HIPAA (Health Insurance Portability and Accountability Act) establishes national standards for protecting sensitive patient health information. If your company handles Protected Health Information (PHI), understanding and implementing HIPAA requirements is mandatory.
What is HIPAA?
HIPAA is a US federal law that sets standards for the protection of individually identifiable health information. It consists of multiple rules governing privacy, security, and breach notification requirements.
PHI includes any information that can identify a patient and relates to their health condition, healthcare provision, or payment for healthcare services.
Who Must Comply?
Covered Entities: Healthcare providers, health plans, and healthcare clearinghouses
Business Associates: Any organization that handles PHI on behalf of a covered entity (includes most healthcare SaaS)
Subcontractors: Downstream vendors of business associates also must comply
The Security Rule
Requires implementation of safeguards to protect ePHI (electronic PHI):
Administrative Safeguards: Risk assessments, security policies, workforce training, incident response
Physical Safeguards: Facility access controls, workstation security, device disposal
Technical Safeguards: Access controls, audit controls, integrity controls, transmission security
The Privacy Rule
Minimum Necessary: Only access/disclose the minimum PHI needed for the purpose
Patient Rights: Right to access, amend, and receive accounting of disclosures
Authorization: Written authorization required for most uses beyond treatment, payment, operations
Privacy Notice: Must provide notice of privacy practices to patients
Breach Notification
Individual Notice: Notify affected individuals within 60 days of discovery
HHS Notification: Report to Department of Health and Human Services; major breaches (500+) require immediate notification
Media Notice: Breaches affecting 500+ in a state require media notification
Business Associate: Must notify covered entity within 60 days of breach discovery
BAA Requirements
A Business Associate Agreement (BAA) is a contract establishing:
- Permitted uses and disclosures of PHI by the business associate
- Security safeguards the business associate must implement
- Breach notification obligations and timelines
- Return or destruction of PHI upon contract termination
- Subcontractor requirements and flow-down provisions