What is HIPAA? Explained simply
By Sid Varma, Founder - AllyMatter.com
help
What HIPAA is for
HIPAA is the Health Insurance Portability and Accountability Act of 1996, a United States federal law. The part everyone means when they say "HIPAA" is a set of regulations written by the Department of Health and Human Services (HHS) that govern how health information is used, shared and protected.
Those regulations live in Title 45 of the Code of Federal Regulations (45 CFR Parts 160 and 164), and they are enforced by the HHS Office for Civil Rights (OCR).
The problem they solve is simple. Your medical history is valuable to insurers, employers, marketers and criminals, and before HIPAA there was no national rule saying who could see it. HIPAA sets a floor: the organizations that hold health information must limit who sees it, protect it, tell you what they do with it, let you see and correct it, and tell you when it leaks.
A 2009 law, the HITECH Act, added breach notification, raised the penalties and extended direct liability to contractors. The last broad rewrite of the rules was the 2013 Omnibus Rule.
Does HIPAA apply to you?
HIPAA does not apply to health information in general. It applies to two kinds of organization, and to information they hold. The first kind is a covered entity: a health plan, a health care clearinghouse, or a health care provider that sends any health information electronically in a transaction for which HHS has adopted a standard, such as an insurance claim (45 CFR 160.103).
The second kind is a business associate: any person or company that creates, receives, maintains or transmits protected health information on a covered entity's behalf, plus any subcontractor down the chain that does the same.
Protected health information (PHI) is individually identifiable health information held or transmitted by one of these organizations in any form. Electronic PHI (ePHI) is the subset in electronic form, and it is what the Security Rule covers.
Two tests trip people up. A provider that only takes cash and never bills electronically is not a covered entity. And a company is a business associate only if it works for a covered entity; a fitness app that collects heart rates directly from consumers is not, however sensitive the data.
HHS publishes a decision tool for the covered entity question, and the regulation's own definition is the final word.
| Who | Covered? | Why |
|---|---|---|
| Doctor, dentist, clinic, pharmacy that bills insurers electronically | Yes, covered entity | A provider that transmits a standard transaction electronically |
| Health insurer, HMO, employer group health plan, Medicare and Medicaid | Yes, covered entity | A health plan |
| Billing company, cloud host of medical records, IT support with access, law or accounting firm receiving PHI | Yes, business associate | Handles PHI on a covered entity's behalf |
| Subcontractor of a business associate that touches PHI | Yes, business associate | The definition reaches down the chain |
| Employer holding staff sick notes in HR files | No | An employer is not a covered entity for its HR files, and even a covered entity's employment records are excluded from PHI |
| Consumer health or fitness app with no covered entity client | No | Not a covered entity, not working for one; the FTC Health Breach Notification Rule may apply instead |
| School holding student health records | No | Education records under FERPA are excluded from PHI |
| Life insurer, workers compensation carrier | No | Not a health plan as defined |
The three rules and where they live
"HIPAA compliance" means complying with three sets of rules (45 CFR Part 164), plus the general and enforcement provisions (45 CFR Part 160). Since the 2013 rewrite, business associates are directly liable under the Security Rule, the Breach Notification Rule and the parts of the Privacy Rule that apply to them (45 CFR 164.502(a)(3)).
A common misstatement is that the Privacy Rule applies only to covered entities. A business associate may use or disclose PHI only as its contract or the law permits, and can be penalized directly when it does otherwise.
| Rule | Where it sits | What it requires | Applies to |
|---|---|---|---|
| Privacy Rule | 45 CFR Part 164, Subpart E | Limits on using and disclosing PHI; the minimum necessary standard; individual rights to access, amend and get an accounting; a notice of privacy practices; a privacy official; workforce training; sanctions; six-year record keeping | Covered entities; business associates for the parts that reach them |
| Security Rule | 45 CFR Part 164, Subpart C | Administrative, physical and technical safeguards for ePHI; a risk analysis; a security official; written policies kept for six years | Covered entities and business associates |
| Breach Notification Rule | 45 CFR Part 164, Subpart D | Notice to individuals, HHS and sometimes the media after a breach of unsecured PHI; a business associate must notify its covered entity | Covered entities and business associates |
| Enforcement Rule | 45 CFR Part 160, Subparts C, D and E | How OCR investigates, the penalty tiers, the 180-day complaint window | Everyone above |
What it actually asks of you
Strip away the vendor language and HIPAA asks for a small number of things done in writing.
