Laws and regulations
HIPAA
US rules for protecting health information: the Security Rule and the Breach Notification Rule.
Official source Published by US Department of Health and Human Services. US government work.
What it is
The Health Insurance Portability and Accountability Act of 1996 is a US federal law whose administrative simplification rules protect individually identifiable health information. For security practitioners the key parts are the Security Rule, which requires safeguards for electronic protected health information, and the Breach Notification Rule, alongside the Privacy Rule on use and disclosure. It exists to protect patient information as health care moved to electronic transactions.
Who it applies to
- Covered entities: health plans, health care clearinghouses and health care providers that conduct certain standard transactions electronically
- Business associates: service providers that create, receive, maintain or transmit protected health information on behalf of a covered entity, such as cloud hosts, billing companies and IT service providers
- Subcontractors of business associates that handle protected health information
- European organisations are in scope when they act as business associates for US covered entities, typically through a business associate agreement
- Status
- Binding US federal law, implemented through regulations at 45 CFR Parts 160 and 164. The Security Rule has applied since 2005, and the HITECH Act of 2009 and the 2013 Omnibus Rule added breach notification and direct liability for business associates. HHS proposed significant Security Rule updates in late 2024, so check whether a final rule has been issued.
- Enforcement
- The HHS Office for Civil Rights enforces the rules through complaint investigations, compliance reviews and audits, usually resolved with resolution agreements and corrective action plans. Civil money penalties are tiered by level of culpability and adjusted for inflation each year, state attorneys general can also bring actions, and the Department of Justice handles criminal violations.
Key points
- The Security Rule requires an accurate and thorough risk analysis and ongoing risk management, and this is the most frequently cited gap in enforcement
- Safeguards are grouped as administrative (such as security management, workforce training, contingency planning), physical (facility and device controls) and technical (access control, audit controls, integrity, authentication, transmission security)
- Implementation specifications are either required or addressable; addressable does not mean optional, and the decision and any alternative must be documented
- Covered entities must have a business associate agreement with each business associate, and business associates must have them with their subcontractors
- Breaches of unsecured protected health information must be notified to affected individuals without unreasonable delay and no later than 60 days after discovery, to HHS, and to the media when more than 500 residents of a state or jurisdiction are affected
- Information encrypted in line with HHS guidance is not unsecured, so a breach of it does not trigger notification
Where to start
- 1Establish whether you are a covered entity, a business associate or neither, and list the systems that hold electronic protected health information
- 2Carry out and document a risk analysis covering all of those systems, and track remediation in a risk management plan
- 3Review business associate agreements in both directions and align your incident response with the breach notification timelines
How it is structured
| 45 CFR Part 160 | General administrative requirements, definitions and enforcement |
|---|---|
| 45 CFR Part 164, Subpart C (Security Rule) | Administrative, physical and technical safeguards for electronic protected health information |
| 45 CFR Part 164, Subpart D (Breach Notification Rule) | Notification of breaches of unsecured protected health information |
| 45 CFR Part 164, Subpart E (Privacy Rule) | Permitted uses and disclosures of protected health information and individuals' rights |
A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.
Items explained (2)
Ordered by how often our lessons cite them.