What is HIPAA?
The Health Insurance Portability and Accountability Act (HIPAA) is a federal law enacted in 1996 that requires the creation of national standards to protect sensitive patient health information from being disclosed without the patient's consent or knowledge.
HIPAA consists of several rules, with the Privacy Rule and Security Rule being the most significant for healthcare organizations and their business partners. These rules establish standards for the protection of individuals' medical records and other personal health information.
Privacy Rule
Standards for PHI use and disclosure
Security Rule
Safeguards for electronic PHI
Breach Rule
Notification requirements for breaches
Enforcement
Penalties for non-compliance
Who Must Comply with HIPAA?
Organizations that directly handle PHI and must comply with all HIPAA rules:
- Healthcare Providers: Doctors, clinics, hospitals, dentists, nursing homes
- Health Plans: Insurance companies, HMOs, employer health plans
- Healthcare Clearinghouses: Billing services, claims processors
Third parties that handle PHI on behalf of covered entities:
- IT Providers: Cloud storage, EHR systems, data centers
- Service Providers: Medical transcription, billing companies
- Consultants: Attorneys, accountants handling PHI
- Subcontractors: Any vendor of a business associate
A legally binding contract required between covered entities and business associates that:
Must Include
- • Permitted uses of PHI
- • Required safeguards
- • Breach notification procedures
- • Subcontractor requirements
- • Termination provisions
Key Obligations
- • Use PHI only as permitted
- • Implement appropriate safeguards
- • Report breaches promptly
- • Ensure subcontractor compliance
- • Return/destroy PHI when done
The Privacy Rule
The HIPAA Privacy Rule establishes national standards for when Protected Health Information may be used and disclosed. It gives patients rights over their health information and sets rules and limits on who can look at and receive health information.
Access to Records
Patients can request and receive copies of their medical records within 30 days
Request Corrections
Patients can request amendments to incorrect or incomplete health information
Disclosure Accounting
Patients can receive a list of entities their information was shared with
Request Restrictions
Patients can request limits on uses and disclosures of their PHI
Confidential Communications
Patients can request communications via specific means or locations
When using or disclosing PHI, covered entities must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose.
Exceptions
The minimum necessary standard does not apply to: disclosures to healthcare providers for treatment, disclosures to the individual, uses pursuant to an authorization, or disclosures required by law.
The Security Rule
The HIPAA Security Rule specifically focuses on protecting electronic Protected Health Information (ePHI). It requires appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of ePHI.
54% of safeguards
- • Security officer designation
- • Workforce training
- • Access management
- • Risk assessments
- • Business associate agreements
26% of safeguards
- • Facility access controls
- • Workstation security
- • Device/media controls
- • Equipment disposal
- • Physical access logs
20% of safeguards
- • Access controls
- • Audit logs
- • Integrity controls
- • Transmission security
- • Encryption
Required
Must be implemented - no exceptions
- • Risk analysis
- • Unique user identification
- • Business associate contracts
- • Incident response procedures
Addressable
Implement if reasonable and appropriate
- • Encryption
- • Automatic logoff
- • Audit log review
- • Testing procedures
Required Safeguards
Security Risk Assessment
Conduct accurate and thorough assessment of potential risks to ePHI. Must be updated regularly and when environment changes.
Workforce Training
Train all workforce members on HIPAA policies and procedures. Document training and conduct periodic updates.
Access Management
Implement procedures for authorizing access to ePHI. Establish clearance procedures and termination procedures.
Incident Response
Identify and respond to suspected or known security incidents. Document incidents and their outcomes.
Access Controls
Unique user identification, automatic logoff, encryption and decryption of ePHI as appropriate.
Audit Controls
Hardware, software, and procedural mechanisms to record and examine access and other activity in systems containing ePHI.
Integrity Controls
Policies and procedures to ensure ePHI is not improperly altered or destroyed. Electronic mechanisms to corroborate ePHI has not been altered.
Transmission Security
Technical security measures to guard against unauthorized access to ePHI transmitted over networks.
Breach Notification Requirements
Days to Notify Individuals
Notify affected individuals without unreasonable delay, no later than 60 days after discovery. Use first-class mail or faster methods if urgent.
Days to Notify HHS
Report to Department of Health and Human Services within 60 days for breaches affecting fewer than 500 individuals.
Large Breach HHS Notification
For breaches affecting 500+ individuals, notify HHS immediately (within 24 hours is best practice).
Days for Media Notice
Breaches affecting 500+ individuals in a state require media notification to prominent outlets within 60 days.
Not all impermissible disclosures are breaches. Conduct a risk assessment considering:
Security Risk Assessment
A comprehensive security risk assessment is the foundation of HIPAA compliance. It identifies vulnerabilities and threats to ePHI, allowing organizations to implement appropriate safeguards.
Scope Definition
Identify where ePHI is created, received, maintained, or transmitted. Include all systems, applications, and devices.
Threat Identification
Identify potential threats including natural disasters, human threats (intentional and unintentional), and environmental threats.
Vulnerability Analysis
Identify vulnerabilities that could be exploited by threats. Consider technical, physical, and administrative vulnerabilities.
Risk Determination
Calculate risk levels based on likelihood and impact. Prioritize risks for remediation based on criticality.
Risk Management
Implement security measures to reduce risks to reasonable levels. Document decisions and maintain ongoing risk management.
Steps to HIPAA Compliance
1. Designate HIPAA Officers
Appoint Privacy and Security Officers responsible for developing and implementing HIPAA policies and procedures.
2. Conduct Risk Assessment
Perform comprehensive security risk assessment to identify vulnerabilities and threats to ePHI.
3. Develop Policies & Procedures
Create written policies addressing all HIPAA requirements including privacy, security, and breach notification.
4. Implement Safeguards
Deploy administrative, physical, and technical safeguards based on risk assessment findings.
5. Execute BAAs
Sign Business Associate Agreements with all vendors who handle PHI on your behalf.
6. Train Workforce
Provide HIPAA training to all workforce members and maintain training documentation.
7. Establish Incident Response
Create incident response and breach notification procedures with clear escalation paths.
8. Maintain Compliance
Conduct regular audits, update policies, retrain staff, and monitor for changes in regulations.
- ✓ Risk assessment reports
- ✓ Policies and procedures
- ✓ Training records
- ✓ Business Associate Agreements
- ✓ Incident response logs
- ✓ Audit reports
- ✓ Access authorization forms
- ✓ Equipment disposal records
- • HIPAA documentation: 6 years
- • Policies in effect: 6 years from last effective date
- • Training records: 6 years
- • Risk assessments: 6 years
- • Incident documentation: 6 years
- • Audit logs: Review regularly, retain per policy
- • BAAs: 6 years after termination
Penalties & Get a Quote
HIPAA compliance costs depend on your organization's size, the volume of PHI you handle, your current security posture, and the scope of technical and administrative safeguards needed. Factors such as risk assessments, policy development, staff training, and ongoing audits all influence total investment.
Get a personalized quote through the AuditNex marketplace to understand what your HIPAA compliance will cost.
Tier 1: Unknown Violation
Entity did not know and could not have reasonably known of violation
$100 - $50,000 per violation (max $1.5M/year)
Tier 2: Reasonable Cause
Violation due to reasonable cause, not willful neglect
$1,000 - $50,000 per violation (max $1.5M/year)
Tier 3: Willful Neglect - Corrected
Willful neglect but violation corrected within 30 days
$10,000 - $50,000 per violation (max $1.5M/year)
Tier 4: Willful Neglect - Not Corrected
Willful neglect and violation not corrected
$50,000 - $1.5M per violation (max $1.5M/year)