Know your risks. The Security Rule's first administrative requirement is an accurate and thorough assessment of the risks and vulnerabilities to the ePHI you hold, followed by measures that reduce those risks to a reasonable level (45 CFR 164.308(a)(1)(ii)(A) and (B)).
This risk analysis is the document OCR asks for first in almost every investigation, and OCR names its absence in most of its recent Security Rule settlements. It is not a checklist and it is not a scan; it is a written account of where your ePHI lives, what could go wrong, how likely that is, and what you are doing about it.
Put safeguards in place. The Security Rule has 18 standards grouped as administrative, physical and technical safeguards, each with implementation specifications. Each specification is marked either Required or Addressable (45 CFR 164.306(d)).
Required means do it. Addressable does not mean optional: you must assess whether the measure is reasonable and appropriate for your environment, then implement it, or document why not and implement an equivalent alternative where one is reasonable. Encryption of stored and transmitted ePHI is addressable under the rule in force today.
In practice, an unencrypted laptop with patient records is hard to defend, and encryption also earns a safe harbor from breach notification, so most organizations choose it. But the rule itself does not require it yet.
Write it down and keep it. Policies and procedures must be written, and every action, activity or assessment the rule requires you to document must be kept for six years from the date it was created or last in effect (45 CFR 164.316(b)).
Training must be given to every workforce member when they join and whenever a policy change affects their work, and documented (45 CFR 164.530(b)). The rule sets no annual frequency for training, for the risk analysis, or for anything called an audit. Many programs run yearly cycles, which is sensible practice, but it is practice, not the regulation.
Name people. A covered entity needs a designated privacy official and a security official. A small practice can give both roles to one person.
What HIPAA is not
It is not a certification. There is no HIPAA certificate, no registry of compliant organizations and no HHS approval. HHS says in its own guidance that no standard requires a covered entity to certify compliance, that it does not endorse or recognize private organizations' certifications, and that holding one does not stop HHS from later finding a violation.
A badge on a website tells a buyer nothing that HHS stands behind.
It is not an audit requirement. The Security Rule asks for a periodic technical and nontechnical evaluation of whether your policies meet the rule (45 CFR 164.308(a)(8)). You can do that internally.
Nothing in the rule requires an outside firm, a report or an attestation, and OCR judges compliance on your own documentation. Advice that you must hire an audit firm to prove compliance is describing a service, not a legal duty.
It is not a control list. The Security Rule has standards and implementation specifications, but there is no official list of "HIPAA controls". Frameworks that map to it are useful tools, not the rule.
It is not a consumer data law. Most health apps, wearables and wellness sites are outside HIPAA. For them the Federal Trade Commission's Health Breach Notification Rule (16 CFR Part 318) and state privacy laws can apply, and those are a different subject.
How it works end to end
For a covered entity the sequence is: work out what PHI you hold and where; run the risk analysis; write policies for each standard; train staff; publish a notice of privacy practices; sign business associate agreements with every vendor that touches PHI; keep the records.
Then repeat the review whenever something material changes, and handle access requests and incidents as they arrive.
For a business associate the trigger is the contract. You cannot become a business associate by signing an agreement if you do not handle PHI, and you cannot avoid being one by refusing to sign if you do. Once you are one, you owe the Security Rule in full, the breach duties, and whatever the agreement passes down from the Privacy Rule.
You must also sign the same kind of agreement with your own subcontractors.
A business associate agreement (BAA) is not a formality; the regulation lists what it must say (45 CFR 164.504(e)(2)).
It must set out the permitted uses and disclosures; require appropriate safeguards and Security Rule compliance for ePHI; require reports to the covered entity of any unpermitted use, including breaches; flow the same terms down to subcontractors; support the individual's rights of access, amendment and accounting; make books and records available to HHS; return or destroy PHI at the end, or explain why that is not feasible; and allow the covered entity to terminate for a material violation.
