HIPAA

What Is HIPAA?

HIPAA is a US federal law that sets rules for protecting health information. Passed in 1996, it applies to anyone who handles protected health information (PHI), which includes medical records, billing data, insurance claims, lab results, and anything else that ties a person's identity to their health status.

The law covers two broad groups: covered entities (healthcare providers, health plans, and clearinghouses) and business associates (any vendor or contractor that handles PHI on their behalf). If you're building software that touches patient data, you're almost certainly a business associate. That means HIPAA applies to you directly, not just to your healthcare customers.

One critical thing to understand upfront: there is no HIPAA certification. No government body will stamp your product as "HIPAA compliant." Compliance is a legal obligation you maintain continuously, not a credential you earn once.

The Four Main Rules

HIPAA is actually a collection of rules, each covering different aspects of health data protection.

Privacy Rule. Controls who can access PHI and under what circumstances. Establishes patient rights like accessing their own records and requesting corrections. Applies to all forms of PHI, whether electronic, paper, or verbal. Sets the "minimum necessary" standard: only use the least amount of PHI needed for the task.

Security Rule. Specifically covers electronic PHI (ePHI). Requires three categories of safeguards: administrative (risk assessments, training, security officers), physical (facility access, workstation security, device controls), and technical (access controls, audit logs, encryption, transmission security). This is where the bulk of compliance work lives for tech companies.

Breach Notification Rule. If unsecured PHI is exposed, you must notify affected individuals within 60 days. Breaches affecting 500 or more people also require notifying HHS and local media. HHS publishes all large breaches on its public portal, sometimes called the "Wall of Shame."

Enforcement Rule. Gives the Office for Civil Rights (OCR) authority to investigate complaints, conduct audits, and impose penalties. Criminal violations are handled by the Department of Justice.

What Counts as PHI?

PHI is any health information that can be tied to a specific individual. HIPAA defines 18 identifiers that make health data "identifiable":

Names, addresses (anything more specific than state), dates related to the individual (birth, admission, discharge), phone numbers, email addresses, Social Security numbers, medical record numbers, health plan IDs, account numbers, device identifiers, IP addresses, biometric data, photographs, and any other unique identifier.

If you strip all 18 identifiers, the data is considered de-identified and HIPAA no longer applies. But modern re-identification techniques have made this harder than it sounds.

Who Actually Needs to Comply?

Covered entities: Hospitals, physician practices, dental offices, pharmacies, health insurance companies, Medicare/Medicaid programs, and healthcare clearinghouses. If you bill for healthcare services or process health insurance claims, you're a covered entity.

Business associates: This is the category that catches most tech companies. If you store, process, or transmit PHI on behalf of a covered entity, you're a business associate. Examples: EHR/EMR vendors, cloud hosting providers storing health data, billing services, IT support companies with access to clinical systems, analytics firms processing patient data, even shredding companies that destroy paper records.

Since the 2013 Omnibus Rule, business associates are directly liable for HIPAA compliance. Before that, liability only flowed through contracts. Now OCR can (and does) fine business associates directly.

Security Rule Requirements

The Security Rule is where companies spend most of their compliance effort. It's organized into three safeguard categories:

Administrative safeguards (the biggest category):

• Conduct a thorough risk analysis of all systems touching ePHI
• Implement a risk management program to address identified risks
• Designate a Security Officer
• Establish workforce access authorization procedures
• Train all employees on security policies (not just at hire, but ongoing)
• Create incident response and reporting procedures
• Build contingency plans: data backup, disaster recovery, emergency operations

Physical safeguards:

• Control physical access to facilities housing ePHI
• Secure workstations where ePHI is accessed
• Track and manage hardware and media containing ePHI
• Properly dispose of devices and media when they're retired

Technical safeguards:

• Assign unique user IDs for system access
• Implement emergency access procedures
• Maintain audit logs that record who accessed what and when
• Protect ePHI integrity against improper alteration
• Encrypt ePHI in transit and at rest

An important nuance: the Security Rule labels some specs as "required" and others as "addressable." Addressable does NOT mean optional. It means you must either implement the specification or document why an equivalent alternative is appropriate for your environment. OCR has fined organizations for treating "addressable" as "skip."

Penalties for Getting It Wrong

HIPAA penalties operate on a four-tier system based on the level of negligence:

• Tier 1 (didn't know): $145 to $73,011 per violation
• Tier 2 (reasonable cause): $1,461 to $73,011 per violation
• Tier 3 (willful neglect, corrected within 30 days): $14,602 to $73,011 per violation
• Tier 4 (willful neglect, not corrected): $73,011 to $2,190,294 per violation

The annual cap for identical violations is $2,190,294. Criminal penalties can reach $250,000 and 10 years in prison for offenses committed for commercial advantage.

These aren't theoretical numbers. Anthem paid $16 million in 2018 after a breach affecting 78.8 million people. In 2025, Solara Medical Supplies paid $3 million after a phishing attack exposed 114,000 individuals' data. OCR has been ramping up enforcement, with 21 financial penalty actions in 2025 alone.

What It Costs

Since there's no formal certification, "HIPAA compliance costs" really means the cost of building and maintaining the required safeguards:

• Risk assessment and gap analysis: $5,000-$15,000 if using a consultant
• Remediation (policies, controls, training): $10,000-$30,000 depending on starting point
• Compliance automation platform: $8,000-$25,000/year
• Ongoing monitoring and annual reassessment: $5,000-$15,000/year
• Total first year: $10,000-$50,000 for most mid-size companies

Many companies also pursue HITRUST CSF certification as a way to demonstrate HIPAA compliance to customers. HITRUST maps directly to HIPAA requirements and provides the formal certification that HIPAA itself lacks. But it adds $40,000-$200,000+ to the cost and takes 6-12 months.

How Compliance Tools Help

HIPAA's Security Rule requires continuous monitoring, not just periodic assessments. You need to track access controls, review audit logs, verify encryption status, manage employee training, and maintain evidence that all of this is actually happening.

Compliance automation platforms handle this by connecting to your cloud infrastructure, identity providers, and HR systems. They map controls directly to HIPAA requirements, pull evidence automatically, flag when something drifts out of compliance, and help you maintain the documentation that OCR expects to see during an investigation. All 17 tools in our database support HIPAA.

The alternative is spreadsheets, calendar reminders, and manual screenshots. It works at small scale, but it breaks down quickly as your infrastructure grows.

Common Mistakes

No risk analysis (or a stale one). This is the single most cited deficiency in OCR investigations. OCR launched a dedicated Risk Analysis Initiative in late 2024 and has been aggressively pursuing organizations that either skip the analysis entirely or did one five years ago and never updated it.

Missing Business Associate Agreements. Sharing PHI with a vendor without a signed BAA in place is itself a HIPAA violation. Both parties can be fined. The BAA must include specific provisions defined by HHS, including breach notification requirements, restrictions on PHI use, and obligations to return or destroy PHI at termination.

Unencrypted devices. Lost or stolen laptops and phones containing unencrypted ePHI remain a leading cause of breaches. Encryption is technically "addressable" under the Security Rule, but in practice there's almost never a valid reason not to encrypt.

Employee snooping. Staff accessing records of celebrities, coworkers, or family members without a business reason. The covered entity is liable even when the employee acted alone.

Treating the rules as static. HHS proposed a major Security Rule overhaul in January 2025 that would make MFA mandatory, require encryption everywhere, add penetration testing requirements, and eliminate the "addressable" designation entirely. The final rule timeline is uncertain, but the direction is clear: requirements are tightening.