Health Insurance Portability and Accountability Act
The US federal law governing protected health information (PHI). Its Privacy and Security Rules set standards for how covered entities and their business associates use, disclose and safeguard health data.
Who it applies to
- Healthcare providers, health plans and healthcare clearinghouses (“covered entities”)
- Business associates handling PHI on behalf of covered entities
- Technology vendors processing health data under a Business Associate Agreement
Key requirements
- Administrative, physical and technical safeguards for electronic PHI
- Signed Business Associate Agreements with all relevant vendors
- Breach notification to affected individuals, HHS, and in some cases the media
- Minimum necessary access to PHI for any given purpose
- Regular risk analysis of systems handling PHI
Maximum penaltyTiered civil penalties up to roughly $2.1 million per violation category per year, plus potential criminal charges for wilful violations
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Questions we get asked
HIPAA applies to: Healthcare providers, health plans and healthcare clearinghouses (“covered entities”); Business associates handling PHI on behalf of covered entities; Technology vendors processing health data under a Business Associate Agreement.
The core obligations are: Administrative, physical and technical safeguards for electronic PHI; Signed Business Associate Agreements with all relevant vendors; Breach notification to affected individuals, HHS, and in some cases the media; Minimum necessary access to PHI for any given purpose; Regular risk analysis of systems handling PHI. Each is summarised in plain English above, with a link to the official text.
Effective: Privacy Rule 2003; Security Rule 2005, with ongoing updates. Regulator: HHS Office for Civil Rights (OCR).
Tiered civil penalties up to roughly $2.1 million per violation category per year, plus potential criminal charges for wilful violations.
Praeferre's GRC Automation engine monitors the policies, document repositories and web pages that carry your risk under HIPAA, on a cadence you set, and turns every scan into an audit trail you can put in front of an auditor or regulator. Alongside it, supplier and processor obligations run through Third-Party Risk Management.
See how Praeferre automates HIPAA compliance
Continuous monitoring, evidence and reporting for HIPAA — alongside every other framework you need to satisfy.