What is HIPAA?
HIPAA is the US Health Insurance Portability and Accountability Act, which sets national standards for protecting health information. Its Privacy Rule limits how protected health information is used and shared, its Security Rule requires safeguards for electronic records, and its Breach Notification Rule sets reporting duties for covered entities and their business associates.
TL;DR
- Covers covered entities and their business associates.
- A documented risk analysis is mandatory.
- There is no official HIPAA certification.
Reviewed by the ComplyEasyAI compliance teamLast reviewed
How does HIPAA work in practice?
HIPAA establishes national standards for safeguarding protected health information (PHI). Its Privacy Rule governs how PHI may be used and disclosed, while its Security Rule sets administrative, physical, and technical safeguards for electronic PHI.
Covered entities — health plans, clearinghouses, and most healthcare providers — and the business associates that handle PHI on their behalf must implement these safeguards. Business associate agreements contractually extend HIPAA obligations down the supply chain.
The Breach Notification Rule requires notifying affected individuals, and in some cases regulators and the media, when unsecured PHI is breached. Demonstrating HIPAA compliance relies on documented policies, risk analyses, and evidence that safeguards operate continuously.
What else do people ask about HIPAA?
What is PHI?
Individually identifiable health information held or transmitted by a covered entity or business associate, in any form.
Is the HIPAA Security Rule changing?
A proposed update was published in January 2025 but is not yet final, so the current Security Rule still applies.
Go deeper: HIPAA compliance guide
Which terms are related to HIPAA?
- GDPRThe General Data Protection Regulation (GDPR) is the EU law, applying since 25 May 2018, that governs how organizations process the personal data of people in the EU. It requires a lawful basis, transparency and security, gives individuals rights such as access and erasure, and allows fines of up to €20 million or 4% of worldwide turnover.
- Vendor Risk ManagementVendor risk management (VRM) is the process of identifying, assessing and monitoring the security, privacy and operational risks that suppliers and service providers bring. A typical program inventories vendors, tiers them by criticality and data access, reviews questionnaires and attestations such as SOC 2 reports, and tracks remediation and contract terms over time.
- Evidence CollectionEvidence collection is gathering the records that prove compliance controls are designed well and operating as intended, such as access reviews, configuration exports, change tickets, scan results and policy acknowledgements. Auditors sample this evidence across the audit period. Automated collection pulls it from source systems on a schedule instead of relying on screenshots.
- Risk RegisterA risk register is the central record of an organization’s identified risks. Each entry describes the risk, its likelihood and impact, the resulting rating, the owner, and the treatment decision: mitigate, transfer, accept or avoid. ISO 27001, the NIST AI RMF and most other frameworks expect one, kept current and linked to controls.