HHS publishes sample provisions. A covered entity that knows its business associate is breaking the agreement and does nothing is itself out of compliance.
The clocks you have to hit
HIPAA is full of deadlines and the two sets that matter most are the individual's right of access and breach notification. The access clock is a frequent source of penalties in its own right; OCR has run a dedicated enforcement initiative on it since 2019 and continues to settle cases under it.
On breaches, a "breach" is an acquisition, access, use or disclosure of unsecured PHI that the Privacy Rule does not permit, apart from three narrow exceptions for good-faith internal mistakes and recipients who could not have kept the data.
It is presumed reportable unless you can show through a documented four-factor risk assessment that there is a low probability the information was compromised (45 CFR 164.402). "Unsecured" means not encrypted or destroyed by the methods HHS specifies in its guidance, which points to the relevant NIST publications.
Encrypted data whose key was not exposed is not a reportable breach. The burden of proving you either notified or did not need to sits with you (45 CFR 164.414(b)), so document the decision either way.
| Event | Deadline | Rule |
|---|---|---|
| Individual asks for a copy of their records | Act within 30 days; one extension of up to 30 days with written reasons; reasonable cost-based fee only | 45 CFR 164.524 |
| Individual asks to amend their record | Act within 60 days; one 30-day extension | 45 CFR 164.526 |
| Individual asks for an accounting of disclosures | 60 days; one 30-day extension | 45 CFR 164.528 |
| Breach discovered: notify affected individuals | Without unreasonable delay, no later than 60 calendar days after discovery, by first-class mail (email only if the person agreed) | 45 CFR 164.404 |
| Breach affects 500 or more individuals: notify HHS | Same time as the individual notices, through the HHS breach portal | 45 CFR 164.408(b) |
| Breach affects fewer than 500: notify HHS | Log it; report through the portal within 60 days after the end of the calendar year in which it was discovered | 45 CFR 164.408(c) |
| Breach affects more than 500 residents of one state or jurisdiction: notify media | Prominent media outlets in that state, within the same 60 days | 45 CFR 164.406 |
| Business associate discovers a breach: notify covered entity | Without unreasonable delay, no later than 60 days after discovery; the contract can require faster | 45 CFR 164.410 |
| Law enforcement asks you to hold off | Delay for the period stated in writing; an oral request buys at most 30 days | 45 CFR 164.412 |
| Someone wants to complain to OCR | Within 180 days of when they knew or should have known | 45 CFR 160.306(b) |
Two details are commonly misstated. Media notice depends on more than 500 residents of one state, not on the national total. And there is no duty to call the police after a breach; law enforcement enters the rule only as a reason to delay notice.
A worked example
Take an illustrative 12-person physical therapy practice with two locations, which bills insurers electronically and uses a cloud practice-management system, an outside billing company and a managed IT provider. It is a covered entity.
The three vendors are business associates and each needs a signed agreement before it touches patient data; the cloud vendor is a business associate even if it never opens a file, because it stores ePHI.
The owner names herself privacy official and the office manager security official. Together they list where ePHI lives: the cloud system, the billing feed, staff email, two laptops that travel between sites, and paper intake forms.
The risk analysis records each location, the threats to it (lost laptop, phishing, a staff member looking up a neighbor's file, the cloud vendor's outage), how likely each is and what they will do.
Decisions go in writing: the laptops get full-disk encryption (an addressable specification they chose to implement), email gets multi-factor sign-in, paper forms go in a locked cabinet and are shredded on a schedule, access rights are reviewed when anyone leaves. Staff are trained at hire and the sign-in sheets are kept.
A year later a laptop is stolen from a car. Because it was encrypted and the key was not on the device, the PHI was not "unsecured" and no notification is due, but the practice writes up the incident and its reasoning and keeps it. Six months after that, a patient asks for her full record.
The practice sends it within 30 days at a cost-based fee. Nothing here required a consultant or a certificate. It required a written risk analysis, a set of policies people actually follow, signed agreements, and a folder that shows all of it for six years.
