HIPAA Security and Privacy Requirements

The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for protecting the privacy and security of protected health information (PHI). Understanding HIPAA requirements is essential for healthcare organizations, business associates, and anyone handling patient information to ensure compliance and avoid significant penalties.

HIPAA Regulatory Framework

HIPAA consists of multiple rules that work together to protect patient information while enabling the flow of health information needed for high-quality healthcare.

HIPAA Rules Overview

Rule	Primary Purpose	Key Requirements
Privacy Rule	Protect PHI in any form	Use/disclosure limits, patient rights, minimum necessary
Security Rule	Protect electronic PHI (ePHI)	Administrative, physical, technical safeguards
Breach Notification Rule	Require breach reporting	Notification to individuals, HHS, media
Enforcement Rule	Enable compliance investigations	Penalties, investigation procedures
Omnibus Rule	Strengthen HIPAA requirements	BA liability, genetic information, penalties

Covered Entities and Business Associates

HIPAA applies to:

• Covered Entities (CE): Healthcare providers who transmit PHI electronically, health plans, and healthcare clearinghouses
• Business Associates (BA): Persons or organizations that perform functions or services involving PHI on behalf of a covered entity
• Subcontractors: Business associates of business associates

Privacy Rule Requirements

The Privacy Rule establishes national standards for the protection of PHI in any form (paper, electronic, or oral).

Protected Health Information (PHI)

PHI includes any individually identifiable health information that relates to:

• Individual’s past, present, or future physical or mental health condition
• Provision of health care to the individual
• Past, present, or future payment for provision of health care

18 HIPAA Identifiers

Category	Identifiers
Names	Full name
Geographic Data	Street address, city, county, zip code (except first 3 digits in some cases)
Dates	Birth date, admission date, discharge date, date of death, and all ages over 89
Phone Numbers	Telephone numbers, fax numbers
Electronic Addresses	Email addresses, URLs, IP addresses
Government IDs	Social Security numbers, medical record numbers, health plan beneficiary numbers
Account Numbers	Account numbers, certificate/license numbers
Vehicle/Device IDs	Vehicle identifiers, device identifiers and serial numbers
Biometric Data	Fingerprints, voiceprints, full-face photographs
Other	Any other unique identifying number, characteristic, or code

Permitted Uses and Disclosures

PHI may be used or disclosed without individual authorization for:

• Treatment: Provision, coordination, or management of healthcare
• Payment: Billing, claims management, utilization review
• Healthcare Operations: Quality assessment, training, business management
• Public Health Activities: Disease prevention, vital statistics, FDA reporting
• Law Enforcement: Court orders, administrative requests, legal proceedings
• Research: With IRB/Privacy Board approval or waiver
• To Avert Serious Threat: Preventing imminent harm

Patient Rights Under Privacy Rule

Right	Description	Timeframe
Access	Obtain copy of PHI in designated record set	30 days (60 with extension)
Amendment	Request correction of PHI	60 days (90 with extension)
Accounting of Disclosures	Receive list of non-TPO disclosures	60 days (90 with extension)
Request Restrictions	Request limits on use/disclosure	Must agree if paid out-of-pocket in full
Confidential Communications	Request alternative communication method	Must accommodate reasonable requests
Notice of Privacy Practices	Receive description of privacy practices	At first service encounter

Security Rule Requirements

The Security Rule establishes standards for protecting electronic PHI (ePHI) through administrative, physical, and technical safeguards.

Administrative Safeguards

Safeguard	Type	Requirements
Security Management Process	Required	Risk analysis, risk management, sanctions, review
Assigned Security Responsibility	Required	Designated security official
Workforce Security	Addressable	Authorization, supervision, clearance procedures
Information Access Management	Required/Addressable	Access authorization, establishment, modification
Security Awareness Training	Addressable	Security reminders, malware protection, login monitoring, password management
Security Incident Procedures	Required	Response and reporting
Contingency Plan	Required	Backup, disaster recovery, emergency mode
Evaluation	Required	Periodic technical and non-technical evaluation
Business Associate Contracts	Required	Written contracts with BAs

Physical Safeguards

Safeguard	Type	Requirements
Facility Access Controls	Addressable	Contingency operations, facility security plan, access control, maintenance records
Workstation Use	Required	Policies specifying proper functions and physical attributes
Workstation Security	Required	Physical safeguards restricting access to authorized users
Device and Media Controls	Required/Addressable	Disposal, media re-use, accountability, backup/storage

Technical Safeguards

Safeguard	Type	Requirements
Access Control	Required	Unique user ID, emergency access, automatic logoff, encryption
Audit Controls	Required	Hardware/software/procedural mechanisms to record and examine access
Integrity	Addressable	Mechanism to authenticate ePHI
Person or Entity Authentication	Required	Verify identity of those seeking access
Transmission Security	Addressable	Integrity controls, encryption

Required vs. Addressable Specifications

• Required: Must be implemented as specified
• Addressable: Must assess whether specification is reasonable and appropriate; if not, implement equivalent alternative or document why not applicable

Breach Notification Requirements

The Breach Notification Rule requires notification following a breach of unsecured PHI.

Breach Definition

A breach is the acquisition, access, use, or disclosure of PHI in violation of the Privacy Rule that compromises the security or privacy of the PHI. Three exceptions apply:

1. Unintentional acquisition, access, or use by workforce member acting in good faith
2. Inadvertent disclosure to another authorized person within same organization
3. Disclosure where recipient would not reasonably be able to retain information

Breach Risk Assessment

Four factors to determine if breach notification is required:

1. Nature and extent of PHI involved
2. Unauthorized person who used PHI or to whom disclosure was made
3. Whether PHI was actually acquired or viewed
4. Extent to which risk to PHI has been mitigated

Notification Requirements

Breach Size	Individual Notice	HHS Notice	Media Notice
<500 individuals	Within 60 days of discovery	Annually (within 60 days of calendar year end)	Not required
≥500 individuals	Within 60 days of discovery	Within 60 days of discovery	Within 60 days of discovery (same state/jurisdiction)

Enforcement and Penalties

Civil Money Penalties

Violation Category	Minimum Penalty	Maximum Penalty	Annual Cap
Did Not Know	$127 per violation	$63,973	$1,919,173
Reasonable Cause	$1,280 per violation	$63,973	$1,919,173
Willful Neglect – Corrected	$12,794 per violation	$63,973	$1,919,173
Willful Neglect – Not Corrected	$63,973 per violation	$1,919,173	$1,919,173

Note: Penalty amounts adjusted annually for inflation.

Criminal Penalties

Offense	Penalty
Knowingly obtaining/disclosing PHI	Up to $50,000 and 1 year imprisonment
Offense committed under false pretenses	Up to $100,000 and 5 years imprisonment
Offense with intent to sell, transfer, or use for commercial advantage, personal gain, or malicious harm	Up to $250,000 and 10 years imprisonment

Risk Analysis Requirements

Risk analysis is the foundation of HIPAA Security Rule compliance. Organizations must:

• Identify all systems that create, receive, maintain, or transmit ePHI
• Identify and document potential threats and vulnerabilities
• Assess current security measures
• Determine likelihood and impact of threats
• Determine level of risk
• Document risk analysis results
• Review and update as needed

Related Resources

For additional information on healthcare privacy and security requirements, explore these resources:

• Compliance Standards Hub – Regulatory requirements and guidelines
• Medical Device Cybersecurity
• CMS Conditions of Participation
• Documentation Hub – Technical equipment specifications
• Knowledge Base Hub – Healthcare equipment guides