DataTerminology.comNEW
Also known as: Health Insurance Portability and Accountability Act
United States federal law establishing national standards for protecting the privacy and security of health information.
DESCRIPTION
HIPAA is a U.S. law that sets rules for the privacy, security, and electronic exchange of protected health information (PHI). The Privacy Rule establishes patient rights and limits on uses and disclosures, while the Security Rule mandates administrative, physical, and technical safeguards. Covered entities and business associates must implement risk management, policies, and training. De-identification standards and breach notifications are defined, with enforcement by HHS OCR. Noncompliance can result in significant civil and criminal penalties.
ALTERNATIVE DEFINITIONS
U.S. Department of Health & Human Services
The Privacy Rule establishes national standards to protect individuals’ medical records and other personal health information.
Focuses on the Privacy Rule’s national standards for PHI protection.
Wikipedia
The Health Insurance Portability and Accountability Act of 1996 is a United States federal statute that provides data privacy and security provisions for safeguarding medical information.
Concise overview emphasizing privacy and security provisions for medical information.
RELATED TERMS
HIPAA Privacy Rule HIPAA Security Rule HITECH Act Protected Health Information Data De-identification Business Associate Agreement Minimum Necessary NIST SP 800-66 Transaction Audit Data
COMPETING TERMS
KNOWLEDGE AREAS
Data Privacy & Compliance Data Security Data Governance
TARGET AUDIENCE
Chief Information Officer Chief Technology Officer Chief Data Officer Data Governance Manager Data Management Consultant
EXTERNAL SOURCES
- Wikipedia - Health Insurance Portability and Accountability Act
- HHS OCR - HIPAA Security Rule overview
- HHS OCR - HIPAA Privacy Rule regulations
- NIST - Guidance for HIPAA Security Rule
TOP QUESTIONS
Who must comply with HIPAA?
Covered entities (health plans, providers, clearinghouses) and their business associates must comply. Vendors handling PHI under contract also face obligations and liability.
Category: Requirements
What is Protected Health Information under HIPAA?
PHI is individually identifiable health information in any form, including electronic, relating to health, care, or payment, and linked to identifiers.
Category: Definition
What are the core HIPAA rules?
The Privacy Rule governs uses and disclosures of PHI; the Security Rule mandates safeguards for ePHI; the Breach Notification Rule requires reporting of breaches.
Category: Overview
How does de-identification work in HIPAA?
HIPAA allows Safe Harbor removal of 18 identifiers or expert determination to render data de-identified, permitting broader use with reduced privacy risk.
Category: Example
What is a Business Associate Agreement (BAA)?
A BAA is a contract obligating a service provider to safeguard PHI and comply with HIPAA when performing functions for a covered entity.
Category: Requirements
How does HIPAA relate to GDPR?
Both protect personal information, but HIPAA targets U.S. health data specifically, while GDPR broadly covers EU personal data with different legal bases and rights.
Category: Alternatives
What are common HIPAA compliance mistakes?
Inadequate risk analysis, poor access controls, lacking encryption at rest/in transit, and insufficient training frequently lead to violations.
Category: Mistakes
What happens after a suspected breach of ePHI?
Organizations must investigate, assess risk, notify affected individuals, and report to HHS and sometimes media, following Breach Notification Rule timelines.
Category: Risks
Why is HIPAA still relevant in modern health tech?
Digital health expansion and cloud adoption intensify risks to PHI. HIPAA’s safeguards remain essential to protect patient trust and meet legal obligations.
Category: Relevancy