The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that was enacted in 1996 to protect the privacy and security of individually identifiable health information. The law applies to a wide range of entities, including healthcare providers, health plans, and healthcare clearinghouses, known as covered entities.
HIPAA includes two sets of regulations: the Privacy Rule and the Security Rule. The Privacy Rule regulates the use and disclosure of protected health information (PHI), which is any information that can be used to identify an individual and that relates to their health or healthcare. The Security Rule regulates the technical and physical safeguards that must be in place to protect electronic PHI (ePHI).
The Privacy Rule requires covered entities to:
- Obtain written consent from individuals before using or disclosing their PHI
- Limit the use and disclosure of PHI to the minimum necessary to accomplish a specific purpose
- Notify individuals of their privacy rights
- Have in place appropriate administrative, physical, and technical safeguards to protect the privacy of PHI
The Security Rule requires covered entities to:
- Implement administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of ePHI
- Perform risk assessments to identify potential threats and vulnerabilities to the confidentiality, integrity, and availability of ePHI
- Implement security controls to address any identified threats and vulnerabilities
HIPAA also requires covered entities to report certain types of data breaches to individuals and the Department of Health and Human Services (HHS). Organizations that fail to comply with HIPAA regulations can face heavy fines and penalties, including civil and criminal penalties.
