HIPAA compliance means following the federal rules that protect health information. HIPAA has three core rules named the Privacy Rule, the Security Rule and the Breach Notification Rule. Covered entities and their business associates must follow them. Treat this guide as general information and not legal advice so confirm your duties with a qualified attorney.
HIPAA is the Health Insurance Portability and Accountability Act. Teams that handle patient data ask who must follow it and what the rules require.
This guide follows HHS documentation and explains every rule in plain words. It is general information and not legal advice.
Who Must Follow HIPAA?
HHS names two groups. Covered entities are health plans, health care clearinghouses and health care providers that transmit health information electronically in connection with standard transactions. Business associates are the vendors that handle protected health information for a covered entity. See HHS covered entities guidance.
What are the Main HIPAA Rules?
| Rule | What it Sets |
|---|---|
| Privacy Rule | National standards for protected health information and patient rights |
| Security Rule | Safeguards for electronic protected health information |
| Breach Notification Rule | Notice duties after a breach of unsecured protected health information |
What does the Privacy Rule Require?
Privacy Rule standards govern how covered entities use and disclose protected health information. That rule also gives individuals rights to examine and obtain a copy of their records and to request corrections. See the HHS Privacy Rule summary.
What does the Security Rule Require?
Security Rule requirements apply to electronic protected health information (ePHI). HHS describes three types of safeguards that covered entities and business associates must put in place. See the HHS Security Rule summary.
- Administrative safeguards. Policies, risk analysis and workforce training.
- Physical safeguards. Facility access and device controls.
- Technical safeguards. Access control, audit controls and transmission security.
What if a Breach Happens?
Covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovery of a breach. Breaches that affect 500 or more individuals also require notice to HHS. See the HHS Breach Notification Rule.
- 500 or more individuals. Notify HHS at the same time as the individuals.
- More than 500 residents of one state. Notify prominent media outlets in that state.
- Fewer than 500 individuals. Report to HHS within 60 days after the end of the calendar year.
How does HIPAA Apply to Cloud Services?
HHS states that a cloud provider that creates, receives, maintains or transmits ePHI is a business associate. That status applies even when the provider cannot view the data. See HHS guidance on HIPAA and cloud computing.
- Sign a business associate agreement with the provider before you store protected health information.
- Confirm in writing which safeguards the provider performs.
- Plan how the provider returns or destroys the data when the contract ends.
For related controls see cloud data protection controls. For wider threats see the top security issues in cloud computing.
Frequently Asked Questions
What is HIPAA Compliance?
It means following the HIPAA Privacy, Security and Breach Notification Rules that protect health information.
Who Must Follow HIPAA?
Covered entities and their business associates must follow it. HHS defines covered entities as health plans, clearinghouses and certain health care providers.
Does HIPAA Apply to Cloud Providers?
Yes. HHS states that a cloud provider that handles protected health information electronically is a business associate even without access to the data.
When Must a Breach be Reported?
Covered entities must notify individuals no later than 60 days after discovery. Breaches of 500 or more individuals also need notice to HHS.
Is This Guide Legal Advice?
No. It is general information from HHS documentation so confirm your duties with a qualified attorney.
Key Takeaways
- HIPAA applies to covered entities and business associates.
- Privacy Rule standards govern protected health information.
- Security Rule safeguards are administrative, physical and technical.
- Breach notice is due no later than 60 days after discovery.
- Cloud providers that handle protected health information need a business associate agreement.
Sources and References
This guide follows HHS documentation and is not legal advice.
- Covered Entities and Business Associates (HHS) www.hhs.gov
- The HIPAA Privacy Rule (HHS) www.hhs.gov
- The HIPAA Security Rule (HHS) www.hhs.gov
- Breach Notification Rule (HHS) www.hhs.gov
- Guidance on HIPAA and Cloud Computing (HHS) www.hhs.gov