The Health Insurance Portability and Accountability Act (HIPAA) is a United States federal law enacted in 1996 that establishes national standards for the protection of sensitive patient health information. Originally designed to improve the portability and continuity of health insurance coverage, HIPAA’s most enduring impact has been its data privacy and security provisions — codified in the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule — which govern how organisations handle protected health information (PHI).
HIPAA is enforced by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). Non-compliance carries substantial financial penalties and, in cases of wilful neglect, criminal prosecution. For any organisation that creates, receives, maintains, or transmits health information, understanding HIPAA is not optional — it is a legal obligation.
Objectives of HIPAA
HIPAA was designed to address several interconnected problems in the American healthcare system. Its core objectives are:
- Protect patient privacy. HIPAA establishes legal boundaries around the use of identifiable health data and gives individuals the right to access and control their own records.
- Ensure the security of health data. As healthcare moved from paper records to electronic systems, HIPAA created enforceable standards for safeguarding electronic health information against unauthorised access, alteration, and destruction.
- Standardise electronic health transactions. HIPAA mandated uniform standards for electronic healthcare transactions — claims processing, enrolment, eligibility verification — to reduce administrative burden and improve interoperability.
- Improve insurance portability. Title I of HIPAA protects workers who change or lose their jobs from losing health insurance coverage.
While the portability provisions gave the law its name, it is Titles II and V — covering administrative simplification, privacy, and security — that define HIPAA compliance as it is understood today.
Who needs to comply with HIPAA?
HIPAA obligations apply to two distinct categories of organisations, each with specific responsibilities under the law.
Covered entities
Covered entities are organisations that directly participate in healthcare delivery or administration. The HHS defines three types:
- Healthcare providers — hospitals, clinics, physicians, dentists, pharmacies, and any other provider that transmits health information electronically in connection with a HIPAA-covered transaction.
- Health plans — health insurance companies, HMOs, employer-sponsored health plans, government health programmes (such as Medicare and Medicaid), and military healthcare programmes.
- Healthcare clearinghouses — organisations that process or facilitate the processing of health information between non-standard and standard formats, acting as intermediaries between providers and payers.
Business associates
A business associate is any person or organisation that performs a function or activity on behalf of a covered entity that involves access to PHI. The HIPAA Omnibus Rule of 2013 significantly expanded the definition and extended direct liability to business associates for compliance with certain HIPAA provisions.
Common examples include cloud service providers hosting healthcare data, SaaS platforms used for patient management or billing, IT service providers with access to PHI, medical billing companies, data analytics firms processing health information, and law firms that access PHI in the course of their work.
Business associates must enter into a Business Associate Agreement (BAA) with each covered entity they serve. The BAA specifies how the business associate will protect PHI, what uses and disclosures are permitted, and what obligations arise in the event of a breach. Without a BAA in place, the covered entity is in violation of HIPAA, regardless of whether a breach has occurred.
What is protected health information (PHI)?
Protected health information is any individually identifiable health information that is created, received, maintained, or transmitted by a covered entity or business associate. PHI includes medical records, diagnoses, treatment plans, laboratory results, prescription histories, billing and payment information, insurance claims data, and any communication between a patient and a healthcare provider.
The HHS identifies 18 specific identifiers that, when combined with health information, make data individually identifiable. These include names, dates of birth, addresses, Social Security numbers, medical record numbers, email addresses, and biometric identifiers.
ePHI — electronic protected health information
When PHI is stored, maintained, or transmitted in electronic form, it is referred to as electronic protected health information (ePHI). The HIPAA Security Rule applies specifically to ePHI and mandates administrative, physical, and technical safeguards to protect it. In practice, nearly all PHI handled by technology companies and modern healthcare organisations qualifies as ePHI, making the Security Rule the most operationally significant component of HIPAA for these organisations.
The three key HIPAA rules
HIPAA’s regulatory framework rests on three principal rules, each addressing a different dimension of health information protection.
The Privacy Rule
The Privacy Rule establishes national standards for the protection of PHI in any form — paper, electronic, or oral. It defines when PHI can be used and disclosed without patient authorisation (including for treatment, payment, and healthcare operations), establishes patient rights over their health information (access, corrections, accounting of disclosures), and introduces the minimum necessary standard, requiring organisations to limit PHI use to the minimum amount needed for the intended purpose. Covered entities must also provide a Notice of Privacy Practices describing how patient information may be used.
