Compliance & regulation

HIPAA

Health Insurance Portability and Accountability Act

Definition

United States federal law enacted in 1996 protecting the privacy and security of Protected Health Information (PHI). Composed of the Privacy Rule, the Security Rule (administrative, physical, technical safeguards), the Breach Notification Rule, and the Enforcement Rule. Enforced by HHS Office for Civil Rights (OCR). Applies to covered entities (healthcare providers, health plans, clearinghouses) and their business associates. Civil penalties up to USD 2.1M per violation category per year, criminal penalties up to USD 250,000 and 10 years imprisonment for willful violations.

In detail

HIPAA (the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191) is the foundational US federal law governing the use and disclosure of Protected Health Information (PHI). It applies to "covered entities" — healthcare providers that transmit health information electronically, health plans, and healthcare clearinghouses — and to their "business associates" handling PHI on their behalf.

HIPAA is implemented through four major rules. The Privacy Rule (45 CFR Part 164, Subparts A and E) establishes patient rights (access, amendment, accounting of disclosures) and the minimum necessary use of PHI. The Security Rule (Part 164, Subpart C) requires three sets of safeguards on electronic PHI: administrative (workforce training, access management, contingency planning), physical (facility access, workstation security, device controls), and technical (access controls, audit logs, encryption, transmission security). The Breach Notification Rule mandates notification of affected individuals, HHS, and (for large breaches) the media within specified timelines. The Enforcement Rule defines investigations, hearings, and penalties.

Enforcement is by the HHS Office for Civil Rights (OCR). Civil penalties are tiered by culpability: from approximately USD 137 per violation (lack of knowledge tier) to USD 68,928 per violation (willful neglect, not corrected), capped at approximately USD 2.06 million per identical violation per year (figures inflation-adjusted annually). Criminal penalties under 42 USC §1320d-6 reach up to USD 250,000 and 10 years imprisonment for selling PHI for personal gain.

HIPAA is frequently combined with the HITECH Act (2009, which strengthened breach notification and extended HIPAA to business associates), state privacy laws (California CMIA, Texas Medical Records Privacy Act), and industry frameworks (HITRUST CSF, NIST 800-66) for full coverage.

Context and origin

HIPAA was signed into law by President Clinton on 21 August 1996, originally aimed at improving health insurance portability for workers changing jobs and combatting healthcare fraud. The privacy and security provisions were a secondary objective, formalized in regulations published by HHS between 2000 and 2003.

The HITECH Act (Health Information Technology for Economic and Clinical Health) of 2009, part of the American Recovery and Reinvestment Act, dramatically strengthened HIPAA. It made business associates directly liable, increased penalty tiers, expanded breach notification, and funded EHR adoption.

The 2013 Omnibus Rule consolidated HITECH amendments and remains the operating baseline. Since 2024, OCR has been negotiating updates to align HIPAA with reproductive healthcare privacy concerns and to formally recognize AI-driven workflows. Healthcare AI applications (clinical documentation, decision support, patient engagement) are now a frequent compliance focus, alongside cybersecurity (ransomware in particular has affected hundreds of US healthcare systems since 2020).

Why it matters

What it changes for a decision maker

For a CEO or CIO of a US healthcare provider, payer, or HealthTech vendor, HIPAA compliance is table stakes: no procurement, no integration with hospital systems, no enterprise sales without HIPAA. Penalties have escalated meaningfully since 2020: large breaches now routinely trigger USD 1 to 5 million settlements with OCR, and ransomware incidents add operational disruption costs.

The economic stakes are equally about customer trust. A single high-profile breach can permanently damage a brand and trigger churn. The 2024 Change Healthcare breach (UnitedHealth subsidiary) affected an estimated 100 million people and is reshaping vendor due diligence across the entire US healthcare supply chain.

For European or other non-US vendors selling to US healthcare, HIPAA compliance is increasingly bundled with HITRUST CSF certification (i1 or r2) as a marketing prerequisite. Building HIPAA into product architecture from day one is materially cheaper than retrofitting.

Access International approach

How we tackle this

For HealthTech and clinical AI engagements targeting the US market, we apply a three-layer compliance approach: HIPAA at the regulatory baseline, HITRUST CSF as the industry-recognized control framework, and SOC 2 Type II for enterprise procurement. Each layer reuses the same control implementations; the documentation and audit deliverables are produced once and packaged differently.

On clinical AI use cases (ambient documentation, decision support, patient triage), we cross HIPAA with NIST AI RMF and EU AI Act high-risk requirements upfront, producing a single compliance matrix. This avoids parallel projects that contradict each other (a frequent failure mode when legal, security, and AI governance are siloed).

Our principle: HIPAA is not a deliverable produced at end of project. It's a design constraint that shapes architecture from day one — encryption at rest and in transit, audit-grade logging, RBAC with break-glass, BAA-aware vendor selection.