What Is HIPAA Compliance? Rules, Requirements & Who Needs It
Robin Joseph
Senior Security Consultant
HIPAA compliance means following the U.S. federal law that protects patients' health information from being seen or shared without permission.
In practice, that means safeguards, staff training, signed agreements with vendors, and proof of all of it if anyone asks. It applies to health information in any form: electronic records, paper charts, billing data, or a conversation about a patient.
HIPAA, the Health Insurance Portability and Accountability Act, is a federal law signed on August 21, 1996. The HHS Office for Civil Rights (OCR) enforces it. For background on the law itself, see our guide to what HIPAA means for healthcare providers.
HIPAA is not a single checklist. It is three enforceable rules working together: a Privacy Rule that controls use and disclosure (covered in the section below), a Security Rule that protects electronic PHI specifically, and a Breach Notification Rule that sets deadlines after something goes wrong. Compliance means meeting all three, not picking the easiest one.
What Does It Mean to Be HIPAA Compliant?
Being HIPAA compliant means you can show, with documents, that you protect health information the way the law requires.
There is no official certificate, so compliance comes down to having these six things in place:
- A risk analysis done in the last 12 months, with a plan to fix what it found.
- Written privacy and security policies that staff actually follow.
- A signed business associate agreement (BAA) with every vendor that touches PHI.
- Administrative, physical, and technical safeguards, such as access controls, encryption, and audit logs.
- HIPAA training for every employee, with completion records.
- A breach response plan that meets the 60-day notification deadline.
If you can produce all six on request, you are in a strong position. If one is missing, that is the gap to close first. Our HIPAA compliance checklist turns this into step-by-step tasks.
What Counts as Protected Health Information
Protected health information, or PHI, is any individually identifiable health information about a person's past, present, or future physical or mental health, the care they received, or payment for that care. It counts whether it is electronic, on paper, or spoken, and whenever a covered entity or business associate handles it.
A patient chart that says "John Smith, diabetes diagnosis" is PHI. A health plan report that says "average member age: 45 years" with no identifiers attached is not. The difference is whether the information can be tied back to a specific person.
The 18 HIPAA Identifiers
HIPAA lists 18 identifiers that make health information identifiable, such as names, Social Security numbers, medical record numbers, email addresses, and full-face photos. To de-identify data under the Safe Harbor method, all 18 must be removed. See our full guide to HIPAA identifiers for the complete list and how each one works.
Properly de-identified data, with all 18 removed or certified low-risk by a qualified statistician, is no longer PHI and falls outside HIPAA. Risk is minimized this way, though total anonymity is never fully guaranteed.
Who Needs HIPAA Compliance?
HIPAA applies to two groups: covered entities and business associates. Covered entities are health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically for transactions HHS has standardized. That covers insurers, HMOs, Medicare and Medicaid programs, hospitals, clinics, and individual providers such as dentists and psychologists.
Business associates create, receive, maintain, or transmit PHI on a covered entity's behalf. This includes billing services, cloud hosting providers, software vendors, data analytics firms, and consultants. A business associate agreement, or BAA, must be signed before PHI can be shared with any of them. Consumer-grade tools such as a free Gmail or Dropbox account do not come with a BAA and using them for PHI is a common, avoidable violation. Since the 2013 Omnibus Rule, business associates can be fined directly by OCR, not just held to their contracts.
A large and growing share of healthcare breaches now trace back to a vendor rather than the covered entity itself: 34% of healthcare data breaches from 2018 to 2026 involved a business associate, up from 20% in the nine years before that, according to HHS breach portal data compiled by HIPAA Journal. Vetting vendors and keeping BAAs current is not a formality.
Who HIPAA Does Not Apply To
HIPAA does not cover every organization that holds health information. HHS lists examples of organizations that do not have to follow the Privacy and Security Rules:
- Life insurers
- Employers, for the health information in employment records
- Workers' compensation carriers
- Most schools and school districts
- Many state agencies, such as child protective services
- Most law enforcement agencies
Health apps and wearables that people buy for themselves are usually outside HIPAA too, unless the app works on behalf of a covered entity. Other laws, such as state privacy laws and FTC rules, may still apply to them.
