HIPAA

Who it applies to

Covered entities (health plans, healthcare clearinghouses and most healthcare providers) and their business associates that handle protected health information.

Key requirements

• Privacy Rule: limits on use and disclosure of PHI, the minimum necessary standard and patient rights.
• Security Rule: administrative, physical and technical safeguards for ePHI, based on a risk analysis.
• Business associate agreements with vendors that handle PHI.
• Breach Notification Rule for unsecured PHI.
• Policies, training and documentation, with records kept for six years.

Breach and incident notification

Affected individuals are notified without unreasonable delay and no later than 60 calendar days after discovery. Breaches affecting 500 or more people are reported to HHS within the same 60 days (and to prominent media for 500 or more residents of a state or jurisdiction); smaller breaches are logged and reported to HHS within 60 days of the end of the calendar year.

Penalties

Tiered civil penalties based on culpability, adjusted annually for inflation, plus criminal penalties enforced by the Department of Justice for knowing misuse.

Go deeper