HIPAA (Health Insurance Portability and Accountability Act)

What is HIPAA (Health Insurance Portability and Accountability Act)?

The Health Insurance Portability and Accountability Act (HIPAA) was enacted in 1996 to protect sensitive patient health information. The HIPAA Privacy Rule establishes national standards for protecting Protected Health Information (PHI), while the Security Rule sets standards for securing electronic PHI (ePHI). The Act applies to covered entities (healthcare providers, health plans, healthcare clearinghouses) and their business associates.

HIPAA requires organizations to implement administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of ePHI. This includes access controls, audit logs, encryption, and regular risk assessments. The Breach Notification Rule requires covered entities to notify affected individuals, HHS, and in some cases the media, of breaches involving unsecured PHI.

PHI includes 18 identifiers such as names, addresses, birth dates, Social Security numbers, medical record numbers, and biometric data. To use health data for testing or research, organizations must either obtain authorization or ensure data is de-identified following HIPAA's Safe Harbor or Expert Determination methods. Violations can result in civil penalties up to $1.5 million per violation category per year, and criminal penalties including imprisonment.