What is HIPPA?

HIPAA stands for the Health Insurance Portability and Accountability Act, a U.S. federal law passed in 1996. It does not stand for the “Health Information Privacy Protection Act.” That law does not exist, and it's where the extra P usually sneaks in from.

Read more: HIPAA at HHS.gov

The brain autocompletes the name from what the law feels like it should be: a privacy protection act, two P's. The actual name is about insurance portability and accountability, and the privacy rules everyone associates with it came later, in regulations HHS wrote under the law. This site is called WhatIsHIPPA.com on purpose: it is how a great many people spell it. (An alternate explanation: People picture a hippopotamus when they think HIPPA, and let's face it, a hippopotamus is more fun than healthcare data legislation.)

What people call the “HIPAA laws” are rules HHS wrote under the one law. The Privacy Rule says when health information may be used and shared, and gives patients rights over their records. The Security Rule requires safeguards for health information kept or sent electronically. The Breach Notification Rule requires notifications following certain breaches of unsecured protected health information. The Enforcement Rule covers how HHS investigates and penalizes. HHS publishes a summary of each.

Read more: HIPAA for professionals

HIPAA applies to covered entities: health plans, healthcare clearinghouses, and healthcare providers that conduct certain standard transactions electronically, which includes most doctors, hospitals, pharmacies, and therapists that bill health plans electronically. It also applies to their business associates: vendors that handle health information for them, such as EHR software, billing services, cloud hosts, telehealth platforms, and AI scribes. It generally does not apply to employers acting as employers, schools, most consumer apps, or individuals, so your step counter is not covered but your cardiologist is.

Read more: Covered entities and business associates

Under HIPAA, protected health information (PHI) is health information that identifies a person and is held by a covered entity or business associate, in any form: spoken, on paper, or electronic. Your blood pressure in your doctor's chart is PHI, and so is a session note maintained by a HIPAA-covered therapist or practice. The same information typed by you into a fitness or mood-tracking app generally is not, because the app is not covered by HIPAA.

Read more: Summary of the Privacy Rule

A HIPAA violation generally means an organization HIPAA covers, or someone who works for it, failed to follow one of HIPAA's rules: sharing information it shouldn't have, failing to protect it, or denying a patient access to their own records. Common examples: a staff member opening a chart with no work reason, test results or session notes sent to the wrong person, posting about patients online, failing to use required safeguards, or mishandling a breach of protected health information. HIPAA violations involve HIPAA-regulated entities, meaning covered entities and business associates, or people acting through those organizations. An ordinary person who is not acting for a HIPAA-regulated organization generally cannot violate HIPAA. Not every privacy mistake is a violation, either; the rules allow a good deal of sharing, such as between your doctor and a specialist, without asking you first.

Read more: HIPAA compliance and enforcement

You can file a complaint with the HHS Office for Civil Rights, which enforces HIPAA. HHS explains what a complaint needs to include and how long you have to file, and organizations are not allowed to retaliate against you for complaining. HIPAA itself does not give individuals a right to sue; whether other laws do is a question for a lawyer.

Read more: Filing a HIPAA complaint

HIPAA compliance means a covered organization is following HIPAA's rules on an ongoing basis. It is a state, not a certificate. No product is “HIPAA compliant” on its own: an EHR or AI scribe can support a practice's compliance, but how the practice sets it up and uses it matters too. And compliance is not a guarantee. Following the rules is a floor for how health information must be handled, not a promise that any particular organization handles it well. Nor is it a guarantee that protected health information will never be leaked, improperly accessed, or mishandled.

Read more: HIPAA for professionals

There is no official HHS HIPAA certification for organizations or products. HHS does not endorse or recognize private certifications as proof of compliance. A training certificate shows a person completed a course. A third-party audit can be useful evidence that a vendor takes security seriously. A “HIPAA Certified” seal has no legal standing, no matter how shiny the badge. (Seriously, even if it looks super professional looking.)

Read more: HHS on certification

There is no single HIPAA form. People usually mean one of a few documents. An authorization lets a doctor or therapist release your records to someone else, such as a lawyer or an insurer. The Notice of Privacy Practices is the document you are handed at a first visit, and the acknowledgment you sign at check-in just confirms you received it. A request to access your own records does not require a HIPAA authorization, although the provider may require you to submit an access request or verify your identity. On the business side, a business associate agreement (or BAA) is the contract between a practice and a vendor like its EHR or billing service. HHS publishes model notices and sample agreement language.

Read more: HIPAA for individuals

HIPAA requires covered organizations to train their workforce on applicable privacy policies and procedures and to provide security awareness and training. It does not name a course, a provider, or a number of hours, and HHS does not approve or endorse training vendors. HHS publishes free educational materials of its own.

Read more: HIPAA training and resources

HIPAA generally does not apply to employers acting as employers, your landlord, or a stranger asking nosy questions. Workplace health questions are governed mainly by other laws, such as the ADA and FMLA. HIPAA does cover your doctor or therapist, who generally needs your permission before sharing your records with your employer.

Read more: Employers and health information in the workplace

HIPAA regulates covered organizations, not patients. You can share your own health information with anyone you like, and repeating something you overheard in a waiting room or a group therapy session is not a HIPAA violation, though other laws or agreements may apply. A nurse or a therapist can share their own records freely too; the same person opening a coworker's chart out of curiosity is acting as staff, and that is a HIPAA problem.

Read more: Your rights under HIPAA

If an EHR, AI scribe, telehealth platform, or billing service creates, receives, maintains, or transmits PHI on behalf of a covered entity, it is generally a business associate, and HIPAA requires an appropriate business associate agreement. “Compliant” describes how the tool is set up and used, not a badge on the product, and there is no official certification. The same tool can be used carefully by one practice and carelessly by another.

Read more: Business associates

The HIPAA Security Rule requires safeguards for electronic protected health information. Encryption is currently an “addressable” implementation specification: an organization must determine whether it is reasonable and appropriate based on its risk analysis and, if it does not use encryption, document that decision and use an appropriate alternative when necessary. It's also important to understand the difference between encryption in transit, encryption at rest, and end-to-end encryption. Encryption does not guarantee that health information can never be improperly accessed or involved in a breach.

Read more: Summary of the Security Rule