools must comply with HIPAA.

Platforms handling ePHI must:

• Offer encryption
• Provide audit controls
• Sign BAAs

Telemedicine services increased 38% in the U.S. after 2020, increasing compliance responsibilities.

Does HIPAA Apply to Employers?

HIPAA does not apply to employment records held by an employer.

Example:

A manager keeping sick leave records is not subject to HIPAA. However, group health plans sponsored by employers must comply.

Does HIPAA Apply to Schools?

Schools governed by FERPA are not subject to HIPAA for student records.

Colleges providing healthcare services may be subject to HIPAA.

HIPAA vs State Privacy Laws

Some states have stricter laws than HIPAA.

Example:

California’s Confidentiality of Medical Information Act (CMIA) provides additional protections.

HIPAA sets a federal minimum standard.

Key Takeaways

• HIPAA is a 1996 federal law.
• It protects patient privacy nationwide.
• Covered entities and business associates must comply.
• Violations can result in fines exceeding $2 million annually.
• The Privacy Rule protects rights.
• The Security Rule protects electronic data.
• Enforcement is handled by HHS OCR.

HIPAA protects millions of Americans every day. Healthcare organizations must take compliance seriously because a single mistake can cost millions of dollars and damage trust.

Understanding your rights under HIPAA empowers you to protect your personal health information.

FAQs