HIPAA (HIPAA)
The US Health Insurance Portability and Accountability Act of 1996, best known for its privacy, security and breach notification rules for health information.
Overview
HIPAA’s rules apply to covered entities, such as health plans, clearinghouses and most providers, and to their business associates. They govern use and disclosure of protected health information, require administrative, physical and technical safeguards, and set breach notification duties. HHS’s Office for Civil Rights enforces them.
As primary legislation it is binding law; regulators fill in and interpret its detail through rules, guidance and supervisory practice.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
Health data is among the most sensitive data there is, and HIPAA is the main US rulebook for it.
Who it affects
Healthcare providers, health plans, clearinghouses and their vendors.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to HIPAA. Select one to open it.
What to do about it
- 1Confirm whether you are in scope: who it covers, which activities and where.
- 2Break it into testable requirements.
- 3Map each requirement to a control and an owner.
- 4Track amendments, implementing rules and guidance.
- 5Keep sealed evidence for every control run.
From requirement to evidence.
HIPAA safeguards are crosswalked to security frameworks so one control serves both.
Request early access →