The Security Rule
The Security Rule focuses exclusively on ePHI and requires covered entities and business associates to implement safeguards across three categories:
Administrative safeguards — policies and procedures for security management, including risk analysis, workforce training, incident response procedures, contingency planning, and designation of a security official responsible for HIPAA compliance.
Physical safeguards — measures to protect electronic information systems and the facilities housing them, including facility access controls, workstation security, and policies governing disposal and re-use of electronic media.
Technical safeguards — technology controls that protect ePHI, including access controls (unique user identification, automatic logoff, encryption), audit controls for system activity, integrity controls, and transmission security measures.
The Security Rule is intentionally technology-neutral — it specifies what safeguards must achieve without mandating specific technologies, allowing organisations flexibility appropriate to their size and risk profile.
The Breach Notification Rule
The Breach Notification Rule, introduced by the HITECH Act of 2009, requires covered entities and business associates to provide notification following the discovery of a breach of unsecured PHI.
- Individual notice must be provided without unreasonable delay and no later than 60 days after discovery.
- HHS notification is required for all breaches. Breaches affecting 500 or more individuals must be reported within 60 days; smaller breaches may be reported annually.
- Media notification is required when a breach affects 500 or more residents of a single state or jurisdiction.
- Business associates must notify the covered entity of any breach within 60 days of discovery.
The HHS maintains a public breach portal — commonly known as the “Wall of Shame” — listing all breaches affecting 500 or more individuals, serving as a powerful incentive for organisations to take breach prevention seriously.
HIPAA penalties and enforcement
HIPAA enforcement is the responsibility of the HHS Office for Civil Rights (OCR), which investigates complaints, conducts compliance reviews, and imposes penalties for violations. The Department of Justice (DOJ) handles criminal enforcement for cases involving knowing misuse of health information.
Civil penalty tiers
HIPAA civil monetary penalties are structured in four tiers, as amended by the HITECH Act. Each tier corresponds to the violator’s level of knowledge and culpability.
| Tier | Level of culpability | Penalty per violation | Annual maximum per violation category |
|---|---|---|---|
| Tier 1 | Lack of knowledge — the entity was unaware and could not have reasonably known of the violation | USD 100 – USD 50,000 | ~USD 2,067,813 |
| Tier 2 | Reasonable cause — the violation was due to reasonable cause and not wilful neglect | USD 1,000 – USD 50,000 | ~USD 2,067,813 |
| Tier 3 | Wilful neglect, corrected — the violation resulted from wilful neglect but was corrected within 30 days of discovery | USD 10,000 – USD 50,000 | ~USD 2,067,813 |
| Tier 4 | Wilful neglect, not corrected — the violation resulted from wilful neglect and was not corrected within 30 days | USD 50,000 minimum | ~USD 2,067,813 |
Note: Annual maximum amounts are adjusted periodically for inflation. The figures above reflect HHS enforcement as of 2024.
Criminal penalties
Criminal penalties apply in cases of knowing wrongdoing. The DOJ may pursue criminal charges under three tiers:
- Knowingly obtaining or disclosing PHI in violation of HIPAA: up to USD 50,000 in fines and one year of imprisonment.
- Offences committed under false pretences: up to USD 100,000 in fines and up to five years of imprisonment.
- Offences committed with intent to sell, transfer, or use PHI for commercial advantage, personal gain, or malicious harm: up to USD 250,000 in fines and up to ten years of imprisonment.
Enforcement trends
The OCR has increased enforcement activity in recent years, with particular focus on failures to conduct adequate risk analysis — the single most common finding in OCR investigations. According to HHS data, inadequate or absent risk analysis has been a factor in the majority of HIPAA settlements. Other frequent enforcement targets include insufficient access controls, lack of encryption, failure to execute BAAs, and delayed breach notification.
Common HIPAA violations
Understanding the most frequently cited violations helps organisations prioritise their compliance efforts.
- Failure to perform a comprehensive risk analysis. Many organisations either skip this step entirely or conduct a superficial review that fails to meet HHS expectations.
- Insufficient access controls. Granting excessive access to PHI, failing to implement role-based access, or neglecting to revoke access for terminated employees.
- Lack of encryption. The Security Rule classifies encryption as “addressable,” but the OCR has made clear that failing to encrypt ePHI — particularly on portable devices and in transit — is a significant risk factor.
- Improper disposal of PHI. Disposing of records, hard drives, or media containing PHI without proper sanitisation or destruction.
- Failure to provide patient access. Covered entities must provide access to health records within 30 days of a request.
- Missing Business Associate Agreements. Sharing PHI with a business associate without a BAA is a violation, regardless of how the data is handled.
