HIPAA Fundamentals

What HIPAA actually is

The Health Insurance Portability and Accountability Act of 1996 is a federal statute. On its own, HIPAA does not tell a practice what to do. The regulations HHS wrote to implement HIPAA — the Privacy Rule, the Security Rule, the Breach Notification Rule, and the Enforcement Rule — are what actually govern day-to-day operations. When someone says a practice is "HIPAA-compliant," they mean the practice is following those regulations.

The HITECH Act of 2009 extended HIPAA obligations to Business Associates directly, made breach reporting mandatory, and raised penalty ceilings. The Omnibus Rule of 2013 finalized HITECH's changes and refined the definition of a breach. Since then, HHS has issued additional guidance and civil-money-penalty adjustments, but the core structure has been stable for more than a decade.

HIPAA does not require any specific product, software, or platform. It requires that a covered entity implement administrative, physical, and technical safeguards proportional to its risk, document what it does, train its workforce, execute Business Associate Agreements where appropriate, and be able to demonstrate compliance if HHS's Office for Civil Rights investigates.

The three rules every workforce member should recognize

HIPAA has more than three regulations, but three do the vast majority of the workforce-facing work. Each rule has its own training module in this series and a deeper reference page on the Patient Protect site.

PHI and ePHI — why the distinction matters operationally

Protected Health Information (PHI) is the umbrella. It is any individually identifiable health information a covered entity or business associate creates, receives, maintains, or transmits. Names, addresses, appointment dates, diagnoses, treatment notes, billing records, insurance identifiers — all PHI when tied to an identifiable patient. PHI includes verbal information (a conversation about a patient) and paper records (a printed chart, an intake form on a clipboard) as well as data on a screen.

Electronic Protected Health Information (ePHI) is the subset of PHI that exists in electronic form — the EHR record, the email, the imaging file, the text message, the cloud backup. Every ePHI is PHI; not every PHI is ePHI.

The distinction matters because the Security Rule applies specifically to ePHI. The technical safeguards — encryption, access control, audit logging, transmission security — are Security Rule requirements. The Privacy Rule covers both electronic and non-electronic PHI, which is why a conversation overheard in a hallway can be a Privacy Rule concern even though no ePHI was involved.

Who HIPAA applies to — Covered Entities and Business Associates

A Covered Entity is one of three things: a healthcare provider that electronically transmits health information in connection with a HIPAA-standard transaction, a health plan, or a healthcare clearinghouse. Most dental offices, medical practices, behavioral health clinics, physical therapy centers, chiropractic offices, and optometry practices are covered entities because they submit claims or eligibility inquiries electronically.

A Business Associate is a person or organization that performs functions or activities on behalf of a covered entity involving the use or disclosure of PHI. Typical examples include an EHR vendor, a cloud backup provider, a claims clearinghouse, a billing service, an IT support contractor with system access, a shredding company, and many marketing or analytics vendors. Not every vendor a practice hires is a business associate — the relationship depends on whether the vendor is handling PHI on the practice's behalf.

A Business Associate Agreement (BAA) is the contract that makes a business associate directly liable for the parts of HIPAA that apply to it. A covered entity must have a signed BAA in place with each business associate before PHI flows. Reference labs performing tests for a treating provider are the common misclassification: HHS treats provider-to-provider treatment disclosures as a different relationship, not a business associate arrangement.

Essential vocabulary

The rest of the training series assumes fluent use of these terms. Each links into the Patient Protect glossary or the appropriate reference page for a deeper definition.

PHI

Protected Health Information. Individually identifiable health information in any form, held by a covered entity or business associate.

ePHI

Electronic Protected Health Information. The subset of PHI that exists in electronic form; the Security Rule specifically protects this.

Covered Entity (CE)

A healthcare provider that transmits health information electronically in an adopted standard transaction, a health plan, or a healthcare clearinghouse.

Business Associate (BA)

A person or organization that creates, receives, maintains, or transmits PHI on behalf of a covered entity.

Business Associate Agreement (BAA)

The written contract required between a covered entity and a business associate before PHI can be shared. Makes the business associate directly accountable for its portion of HIPAA.

Breach

An impermissible acquisition, access, use, or disclosure of unsecured PHI that compromises its security or privacy.

Encryption

The transformation of readable data into unreadable ciphertext using an algorithm and a key. One of the two safeguards that renders PHI "secured" for breach-notification purposes; the other is proper destruction.

HHS

The U.S. Department of Health and Human Services — the federal department that promulgates and enforces HIPAA.

OCR

The HHS Office for Civil Rights — the agency within HHS that investigates HIPAA complaints, conducts audits, and issues civil-money penalties.

Why this matters inside a practice

HIPAA does not sit in a binder. It shows up in the choice of which email account is used for a patient reminder, in whether a workstation is locked when the front desk steps away, in whether a lab result is discussed at the counter or in an operatory, in whether the practice has a BAA with the vendor sending its appointment texts, in what happens the moment someone realizes a chart was opened by mistake.

The rest of this series takes each of those daily decisions and connects it back to the rule it lives under. If Module 1 gave you the map, Modules 2 through 5 give you the terrain — the Privacy Rule for verbal, physical, and disclosure workflows, the Security Rule for anything electronic, the Breach Notification Rule for what happens after an incident, and a scenario library that puts all of it into practice.