Who does what
HIPAA is unusual among the frameworks on this site because there is no independent auditor, no certification and no accreditation body. The only party that decides whether you comply is the government.
| Role | Who | What they do |
|---|---|---|
| Writes the rules | HHS, through the Office for Civil Rights | Issues and amends 45 CFR Parts 160 and 164 by notice-and-comment rulemaking |
| Enforces civil compliance | HHS Office for Civil Rights | Takes complaints, investigates breach reports, runs compliance reviews, negotiates resolution agreements with corrective action plans, imposes civil money penalties |
| Prosecutes crimes | Department of Justice, on OCR referral | Knowingly obtaining or disclosing PHI: up to $50,000 and one year; under false pretenses up to $100,000 and five years; for commercial advantage or malicious harm up to $250,000 and ten years (42 U.S.C. 1320d-6) |
| Sues on behalf of residents | State attorneys general | Civil actions for injunctions and statutory damages under the HITECH Act (42 U.S.C. 1320d-5(d)) |
| Audits | HHS Office for Civil Rights | Runs its own periodic compliance audits; the 2024-2025 round reviews 50 covered entities and business associates on Security Rule provisions tied to hacking and ransomware. No third-party audit is required |
| Certifies | Nobody | No certification is recognized by HHS |
| Accredits auditors | Nobody | There is no accreditation scheme for HIPAA auditors or certifiers |
Most enforcement ends in a resolution agreement: a settlement payment plus a corrective action plan that OCR monitors, usually for two or three years, with HHS approving your risk analysis and risk management plan along the way. Civil money penalties are imposed when that route fails.
OCR's own tally, last updated on its site for October 31, 2024, was 152 cases settled or penalized for a combined $144,878,972 since 2003, out of more than 374,000 complaints received; the large majority of complaints end with corrective action, technical assistance or a finding of no violation.
The resolution agreements list on the HHS site runs through September 2026 and shows the pattern: ransomware and hacking investigations that turn on the missing risk analysis, and right of access cases.
Penalties at current values
Civil penalties are tiered by how much you knew and whether you fixed the problem, and the dollar amounts are adjusted for inflation each year when HHS publishes its annual adjustment, which in recent years has come anywhere between January and November. The regulation sets the same annual cap for every tier.
Since April 2019, however, HHS has said it will apply the lower caps written in the HITECH Act for the first three tiers as a matter of enforcement discretion, pending rulemaking that has not happened. Pages that quote "$100 to $50,000" are giving the 2009 statutory figures, not today's.
| Tier (45 CFR 160.404) | Per violation, in effect since January 28, 2026 | Annual cap in the regulation | Cap OCR applies under the 2019 notice |
|---|---|---|---|
| Did not know and could not reasonably have known | $145 to $73,011 | $2,190,294 | $25,000, adjusted for inflation |
| Reasonable cause, not willful neglect | $1,461 to $73,011 | $2,190,294 | $100,000, adjusted for inflation |
| Willful neglect, corrected within 30 days | $14,602 to $73,011 | $2,190,294 | $250,000, adjusted for inflation |
| Willful neglect, not corrected | $73,011 to $2,190,294 | $2,190,294 | $1,500,000, adjusted for inflation (the same as the regulation's cap, $2,190,294) |
The cap applies per identical provision per calendar year, so an organization that violates several provisions can exceed it. Amounts are from the HHS penalty table (45 CFR 102.3) as amended by the final rule of January 28, 2026 (91 FR 3665), which applied the 2025 inflation adjustment.
The 2019 caps are the unadjusted HITECH figures; the notice says HHS applies them as adjusted for inflation, and we did not find a published table of those adjusted figures.
What it costs and how long it takes
HHS charges nothing. There is no registration, no filing fee, no certificate to buy and no renewal. The regulations are free on eCFR, and HHS publishes its guidance, sample business associate provisions and a free security risk assessment tool.
Your real cost is time: the risk analysis, the policies, training and the safeguards you decide are reasonable. Consultants, lawyers and software are optional and their fees are their own; we do not publish their prices.