- Insufficient workforce training. Organisations that fail to train staff — or provide training only at hire — are consistently at risk.
HIPAA vs HITRUST
HIPAA and HITRUST are related but fundamentally different. HIPAA is a federal law. HITRUST is a privately developed compliance framework.
The HITRUST Common Security Framework (HITRUST CSF) was created to provide a certifiable, prescriptive framework that incorporates requirements from HIPAA, ISO 27001, NIST 800-53, PCI DSS, and other standards. Organisations that achieve HITRUST CSF certification can demonstrate compliance with multiple frameworks simultaneously, including HIPAA.
The key distinction is that HIPAA does not offer a formal certification. There is no “HIPAA certified” designation issued by the HHS. Compliance is assessed through internal audits, third-party assessments, and — when things go wrong — OCR investigations. HITRUST certification, by contrast, involves a formal assessment by a HITRUST-authorised assessor and results in a published certification valid for two years.
For healthcare technology companies, HITRUST certification is increasingly requested by large healthcare systems as evidence of a mature security programme. However, it is more expensive and resource-intensive than a HIPAA-focused assessment. Many organisations opt for a targeted HIPAA compliance programme with third-party validation rather than pursuing full HITRUST certification.
How technology companies are affected
The expansion of HIPAA’s reach to business associates, combined with the increasing digitisation of healthcare, means that technology companies are more likely than ever to fall within HIPAA’s scope.
Cloud service providers — AWS, Azure, and GCP all offer HIPAA-eligible services and will execute BAAs with customers, but the responsibility for configuring those services in a HIPAA-compliant manner rests with the customer. Using a HIPAA-eligible cloud service does not automatically make your application compliant.
SaaS companies serving healthcare clients must evaluate whether their platform creates, receives, maintains, or transmits PHI. If it does — even if only incidentally — the company is a business associate and must comply with the Security Rule, execute BAAs, and implement appropriate safeguards. This obligation applies regardless of whether the company considers itself a “healthcare company.”
Digital health and telehealth platforms are squarely within HIPAA’s scope and must implement the full range of Privacy, Security, and Breach Notification Rule requirements.
Analytics and AI/ML companies processing health data must be particularly careful. De-identified data — data from which all 18 HIPAA identifiers have been removed — is not subject to HIPAA. However, the de-identification standard is rigorous, and many datasets that appear anonymised still contain sufficient information to re-identify individuals.
Practical steps to HIPAA compliance
For organisations beginning their HIPAA compliance journey, the following steps provide a structured path forward.
1. Determine your status. Establish whether your organisation is a covered entity, a business associate, or a subcontractor of a business associate. This determines which HIPAA provisions apply and what agreements must be in place.
2. Conduct a comprehensive risk analysis. The Security Rule requires a thorough, documented assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. The HHS publishes a Security Risk Assessment (SRA) Tool to assist small and medium organisations with this process. The risk analysis must be repeated periodically and whenever significant changes occur in your environment.
3. Develop and implement policies and procedures. Document your approach to PHI handling, access controls, incident response, and workforce training. Policies must be specific, actionable, and reflective of actual practice — generic templates will not satisfy an auditor or the OCR.
4. Implement technical safeguards. Configure access controls, audit logging, encryption at rest and in transit, automatic session termination, and integrity controls across all systems that store, process, or transmit ePHI.
5. Execute Business Associate Agreements. Identify all vendors and partners that access PHI and ensure a BAA is in place with each one. Review existing BAAs periodically.
6. Train your workforce. Provide regular HIPAA training to all employees who access or could come into contact with PHI. Document all training activities and attendance.
7. Establish breach notification procedures. Define clear procedures for identifying, investigating, and reporting breaches. Ensure your team understands the 60-day notification timeline.
8. Monitor and audit continuously. HIPAA compliance is not a point-in-time achievement. Implement ongoing monitoring of access logs, security controls, and policy adherence. Compliance automation platforms can significantly reduce this burden by integrating with your existing systems and providing real-time visibility into your compliance posture.
Next steps
HIPAA compliance requires sustained commitment, but the path is well-defined. The HHS provides extensive guidance materials, including the Security Risk Assessment Tool and detailed guidance on the Privacy, Security, and Breach Notification Rules.
For organisations managing HIPAA alongside other frameworks such as SOC 2 or ISO 27001, the control overlap is substantial. A well-structured compliance programme can map shared controls across frameworks, reducing duplicate effort and accelerating your path to compliance across multiple standards simultaneously.