🇺🇸Health Insurance Portability and Accountability Act of 1996

Skin

← Back to laws in United States

Health Insurance Portability and Accountability Act of 1996

HIPAA regulates protected health information in covered healthcare contexts

The Health Insurance Portability and Accountability Act of 1996 is a major United States health law. For privacy compliance, HIPAA is best known for the administrative simplification framework that led to privacy, security and breach notification rules for protected health information.

HIPAA does not apply to every business that holds health-related information. It applies through defined roles and regulated contexts, especially covered entities and business associates. This distinction is critical for health apps, wellness platforms, employers, insurers, hospitals, clinics, pharmacies, billing providers, cloud services and healthcare vendors.

Covered entities and business associates

HIPAA obligations generally apply to covered entities such as health plans, healthcare clearinghouses and certain healthcare providers that conduct covered transactions electronically. Business associates are persons or organisations that perform certain functions or services for covered entities involving protected health information.

A direct-to-consumer wellness app may hold sensitive health-related data but still fall outside HIPAA if it is not acting as a covered entity or business associate. Conversely, a technology vendor that processes protected health information for a hospital or health plan may be directly tied into HIPAA through a business associate relationship.

Key Provisions

Administrative simplification: HIPAA created standards for healthcare transactions, identifiers, code sets, privacy and security.

Protected health information: HIPAA focuses on identifiable health information in regulated covered entity and business associate contexts.

Privacy controls: use and disclosure of protected health information is limited by the Privacy Rule framework.

Security controls: electronic protected health information must be protected through administrative, physical and technical safeguards.

Breach response: regulated entities must assess and respond to breaches of unsecured protected health information under the breach notification framework.

Privacy Rule, Security Rule and Breach Notification Rule

The HIPAA Privacy Rule governs when protected health information may be used or disclosed and gives individuals rights in relation to their health information. The Security Rule focuses on electronic protected health information and requires administrative, physical and technical safeguards. The Breach Notification Rule requires notifications when unsecured protected health information is breached, subject to the rule’s assessment framework.

In practice, HIPAA compliance requires policies, role-based access, workforce training, business associate agreements, risk analysis, security controls, audit trails, incident response and documentation.

Health data outside HIPAA may still be regulated

A common mistake is assuming that “not HIPAA” means “not regulated.” Health-related data outside HIPAA may still be subject to state consumer privacy laws, state health privacy laws, FTC enforcement, app store rules, contract duties, biometric laws, consumer protection laws or breach notification statutes.

This is especially relevant for fitness apps, fertility apps, mental wellness tools, symptom checkers, AI health chatbots and employer wellness programmes. The legal analysis should begin with role and context, not with the sensitivity of the data alone.

Practical risk area

Do not describe a service as “HIPAA compliant” unless you know the role, the data flow and the applicable rule. HIPAA compliance is not a generic security badge; it is a regulated operating model for protected health information.

Business associate governance

When a vendor handles protected health information for a covered entity, the relationship should be governed by a business associate agreement. The agreement should address permitted uses and disclosures, safeguards, reporting of incidents, subcontractors, return or destruction of information and support for the covered entity’s HIPAA obligations.

Cloud providers, billing vendors, analytics tools, transcription services, AI tools and customer support platforms should all be reviewed before protected health information is shared with them.

What this means for you

For HIPAA, first determine whether you are a covered entity, business associate or outside HIPAA. Then map protected health information, execute business associate agreements where required, implement privacy and security safeguards, train personnel, maintain audit evidence and prepare a breach response workflow.

Other laws in United States
CA-DELETE

California Delete Act and Data Broker Requirements

California Privacy Protection Agency

Open law Read analysis
CPPA

California Privacy Rights Act and California Privacy Protection Agency provisions

California Privacy Protection Agency

Open law Read analysis
CLOUD-ACT

Clarifying Lawful Overseas Use of Data Act (CLOUD Act)

United States Department of Justice

Open law Read analysis
42-CFR-P2

Confidentiality of Substance Use Disorder Patient Records

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
CAN-SPAM

Controlling the Assault of Non-Solicited Pornography And Marketing Act

Federal Trade Commission

Open law Read analysis
CPNI

Customer Proprietary Network Information Rules

Federal Communications Commission

Open law Read analysis
DPPA

Drivers Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis
ECPA-SCA

Electronic Communications Privacy Act and Stored Communications Act

United States Department of Justice

Open law Read analysis
FERPA

Family Educational Rights and Privacy Act

U.S. Department of Education, Student Privacy Policy Office

Open law Read analysis
GINA

Genetic Information Nondiscrimination Act

U.S. Equal Employment Opportunity Commission and federal health agencies

Open law Read analysis
HITECH

Health Information Technology for Economic and Clinical Health Act

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
IL-BIPA

Illinois Biometric Information Privacy Act

Illinois Attorney General and private enforcement

Open law Read analysis
MT-CDPA

Montana Consumer Data Privacy Act

Montana Attorney General, Office of Consumer Protection

Open law Read analysis
NJDPA

New Jersey Data Privacy Law

New Jersey Attorney General and Division of Consumer Affairs

Open law Read analysis
PRIVACY-ACT

Privacy Act of 1974

U.S. Department of Justice, Office of Privacy and Civil Liberties

Open law Read analysis
RI-DTPPA

Rhode Island Data Transparency and Privacy Protection Act

Rhode Island Attorney General

Open law Read analysis
UCPA

Utah Consumer Privacy Act

Utah Attorney General and Division of Consumer Protection

Open law Read analysis
VT-DPOSA

Vermont Data Privacy and Online Surveillance Act

Vermont Attorney General

Open law Read analysis
VPPA

Video Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis