HIPAA

Who's covered

HIPAA applies to two categories. The distinction matters: it determines what you sign, what you're liable for, and who comes for you when something goes wrong.

• Covered entities are the headline group: health plans (insurers, HMOs, Medicare, employer-sponsored group health plans), healthcare providers that transmit health information electronically in connection with HIPAA-named transactions (almost every modern doctor's office, hospital, dentist, pharmacy, mental health practice, physical therapist), and healthcare clearinghouses (the data-transformation companies that translate provider claims into the standard formats payers expect).
• Business associates are everyone else who handles Protected Health Information (PHI) on behalf of a covered entity. The IT outsourcer running the EHR. The cloud provider hosting the patient portal. The transcription service. The shredding company. The legal firm handling malpractice cases. The data analytics startup. Since the 2013 Omnibus Rule, business associates are directly liable under HIPAA — not just contractually liable to the hospital that hired them.

If you build software that any healthcare provider uses to store, view, or transmit patient information, you're almost certainly a business associate and the hospital will require you to sign a Business Associate Agreement (BAA) before they let your product near their data. Major cloud providers (AWS, Azure, GCP) sign BAAs as a standard service offering for a defined subset of their services.

PHI: the thing being protected

Protected Health Information is the term of art. It's individually identifiable health information held or transmitted by a covered entity or its business associate. "Identifiable" is broad — the HIPAA Privacy Rule names 18 identifiers that turn health data into PHI:

That last "and any other" clause is what makes PHI a practical category, not a checklist. If a data set is de-identified by stripping all 18 categories (the "Safe Harbor" method) or certified de-identified by a qualified statistician (the "Expert Determination" method), it stops being PHI and HIPAA stops applying. Re-identification then becomes its own concern — combining "de-identified" datasets is a classic way to re-create identity.

The three rules

Privacy Rule

Issued in 2003, the Privacy Rule sets the substantive limits: what you can and can't do with PHI, regardless of format (paper, electronic, oral). It covers permitted uses and disclosures (treatment, payment, health care operations — "TPO"), patient rights to access and amend their own records, the Notice of Privacy Practices a provider must hand patients, the Minimum Necessary standard (only use or disclose the smallest amount of PHI required for the purpose), and accounting of disclosures.

Security Rule

Issued in 2005, the Security Rule is the part security practitioners actually live in. It applies specifically to electronic PHI (ePHI) — paper records are out of scope here. It's organized into three families of safeguards plus organizational and policy requirements.

Each Security Rule specification is either required or addressable. "Addressable" does not mean optional. It means: implement it as written, implement an equivalent alternative, or document why it isn't reasonable and appropriate for your organization. Encryption of ePHI at rest is addressable. The OCR's interpretation is that if you can do it, you should; if you can't, document the alternative. "Addressable" has gotten more organizations into trouble than any other word in the Security Rule.

Breach Notification Rule

Added by HITECH (2009), this rule turns breaches into notification events. A breach is presumed for any unauthorized acquisition, access, use, or disclosure of unsecured PHI unless the covered entity can demonstrate (via four-factor risk assessment) that there is a low probability of compromise. "Unsecured" effectively means unencrypted — properly encrypted PHI that's stolen is, by HHS guidance, not a reportable breach.

• Breaches of fewer than 500 individuals: notify affected individuals without unreasonable delay (within 60 days). Log it; report annually to HHS.
• Breaches of 500 or more individuals: notify affected individuals within 60 days, notify HHS within 60 days, AND notify "prominent media outlets" serving the state or jurisdiction. These appear on the HHS Office for Civil Rights public breach portal — informally known as the "Wall of Shame." Anyone can browse it.
• Business associates must notify the covered entity (their customer); the covered entity then handles individual / HHS / media notification.

Enforcement and penalties

HIPAA is enforced by the HHS Office for Civil Rights (OCR). OCR investigates complaints, conducts compliance audits, and assesses Civil Monetary Penalties (CMPs). Criminal cases get referred to the Department of Justice.

Penalties are tiered by culpability. The amounts adjust annually for inflation; the figures below reflect the 2024 ranges per HHS's Federal Register notice:

Beyond CMPs, settlements often include multi-year Corrective Action Plans (CAPs) requiring the organization to overhaul its security program under OCR oversight. The headline-grabbing cases — Anthem's $16M (2018), Premera's $6.85M (2020), Excellus's $5.1M (2021), Banner Health's $1.25M (2023) — usually combine a CMP with a multi-year CAP that costs many multiples of the fine to execute. Criminal liability applies to knowingly obtaining PHI in violation of HIPAA, up to 10 years' imprisonment for intent to sell or use it for malicious purposes.

What HIPAA means for a security team

Translated from regulator language into practitioner reality:

• Inventory ePHI. You can't protect what you don't know about. Catalog every system, application, file share, backup, and vendor that touches ePHI. Most failed audits trace to "we forgot about that database."
• Risk analysis is the keystone requirement. Conduct a comprehensive risk analysis annually (more often after major change). Document it. OCR's first ask in nearly every investigation: show me your most recent risk analysis. If you can't, the tier-3/tier-4 penalty conversation starts.
• Encrypt ePHI at rest and in transit. Addressable in the rule, effectively required in practice. Use FIPS 140-2/-3 validated modules where possible.
• Unique user IDs, MFA, RBAC. Shared accounts are the antithesis of audit logging. MFA isn't explicitly named in the rule, but it's expected by 2024 OCR auditors.
• Audit logs and review. Generating logs isn't enough — the rule requires that you actually review them. SIEM ingestion, alerting, periodic access reviews.
• BAAs with every vendor that touches ePHI. Cloud providers, payment processors, secure messaging, e-faxing, EHRs, backup vendors. No BAA = no business associate relationship = direct HIPAA violation.
• Workforce training. Annual at minimum, more often after policy changes or incidents.
• Incident response plan. Tested. With the 60-day breach notification clock running, you don't have time to figure out who notifies whom while the incident is unfolding.
• Retention. Six years for all HIPAA-related documentation: policies, procedures, risk analyses, training records, BAAs, incident records.