Health Insurance Portability and Accountability Act (HIPAA)
The Health Insurance Portability and Accountability Act (HIPAA) governs how protected health information (PHI) is used, disclosed, and secured; the obligation applies the moment you handle PHI.
Who Needs It
HIPAA applies to two groups:
- Covered entities: healthcare providers (hospitals, practices, pharmacies, labs), health plans (insurers, HMOs, employer-sponsored plans, Medicare/Medicaid), and healthcare clearinghouses that process health information between providers and payers.
- Business associates: anyone who handles PHI on a covered entity's behalf, including cloud hosting providers, EHR vendors, billing companies, analytics firms, even law and accounting firms. Since the 2013 Omnibus Rule, business associates are directly liable under HIPAA, not just contractually.
The practical trigger for most software companies: if you sell to healthcare organizations and your system stores, processes, or transmits PHI, you're a business associate. You'll need to sign a Business Associate Agreement (BAA) and comply with the Security Rule, even if you never interact with a patient.
The Four Rules
| Rule | What it requires |
|---|---|
| Privacy Rule (2003) | Limits on how PHI is used and disclosed, the "minimum necessary" standard, and patient rights: access, amendment, an accounting of disclosures, and a notice of privacy practices |
| Security Rule (2005) | Administrative, physical, and technical safeguards for electronic PHI (ePHI): risk analysis, workforce training, access controls, audit logging, transmission security |
| Breach Notification Rule (2009) | Notify affected individuals within 60 days of discovering a breach of unsecured PHI; notify HHS, and the media for breaches affecting 500 or more people in a state or jurisdiction |
| Omnibus Rule (2013) | Extends direct liability to business associates, tightens the breach definition, and strengthens enforcement |
The Security Rule is where most of your engineering work lives. Its safeguards are either required or addressable, and addressable does not mean optional. It means you implement the specification, implement a reasonable alternative, or document why neither is needed. Leaving a specification unaddressed without documentation is not one of the options.
Enforcement
OCR investigations are largely complaint-driven and breach-driven; every breach affecting 500 or more individuals gets investigated. Civil penalties are tiered by culpability, from lack of knowledge up to willful neglect, with annual caps in the millions of dollars and amounts adjusted yearly for inflation. Knowing misuse of PHI can also bring criminal charges, including imprisonment.
Where to Start
A few administrative steps come before any technical work, and OCR asks for the resulting documents first in an investigation:
- Designate a Privacy Official and a Security Official. Both designations are required: the Privacy Rule mandates a privacy official and the Security Rule mandates a security official. One person can hold both roles in a small organization, but the appointment must be documented either way.
- Conduct and document a risk analysis. Identify threats to PHI and ePHI specific to your organization, including physical risks such as device theft and facility access, and risks introduced by vendors. Follow it with a documented risk management plan that tracks how each identified risk is treated, and reassess at least annually.
- Adopt the core policies: privacy, security, and breach notification, plus a sanctions policy defining consequences for workforce members who violate them. Keep policies version-controlled, review them annually, and have all personnel acknowledge them.
- Train the workforce on HIPAA and PHI handling at onboarding and annually thereafter, and retain completion records.
- Execute BAAs with every vendor that creates, receives, maintains, or transmits PHI on your behalf before any PHI flows to them.
- Document incident response procedures that cover breach assessment, mitigation, and the notification obligations described above.
- Evaluate periodically. Run internal assessments using staff or consultants independent of the controls under review, document findings and corrective actions, and have management review the results.
For the artifacts that typically satisfy manually evidenced control areas, see Example Evidence.
FAQ
Can we get HIPAA certified?
No. HHS does not recognize any HIPAA certification. Third parties sell "HIPAA certification" assessments, and they can be useful gap analyses, but they carry no legal weight; compliance is judged by OCR when something goes wrong.
Is encryption required?
It's an addressable specification, which in practice means yes for any modern system: the Breach Notification Rule only applies to unsecured PHI, so properly encrypted data that's lost or stolen generally isn't a reportable breach. We recommend encrypting ePHI everywhere for that reason.
Do we need a BAA with every vendor?
With every vendor that creates, receives, maintains, or transmits PHI on your behalf, including your cloud provider. No BAA means the disclosure to that vendor is itself a violation.
What's the single most cited compliance failure?
Missing or inadequate risk analysis. The Security Rule requires an accurate, thorough assessment of risks to ePHI, and it's the first document OCR asks for in an investigation.