What is HIPAA?

Definition

HIPAA (the Health Insurance Portability and Accountability Act of 1996) is a US federal law. For security and privacy, it sets the standards covered entities and their business associates must follow to safeguard protected health information (PHI).

Background

HIPAA is enforced by the US Department of Health and Human Services (HHS). Within HHS, the Office for Civil Rights (OCR) enforces the rules that matter most for a security program. The Privacy Rule covers how PHI may be used and disclosed. The Security Rule sets administrative, physical, and technical safeguards for electronic PHI. The Breach Notification Rule covers notifying individuals and regulators after a breach. Covered entities are health plans, including Medicare, Medicaid and employer group health plans; health care clearinghouses; and health care providers that transmit health information electronically in connection with standard transactions such as claims. Doctors, clinics, hospitals, nursing homes and pharmacies are typical providers. A business associate is a person or organization, often a vendor, that performs a function or service for a covered entity that involves PHI. Business associates are bound by a Business Associate Agreement (BAA). The HITECH Act of 2009, implemented by HHS in its 2013 Omnibus Rule, made business associates directly liable for complying with the Security Rule and with some Privacy Rule requirements. All of these rules live in the Code of Federal Regulations. General provisions and definitions are in 45 CFR Part 160. Part 164 holds the Security Rule in subpart C, the Breach Notification Rule in subpart D, and the Privacy Rule in subpart E. Two more sit alongside them. The Enforcement Rule, in subparts C to E of Part 160, governs how HHS investigates and how penalties are set. The transaction, code set and identifier standards in 45 CFR Part 162 are the administrative-simplification half of the law. They matter most to organizations that run covered transactions such as claims and eligibility checks.

Why it matters

If your product touches health data on behalf of a covered entity, you are almost certainly a business associate and directly liable under HIPAA. Buyers will require a signed BAA and evidence of a real security program before they share PHI with you. The Privacy Rule also gives patients rights over their own information, including the right to see and get a copy of their medical and billing records (§164.524) and to ask for corrections (§164.526). If you host records for a provider, your product has to let the provider meet those requests. Some health data sits outside HIPAA altogether. A consumer health app that people use on their own, with no provider or health plan involved, is usually not covered, though other laws such as the FTC’s Health Breach Notification Rule may apply.

Step by step

1. Determine your role: covered entity or business associate, and where PHI flows.
2. Run a HIPAA Security Rule risk analysis.
3. Implement administrative, physical, and technical safeguards (access controls, encryption, audit logging, workforce training).
4. Sign Business Associate Agreements with every vendor that touches PHI, and with your customers where you are the business associate.
5. Stand up breach detection and a documented breach-notification process.
6. Put the notification deadlines in your incident response plan. Affected individuals must be told without unreasonable delay and no later than 60 calendar days after a breach is discovered (§164.404(b)), and a business associate must tell the covered entity within the same outer limit (§164.410(b)).
7. Keep required policies, procedures and records for six years from the date they were created or last in effect, whichever is later (§164.316(b)(2)(i)).
8. Review and update the program as systems and vendors change.

Examples

• A telehealth startup is a business associate to the clinics it serves, so it signs BAAs and encrypts ePHI in transit and at rest.
• A billing SaaS restricts PHI access to the minimum necessary and logs every access for its audit trail.
• A clinic’s scheduling vendor stores the reason for each visit next to the patient’s name. That combination is PHI, so the vendor signs a BAA and includes the scheduling database in its risk analysis.

Common mistakes

• Assuming HIPAA has a certification: there is no official HIPAA certificate, only demonstrable compliance.
• Forgetting BAAs with downstream vendors that also touch PHI.
• Skipping the required risk analysis, which is the most-cited failing in enforcement actions.
• Reading addressable implementation specifications as optional. Addressable means you assess whether the specification is reasonable and appropriate for you, then implement it, implement an equivalent measure, or document why neither fits.

FAQ