What drives any quote is the number of systems holding ePHI, the number of locations and staff, how many vendors need agreements, and whether you have any documentation to start from.
How long it takes depends on the same things. There is no grace period for an existing organization: the core rules have applied for years, the Security Rule in its current form since 2013, and you are expected to comply now. New or amended rules come with their own dates, normally 180 days after the effective date (45 CFR 160.105).
What changed in 2025 and 2026, and where it leads next
The most important thing to know about HIPAA in September 2026 is what has not happened. The proposed overhaul of the Security Rule is still a proposal. We have written it up in detail in our article on the Security Rule update status, and the short version is in the table.
| Date | What | Status on September 29, 2026 |
|---|---|---|
| January 6, 2025 | HHS publishes the proposed Security Rule rewrite (90 FR 898): every specification required, mandatory encryption and multi-factor authentication, asset inventory and network map, yearly compliance audit, 72-hour restoration, and more; comments closed March 7, 2025 | Proposed. Not final, not in force. The 2026 Unified Agenda lists it as a long-term action with final action scheduled for July 2027 |
| June 18, 2025 | A federal court in Texas (Purl v. HHS) vacates most of the 2024 reproductive health privacy rule nationwide | Vacated. The rule's text still appears on eCFR but is not enforceable; HHS says only the surviving notice of privacy practices changes remain |
| February 16, 2026 | Compliance date for the remaining changes to the notice of privacy practices, and for the 42 CFR Part 2 rule that aligns substance use disorder treatment records with HIPAA's breach, penalty and notice rules | In force |
| January 28, 2026 | Inflation adjustment of civil penalties, the 2025 annual adjustment (91 FR 3665) | In force for penalties assessed from January 28, 2026; no later adjustment published |
| Through September 2026 | OCR continues settling ransomware, hacking and right of access cases; the missing or inadequate risk analysis is named in most Security Rule settlements | Ongoing |
Where it leads next. If the Security Rule proposal is finalized, the proposal itself would give regulated entities 180 days after a 60-day effective date to comply, so nothing would bite before 2028 on the current agenda date, and the final text could differ.
A separate final Privacy Rule on coordinated care and individual engagement has been under White House review since April 2026 and is unpublished. In the meantime the rule that applies is the 2013 rule, and the practical priority is unchanged: a current, written, honest risk analysis, and evidence you acted on it.
If you sell to health care, expect customers to ask for your risk analysis, your policies and your signed agreements, because those are the documents OCR would ask them for.
What we could not verify
OCR describes a Risk Analysis Initiative launched in late 2024 and counts its enforcement actions under it. HHS blocks automated access and we could not open the page that states the launch date and the running count, so we have described the pattern from the resolution agreements list and the OSF Healthcare System agreement of July 2026 instead.
The inflation-adjusted versions of the 2019 enforcement-discretion caps. The 2019 notice says HHS applies them as adjusted for inflation but we found no published table.
OCR's cumulative enforcement totals after October 31, 2024. The enforcement highlights page still carries that date.
The results of OCR's 2024-2025 compliance audits. OCR's audit page says the round covers 50 covered entities and business associates and that it will publish an industry report when the audits end; we did not find that report.
Need a hand implementing it?
Find a consultant for HIPAA
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
What people ask.
Is there a HIPAA certification?
No. HHS says no standard requires certification, that it does not endorse or recognize private certifications, and that having one does not prevent a later finding of violation. A vendor or consultant can review you against the rules, but the result is their opinion, not a credential HHS stands behind.
Does HIPAA require an annual audit or annual training?
No. The Security Rule requires a periodic evaluation and the Privacy Rule requires training at hire and after material policy changes, with documentation. Neither sets a yearly cycle. The 2025 proposed rule would add an annual compliance audit, but it is not final.
Is encryption required under HIPAA?
Under the current rule it is addressable: you must implement it if reasonable and appropriate, or document why not and use an equivalent alternative. Encrypted data whose key is not exposed also falls outside breach notification, which is why nearly everyone chooses it. The proposed Security Rule would make it mandatory with limited exceptions.
