HIPAA (Healthcare) - Compliance Guide

· About HIPAA (Healthcare)

Key Takeaways

  • Covered entities under HIPAA are health plans, most health care providers that transmit health information electronically for standard transactions, and health care clearinghouses, while business associates are also directly regulated for many Privacy, Security, and Breach Notification Rule duties.[1]
  • HIPAA’s Privacy Rule protects protected health information (PHI), and the Security Rule requires administrative, physical, and technical safeguards for electronic PHI (ePHI).[1]
  • HHS’s Office for Civil Rights (OCR) enforces HIPAA, and civil monetary penalties are inflation-adjusted; for penalties assessed on or after 28 January 2026, the maximum per-violation amount reaches $73,011 for most tiers and $2,190,294 for the most serious uncorrected willful-neglect tier.[2]
  • A major HIPAA Security Rule overhaul proposed in 2025 remains unfinalized in 2026, and HHS’s rulemaking timetable has been reported as delayed from a May 2026 target to July 2027; the existing Security Rule remains in force until a final rule is published.[3][4][1]
  • HIPAA allows disclosures for treatment, payment, and health-care operations without individual authorization, but many other uses, disclosures, and patient-access failures can trigger OCR enforcement, corrective action plans, and civil penalties.[1][2]
  • Civil penalties are not the only risk: OCR may also require a corrective action plan, monitoring, or a settlement agreement, and repeated or systemic failures can produce multi-year oversight.[2]

What It Is

HIPAA is a federal U.S. statute that created national standards for the privacy, security, and breach handling of health information. Its core implementing regulations sit in 45 CFR Part 160 and Part 164, and OCR within HHS administers and enforces the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules.[1]

HIPAA was enacted in 1996; the implementing privacy framework took effect in stages beginning in the early 2000s, and the Security Rule has long required covered entities and business associates to safeguard ePHI.[1] The current Security Rule remains operative in 2026, even though HHS proposed significant amendments in 2025 and subsequently delayed finalization; reporting in 2026 indicates the final rule is now expected no earlier than July 2027.[3][4]

The 2025–2026 rulemaking matters because it signals a materially higher compliance floor, but it is still proposed, not final, and organizations must continue to comply with the existing rule until any final amendments are published and become effective.[1][3][4]

Who Must Comply

HIPAA applies to covered entities: health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with transactions for which HHS has adopted standards.[1] It also applies to business associates that create, receive, maintain, or transmit PHI on behalf of covered entities, including many cloud, IT, billing, analytics, legal, and managed-service vendors.[1]

The statute and rules have extraterritorial reach in practice where a non-U.S. vendor handles PHI for a covered entity or another business associate subject to HIPAA obligations.[1] The decisive question is not where the vendor is located, but whether it functions as a business associate or downstream subcontractor handling PHI for a regulated purpose.[1]

Common exceptions include de-identified information, which is outside HIPAA when properly de-identified under the rule, and certain limited non-covered arrangements where no PHI is involved.[1] HIPAA also does not regulate every employer health record or every consumer health app; applicability turns on whether the organization is a covered entity or business associate, or is acting on behalf of one.[1]

Core Requirements

  1. Privacy Rule compliance: Covered entities must restrict uses and disclosures of PHI to permitted purposes, provide the Notice of Privacy Practices, and honor patient rights such as access, amendment, and an accounting of certain disclosures.[1]
  1. Minimum necessary standard: Uses, disclosures, and requests for PHI must generally be limited to the minimum necessary amount, subject to specific exceptions such as treatment disclosures.[1]
  1. Security Rule safeguards: Entities must implement reasonable and appropriate administrative, physical, and technical safeguards to protect ePHI, including risk analysis, workforce security, access controls, audit controls, transmission security, and contingency planning.[1]
  1. Breach Notification Rule: Covered entities must notify affected individuals, HHS, and in some cases the media after a breach of unsecured PHI, with timing and content requirements tied to the size and nature of the incident.[1]
  1. Business associate management: Covered entities must obtain compliant business associate agreements, and business associates must flow down appropriate safeguards and breach obligations to subcontractors where required.[1]
  1. Documentation and training: HIPAA requires policies, procedures, workforce training, sanctions for violations, and retention of required documentation for specified periods.[1]

