HIPAA compliance explained

HIPAA is the US law that protects the privacy and security of people's health information. HIPAA compliance is what organizations do to follow it. This guide gives a plain definition of each and then the practical detail on who must comply and how to do it.

What is HIPAA?

HIPAA is the Health Insurance Portability and Accountability Act of 1996, a US federal law. It sets national standards for protecting sensitive patient health information from being disclosed without the patient's consent or knowledge. The US Department of Health and Human Services (HHS) issues the rules and its Office for Civil Rights (OCR) enforces them.

The law covers more than privacy. It also made it easier for people to keep health coverage when they change jobs, which is the "portability" in the name. Most day-to-day compliance work relates to the Privacy Rule and the Security Rule.

The main HIPAA rules

Rule	What it covers
Privacy Rule	How protected health information can be used and shared, and the rights people have over their own records
Security Rule	Administrative, physical and technical safeguards for electronic protected health information
Breach Notification Rule	What to do when protected health information is exposed, including who must be told and when
Enforcement Rule	How OCR investigates complaints and applies penalties
Omnibus Rule	The 2013 update that extended many requirements to business associates and strengthened enforcement

What counts as protected health information

Protected health information (PHI) is health information that identifies a person and relates to their health, care or payment for care. When it is held or sent in electronic form it is called ePHI. HIPAA lists 18 types of identifier that make health data identifiable, including names, dates, phone numbers, email addresses, Social Security numbers and medical record numbers.

Who HIPAA applies to

Group	Who they are	Examples
Covered entities	Organizations that provide or pay for healthcare or process health data	Health plans, healthcare providers that bill electronically and healthcare clearinghouses
Business associates	Organizations that handle PHI on behalf of a covered entity	Billing companies, cloud hosts, IT support and shredding services
Subcontractors	Organizations that handle PHI for a business associate	A data center used by a software vendor

A covered entity must have a written business associate agreement with each business associate. The agreement sets out how PHI may be used and requires the associate to protect it.

Patient rights under HIPAA

• Access and obtain a copy of their health records
• Ask for corrections to records they believe are wrong
• Receive a notice that explains how their information is used
• Ask for limits on certain uses or disclosures
• Get a list of certain disclosures of their information
• File a complaint with the provider or with OCR

What is HIPAA compliance?

HIPAA compliance means meeting the requirements of the HIPAA rules that apply to your organization. In practice it is an ongoing program of policies, safeguards, training and records that protects PHI and shows regulators that the organization takes it seriously. HIPAA does not have an official government certificate, so organizations demonstrate compliance through their documented program and the evidence behind it.

The core requirements of HIPAA compliance

Requirement	What it involves
Risk analysis	Find where PHI is held and sent, and assess the threats to it
Risk management	Put safeguards in place that reduce those risks to a reasonable level
Policies and procedures	Write down how the organization handles PHI and keep the documents current
Designated officials	Name a privacy officer and a security officer
Workforce training	Train staff when they join and refresh the training regularly
Access controls	Limit PHI to the people who need it for their job, known as the minimum necessary standard
Technical safeguards	Use measures such as unique user IDs, audit logs and encryption where appropriate
Business associate agreements	Sign agreements with every vendor that handles PHI
Incident and breach response	Have a plan to detect, investigate and report incidents
Documentation	Keep policies and records of compliance activity for six years

The three types of safeguard in the Security Rule

• Administrative: risk analysis, policies, workforce training and incident response
• Physical: facility access controls, workstation security and device and media handling
• Technical: access controls, audit controls, integrity checks and transmission security

How to build a HIPAA compliance program

• Work out whether the organization is a covered entity or a business associate
• Map where PHI is created, stored, sent and disposed of
• Complete a risk analysis and record the results
• Close the gaps found, starting with the highest risks
• Write or update policies and make them easy for staff to find
• Train every member of the workforce and keep attendance records
• Review all vendors and put business associate agreements in place
• Test the incident response plan
• Review the program at least once a year and after any major change

What to do after a breach

A breach is an impermissible use or disclosure of PHI that compromises its privacy or security. Covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovery. They must also notify HHS. Where a breach affects 500 or more people, they must notify HHS and prominent media outlets in the affected area within the same 60-day period. Smaller breaches are reported to HHS each year. Business associates must tell the covered entity about breaches they find.

What happens when organizations fall short

OCR can investigate complaints and breaches, require corrective action plans and impose financial penalties. Civil penalties are tiered by the level of fault and are adjusted for inflation each year. Criminal penalties can apply to people who knowingly obtain or disclose PHI in violation of the law. State attorneys general can also enforce HIPAA. Common findings include missing risk analyses, weak access controls and no business associate agreement.

Keeping up with change

HIPAA compliance does not end once policies are written. Rules are updated, guidance changes and state privacy laws add extra requirements. In January 2025, HHS proposed changes to the Security Rule, so check the current status of that proposal. Healthcare and public sector organizations also work under other rules at the same time, such as state health privacy laws and funding conditions.

Tracking those changes across many policies is hard to do by hand. Ideagen's regulatory compliance solution helps teams track regulatory updates and see which policies and processes they affect, so reviews are triggered when a rule changes. Privacy and legal teams still decide how each requirement applies and what the organization must do.

HIPAA vs HIPAA compliance

Item	HIPAA	HIPAA compliance
What it is	The law and its rules	The organization's program to meet them
Who sets it	Congress and HHS	The organization, guided by the rules
Can be certified	No	No official certification exists
Timing	Fixed until the rules change	Ongoing, with regular review

Frequently asked questions

What is HIPAA in simple terms?

It is a US law that protects the privacy and security of people's health information.

What is HIPAA compliance in simple terms?

It is following the HIPAA rules through policies, safeguards, training and records.

Who must comply with HIPAA?

Covered entities such as health plans and healthcare providers, and the business associates that handle PHI for them.

Is there a HIPAA certification?

No. The US government does not certify organizations as HIPAA compliant. Some vendors offer their own assessments or attestations, but these are not an official approval.

Does HIPAA apply outside the US?

HIPAA is a US law. It applies to US covered entities and their business associates, including non-US companies that handle PHI for them. Other countries have their own health data rules.