Does the Privacy Rule apply to business associates?
Yes, in part, and directly. Since 2013 a business associate may use or disclose PHI only as its agreement or the law permits, must support access, amendment and accounting requests, and is liable for its own violations. It also owes the whole Security Rule and the breach notification duties.
What are the HIPAA fines in 2026?
Civil penalties run from $145 per violation at the lowest tier to $2,190,294 per violation for uncorrected willful neglect, with an annual cap in the regulation of $2,190,294 per identical provision, and lower caps for the first three tiers that HHS applies as a matter of enforcement discretion. Most cases end in a negotiated settlement with a corrective action plan rather than a formal penalty. Criminal penalties for knowingly obtaining or disclosing PHI go up to $250,000 and ten years.
How long do I have to answer a patient's records request?
Thirty days from receipt, with one extension of up to 30 days if you tell the person in writing why and when. You may charge only a reasonable, cost-based fee. OCR has an active enforcement program on this right and has penalized providers for missing it.
Is the new HIPAA Security Rule in effect?
No. It was proposed in January 2025 and remains a proposal as of September 29, 2026, with final action listed on the federal agenda for July 2027. The Security Rule in force is the 2013 version, including the required and addressable distinction.
What each one is doing here.
eCFR, 45 CFR 160.103, Definitions (covered entity, business associate, protected health information, health care provider)eCFR, 45 CFR 164.104, ApplicabilityeCFR, 45 CFR 164.502, Uses and disclosures: general ruleseCFR, 45 CFR 164.504(e), Business associate contractseCFR, 45 CFR 164.306, Security standards: general ruleseCFR, 45 CFR 164.308, Administrative safeguardseCFR, 45 CFR 164.312, Technical safeguardseCFR, 45 CFR 164.316, Policies and procedures and documentation requirementseCFR, 45 CFR 164.530, Administrative requirements (Privacy Rule)eCFR, 45 CFR 164.402 to 164.414, Breach Notification RuleeCFR, 45 CFR 164.524, 164.526 and 164.528, Individual rightseCFR, 45 CFR 160.306, Complaints to the SecretaryeCFR, 45 CFR 160.404, Amount of a civil money penaltyeCFR, 45 CFR 102.3, Penalty adjustment table (current as of September 24, 2026)Federal Register, Annual Civil Monetary Penalties Inflation Adjustment, 91 FR 3665, January 28, 2026Federal Register, Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties, 84 FR 18151, April 30, 2019eCFR, 45 CFR 160.105, Compliance dates for new or modified standards42 U.S.C. 1320d-6, Wrongful disclosure of individually identifiable health information (via Cornell LII)42 U.S.C. 1320d-5(d), Enforcement by State attorneys general (via Cornell LII)HHS OCR FAQ, Are we required to certify our organization's compliance with the standards of the Security Rule?HHS OCR, Covered Entities and Business AssociatesHHS OCR, Submitting Notice of a Breach to the SecretaryHHS OCR, Guidance to Render Unsecured PHI Unusable, Unreadable, or IndecipherableHHS OCR, Resolution Agreements and Civil Money Penalties (list)HHS OCR, OSF Healthcare System Resolution Agreement and Corrective Action Plan, signed July 1, 2026HHS OCR, HIPAA Enforcement Highlights (as of October 31, 2024)Federal Register, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, proposed rule, 90 FR 898, January 6, 2025Reginfo.gov, Unified Agenda entry for RIN 0945-AA22, 2026 editionHHS OCR, HIPAA Security Rule NPRM pageHHS OCR, HIPAA and Reproductive Health (Purl v. HHS notice)HHS, Fact Sheet: 42 CFR Part 2 Final Rule (updated January 30, 2026)Federal Register, Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules (Omnibus Rule), 78 FR 5566, January 25, 2013eCFR, 16 CFR Part 318, FTC Health Breach Notification RuleReginfo.gov, OIRA review of the HIPAA Privacy Rule final rule (RIN 0945-AA00)Policy & Compliance, The HIPAA Security Rule overhaul: proposed in 2025, and where it stands now (fact-checked September 25, 2026)