HIPAA Rules and Regulations Explained
Three rules make up HIPAA's enforceable framework.
The HIPAA Privacy Rule
The HIPAA Privacy Rule controls how PHI can be used and disclosed. The guiding principle is minimum necessary: use and share only what a task actually requires. It also gives patients rights, to access their own records, request corrections, and restrict certain disclosures. Violating the Privacy Rule is what triggers most OCR complaints.
The HIPAA Security Rule
The Security Rule protects electronic PHI specifically, through administrative, physical, and technical safeguards. It is detailed enough to deserve its own guide: see our HIPAA Security Rule requirements breakdown for the full safeguard list and the proposed 2025 update that would tighten it further.
The Breach Notification Rule
The Breach Notification Rule sets who you must tell, and how fast, when unsecured PHI is exposed.
Affected individuals must be told without unreasonable delay and no later than 60 days after the breach is discovered. If 500 or more people are affected, HHS must also be told within 60 days, and so must local media when more than 500 residents of one state or area are affected. Smaller breaches can be reported to HHS once a year, within 60 days of the end of the calendar year (HHS breach notification rules).
Any impermissible use or disclosure is presumed a breach unless a documented risk assessment shows a low probability the data was compromised. Our guide to risk assessment methodologies covers how to run that assessment.
HIPAA Compliance Requirements at a Glance
HIPAA compliance requirements in practice mean three categories of safeguards working together, all required by the Security Rule for electronic PHI. Our HIPAA Security Rule requirements guide covers each one in full detail, including current encryption and access control specifics. In summary:
| Safeguard category | Covers | Examples |
|---|---|---|
| Administrative | Policies, risk analysis, workforce management | Risk analysis, a named Security Officer, staff training, sanctions for violations |
| Physical | Facilities and devices | Facility access controls, workstation security, device disposal procedures |
| Technical | Systems and data access | Access controls, unique user IDs, audit logs, encryption, automatic logoff |
Risk analysis sits underneath all three. It is not a one-time document. Organizations must reassess at least annually and after any major change, then use the findings to decide what encryption, backups, and access controls actually fit their size and systems. Our guide on why risk assessments fail covers the most common gaps auditors find.
Required vs. Addressable Safeguards
In the Security Rule, "addressable" does not mean optional.
A required safeguard must be implemented as written. For an addressable one, you must either implement it, use an equivalent alternative, or document why neither is reasonable for your organization (HHS guidance). That decision has to be written down, and it should come from your risk analysis.
For a step-by-step version of all of this, see our HIPAA compliance checklist.
HIPAA Penalties for Non-Compliance
HIPAA penalties are not abstract. They are real settlements against real organizations, and they scale with how much the organization knew and did about the problem.
Since the Privacy Rule's 2003 compliance date, OCR has received over 374,000 HIPAA complaints and settled or imposed a civil penalty in 152 cases, totaling about $144.9 million, as of its most recent published enforcement summary. Most complaints never reach that stage. Many are resolved through technical assistance or corrective action without a fine.
Who Enforces HIPAA?
The HHS Office for Civil Rights (OCR) enforces HIPAA's civil rules.
OCR investigates complaints and breach reports, and can require corrective action or impose fines. State attorneys general can also bring civil cases on behalf of their residents, and the Department of Justice handles criminal cases, such as knowingly obtaining or disclosing PHI without permission.