Deadlines and Penalties

| Milestone | Date | What applies | |---|---:|---| | HIPAA enacted | 1996 | Federal framework for health information privacy and portability begins. | | Current Security Rule remains in force | 2026 | Existing safeguards continue to apply because proposed amendments are not final.[1][3][4] | | Inflation-adjusted civil penalty amounts updated | 28 January 2026 | New penalty ranges apply to penalties assessed on or after this date.[2] | | Reported target for final Security Rule amendments pushed out | July 2027 | Reported revised timetable for finalization of proposed security amendments.[3][4] |

For penalties assessed on or after 28 January 2026, OCR’s inflation-adjusted civil monetary penalties are approximately: Tier 1, $145 to $73,011 per violation; Tier 2, $1,461 to $73,011 per violation; Tier 3, $14,602 to $73,011 per violation; and Tier 4, $73,011 to $2,190,294 per violation, with an annual cap of $2,190,294 for identical provisions.[2]

Other sanctions can include corrective action plans, multi-year OCR monitoring, settlement obligations, and reputational harm from a public resolution agreement.[2]

How to Comply

  1. Map the data and regulated entities: Identify whether the organization is a covered entity, business associate, or subcontractor, and inventory where PHI and ePHI are created, stored, transmitted, or disclosed.[1]
  1. Run a HIPAA risk analysis: Use the Security Rule’s risk-analysis expectation as the baseline, and align the process with NIST CSF 2.0 functions to identify, protect, detect, respond, and recover across systems handling ePHI.[1]
  1. Strengthen the control framework: Implement an information-security management system aligned to ISO 27001 for governance, access control, logging, supplier security, incident handling, and continuous improvement.[1]
  1. Operationalize privacy governance: Maintain updated notices, authorization workflows, minimum-necessary rules, and patient-access procedures so Privacy Rule obligations are repeatable, not ad hoc.[1]
  1. Tighten vendor management: Execute and maintain business associate agreements, verify subcontractor flow-downs, and review vendor security attestations, especially for cloud, billing, and AI service providers.[1]
  1. Prepare for incidents and breaches: Build tested incident response and breach assessment procedures, including decision trees for notification deadlines and forensic preservation.[1]
  1. Track the proposed Security Rule changes: Treat the 2025 proposed amendments as a forward-looking gap assessment target, and use ISO 42001 where AI systems touch PHI to control data governance, lifecycle management, and human oversight.[3][4]

Related Regulations

  • HITECH Act strengthened HIPAA enforcement, expanded breach-notification expectations, and helped drive the OCR enforcement model now used in practice.[1]
  • 42 CFR Part 2 can be more restrictive than HIPAA for substance use disorder records, so dual analysis is required when both regimes may apply.
  • State health privacy laws may impose stricter limits, especially for sensitive categories, and HIPAA does not preempt state law when state law is more protective.
  • FTC Health Breach Notification Rule can apply to certain non-HIPAA consumer health apps and platforms, creating parallel breach-notification exposure.
  • State breach notification laws often apply alongside HIPAA when PHI is exposed, so incident teams must check both federal and state notification duties.

FAQ

Does HIPAA apply to companies outside the United States?

Yes, if the company is a business associate or subcontractor handling PHI for a covered entity or another regulated entity. Location alone does not avoid HIPAA if the role and data relationship bring the company within the regulated chain.[1]

Does HIPAA cover all health apps?

No. HIPAA applies only when the app is operated by, or on behalf of, a covered entity or business associate handling PHI in that capacity. Many direct-to-consumer apps fall outside HIPAA but may still face FTC, state privacy, or breach-notification obligations.

What changed in HIPAA in 2025–2026?

The most important development is the proposed Security Rule overhaul published in 2025, but it has not yet been finalized in 2026. Separately, OCR’s inflation-adjusted civil penalty amounts increased effective 28 January 2026.[2][3][4]

What is the biggest HIPAA risk for most organizations?

For most organizations, the highest-risk failure is still weak Security Rule execution, especially incomplete risk analysis, poor access control, and inadequate vendor oversight.[1] OCR enforcement frequently centers on systemic safeguards, not isolated paperwork mistakes.[2]

Are the 2025 security-rule proposals already mandatory?

No. They are proposed changes and are not binding until final rulemaking is completed and the effective dates arrive. Until then, the existing Security Rule remains the enforceable standard.[1][3][4]

Sources

Put it into practice

More compliance guides