What it is
HIPAA is US federal law enacted in 1996 with regulations at 45 CFR Parts 160, 162, and 164. Enforced by the HHS Office for Civil Rights (OCR), it establishes national standards for the privacy, security, and breach notification of Protected Health Information (PHI), individually identifiable health information held or transmitted by covered entities and business associates.
Who it applies to
- Covered entities: Health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with HIPAA-standard transactions
- Business associates: Any person or entity that performs functions on behalf of a covered entity involving PHI (billing services, cloud storage, IT contractors, revenue cycle managers)
- Subcontractors of business associates: Same obligations flow downstream through Business Associate Agreements (BAAs)
Key provisions
Key data protection requirements
- Privacy Rule (45 CFR 164 Subpart E): Governs use and disclosure of PHI; requires Notice of Privacy Practices, minimum necessary standard, patient access rights
- Security Rule (45 CFR 164 Subpart C): Requires administrative, physical, and technical safeguards for electronic PHI (ePHI); annual risk analysis is foundational
- Breach Notification Rule (45 CFR 164 Subpart D): Notification triggered by unauthorized acquisition, access, use, or disclosure of unsecured PHI
Breach notification
Following discovery of a breach of unsecured PHI:
- Individual notification: Within 60 calendar days from discovery, first-class mail to affected individuals (or email if agreed)
- HHS notification:
- Breach of 500 or more individuals: notify HHS OCR concurrently with individuals (within 60 days)
- Breach of fewer than 500: log and report to HHS annually within 60 days of year-end
- Media notification: Breach of 500+ residents of any state or jurisdiction requires notice to prominent media outlets in that area
Business associates must notify covered entities without unreasonable delay, no later than 60 days from discovery (BAA typically shortens this).
Enforcement
Civil money penalties are tiered by culpability, from a violation the covered entity did not know of to willful neglect that was not corrected, and the amounts are adjusted for inflation each year (45 CFR 160.404; 45 CFR 102.3). Criminal penalties (42 U.S.C. 1320d-6) apply to knowing offences.
Recent amendments
- Apr 2024Status under review
HIPAA Privacy Rule to Support Reproductive Health Care Privacy, final rule strengthening protections for reproductive-health PHI. - Jan 2025Status under review
HIPAA Security Rule NPRM, proposed comprehensive Security Rule update with new technical safeguard requirements.
How LeakTrace maps to it
An External Cybersecurity Assessment reads what a firm exposes from outside: email settings, the firm’s addresses in monitored breach databases, lookalike domains, exposed services and keys left in the firm's own website code. The Rules and Insurance Briefing that comes with it maps each finding to HIPAA, with the proof behind it, so the firm can see which obligation a finding touches. The assessment is human-verified before it is released.
- Health Insurance Portability and Accountability Act (45 CFR Parts 160, 162, and 164), authoritative text (www.hhs.gov/hipaa/for-professionals/index.html)