The Four-Tier Penalty Structure
Civil penalties scale with how much an organization knew and did about the violation. Following the January 2026 inflation adjustment, all four tiers share the same $73,011 per-violation ceiling and $2,190,294 annual cap per violation category; only the floor changes:
| Tier | Culpability | Per-violation range |
|---|---|---|
| 1 | Did not know, and reasonably could not have known | $145 to $73,011 |
| 2 | Reasonable cause, not willful neglect | $1,461 to $73,011 |
| 3 | Willful neglect, corrected within 30 days | $14,602 to $73,011 |
| 4 | Willful neglect, not corrected within 30 days | At least $73,011, up to the $2,190,294 annual cap |
Source: https://www.hipaajournal.com/hipaa-violation-fines/
Real Settlement Examples
These are real, named OCR settlements, not hypothetical numbers:
- Advocate Health Care paid $5.55 million after OCR found it had never conducted an organization-wide risk analysis, at the time the largest single-entity HIPAA settlement on record.
- Banner Health paid $1.25 million in 2023 after a 2016 hacking incident exposed records for almost three million people, tied to long-term gaps in monitoring and authentication.
- Presence Health paid $475,000 in 2017, the first OCR settlement specifically for late breach notification, after reporting a breach more than 100 days late.
The common thread is not one dramatic mistake. It is a missing risk analysis, a slow notification, or a vendor nobody vetted properly, the same gaps a compliance checklist is meant to catch before an auditor or a regulator finds them first. See our full guide to HIPAA violations and enforcement for more cases and how OCR decides which tier applies.
HIPAA Compliance for Startups and Healthcare Tech Companies
A first enterprise customer will usually ask, directly, whether you are HIPAA compliant. HIPAA compliance for startups is cheaper to build in from day one than to retrofit after a breach.
Before You Touch PHI
Map every system that will touch PHI, including staging environments, backups, and analytics tools. Minimize what you collect. Run a risk assessment before launch, not after, and set a date to redo it, at least annually or after any major system change.
Business Associate Agreements
Every vendor that touches PHI needs a signed BAA before it does, not after. Major cloud providers such as AWS, Google Cloud, and Azure offer BAAs; many everyday consumer tools do not. Keep a vendor inventory and review it on a schedule, since a forgotten integration is still your liability if it mishandles PHI.
Ongoing Monitoring and Training
Train every employee on HIPAA policies at onboarding and at least annually after, even staff without direct PHI access. Monitor access logs, audit vendors on a schedule, and keep documentation, since incomplete records are one of the most common findings when OCR investigates. Automated evidence collection turns this from a recurring scramble into something that stays current on its own.
Frequently Asked Questions
HIPAA compliance means following the U.S. federal law that protects patients' health information from being seen or shared without permission. It covers how healthcare providers, insurers, and their vendors store, access, and share protected health information, through the Privacy Rule, the Security Rule, and the Breach Notification Rule. It applies whether the information is electronic, on paper, or spoken.
The three important rules for HIPAA compliance are the Privacy Rule, the Security Rule, and the Breach Notification Rule. The Privacy Rule controls how protected health information can be used and shared. The Security Rule requires safeguards specifically for electronic PHI. The Breach Notification Rule sets deadlines for telling patients, HHS, and sometimes the media after a breach.
HIPAA's main purpose is to protect patients' health information while still letting healthcare keep working efficiently. It sets national rules so patient data is not shared or exposed without a real reason, while giving patients rights over their own records and letting providers, insurers, and their vendors exchange information they need to give care and get paid.
A HIPAA violation is any use or sharing of protected health information that the law does not allow, or a missing required safeguard. Common examples include sharing more information than necessary, missing a breach notification deadline, not signing a business associate agreement before sharing PHI, or skipping a required risk analysis. Intent does not matter. A mistake can still be a violation.
A clinic that encrypts patient records and signs a business associate agreement before sending data to a billing vendor is an example of HIPAA compliance. The same clinic limits staff access to only the records they need and reports any breach to HHS within 60 days. Compliance shows up as everyday habits, not a one-time certificate.
Covered entities and their business associates must comply with HIPAA. Covered entities are health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically for standard transactions. Business associates are vendors, such as billing services, cloud hosts, and software platforms, that create, receive, maintain, or transmit PHI on a covered entity's behalf.
Protected health information is any health information that can be tied to a specific person, about their health, care, or payment for care, in any format. HIPAA lists 18 identifiers, such as name, Social Security number, and medical record number, that make health information identifiable. Remove all 18 and the data is no longer PHI under HIPAA's Safe Harbor method.
There is no official HIPAA certification for organizations, because the government does not issue one. Instead, you show compliance through documented policies, risk assessments, safeguards, and signed BAAs. Some companies hire an independent firm for a HIPAA assessment to give customers extra assurance. Employees can take HIPAA training courses that issue certificates, but those prove training, not compliance. Be cautious of any vendor selling official certification.
You are likely HIPAA compliant if you can show a current risk analysis, signed BAAs, written policies, training records, and a breach plan. If any of these is missing or out of date, that is a gap. Many companies run a yearly internal review or hire an independent assessor to check, since there is no official audit you can request.
Being HIPAA compliant means a business protects health information the way HIPAA requires and can prove it with documents. That includes the administrative, physical, and technical safeguards HIPAA requires, signed business associate agreements with every vendor that touches PHI, staff training, and records ready if OCR investigates. It is an ongoing state a business maintains, not a status it earns once and keeps forever.
HIPAA does not apply to organizations that are neither covered entities nor business associates, even if they hold health information. Examples include life insurers, employers for employment records, workers' compensation carriers, most schools, and most law enforcement agencies. Health apps people buy for themselves are usually outside HIPAA too, unless the app works for a covered entity.
Yes, HIPAA is a U.S. federal law, signed on August 21, 1996. Its full name is the Health Insurance Portability and Accountability Act. HHS turned it into detailed regulations, including the Privacy, Security, and Breach Notification Rules, and the HHS Office for Civil Rights enforces them. States can add stricter privacy rules on top of HIPAA, but cannot weaken it.
The HHS Office for Civil Rights (OCR) enforces HIPAA's privacy, security, and breach notification rules. OCR investigates complaints and breach reports and can impose civil fines. State attorneys general can also bring civil cases for their residents, and the Department of Justice prosecutes criminal violations, such as knowingly obtaining or sharing health information without permission.
State privacy law supersedes HIPAA when it gives patients stronger privacy protection or more rights over their health information. HIPAA sets a federal minimum. A state law that conflicts with HIPAA and protects patients less is generally overridden, but a stricter state law stays in force. Healthcare tech companies selling in several states need to follow the strictest rule that applies.
The three exceptions in HIPAA usually refer to situations that do not count as a breach under the Breach Notification Rule. They are: a workforce member accessing PHI by mistake in good faith, one authorized person accidentally sharing PHI with another authorized person, and a disclosure where the recipient could not reasonably have kept the information.
HIPAA penalties are civil fines that start at $145 per violation and can reach $2,190,294 per year for each type of violation. The amount depends on which of four tiers applies, based on how much the organization knew and how fast it fixed the problem. These figures are current as of the January 2026 inflation update. Knowing violations can also bring criminal fines and prison time.
Protecting Your Organization Through HIPAA Compliance
HIPAA compliance is not paperwork you finish once. It is an ongoing set of habits: knowing what counts as PHI, knowing who in your organization and vendor list touches it, and having the safeguards, agreements, and training to prove it if OCR ever asks. The cost of getting this wrong, measured in real settlements from a few hundred thousand dollars to over $5 million, is far higher than the cost of building it in from the start.
UprootSecurity helps healthcare tech companies turn HIPAA compliance into evidence instead of a once-a-year scramble. It connects to your cloud, identity, and code tools, runs continuous monitoring so a control failure surfaces when it happens, and keeps every piece of evidence time-stamped and ready for an auditor or OCR. The same controls map to SOC 2 and ISO 27001 as well, so adding a framework later does not mean starting over. If your BAAs, risk assessments, and safeguards still live in scattered documents, it is worth seeing what they look like in one place.
HIPAA & Healthcare
