What Is HIPAA?

The Health Insurance Portability and Accountability Act governs the handling of protected health information in the United States. Its security requirements apply to covered entities — providers, plans and clearinghouses — and to the business associates who handle that data on their behalf.

It is a law rather than a certification. There is no HIPAA certificate, and vendors claiming to be certified are describing an assessment against somebody's interpretation of the rules.

The rules that matter operationally

The Security Rule covers electronic protected health information through administrative, physical and technical safeguards. The Privacy Rule covers use and disclosure generally, in any form.

The Breach Notification Rule sets obligations following unauthorised disclosure, including notification to individuals and to the regulator, with timing that depends on the number of people affected.

Required and addressable

The Security Rule distinguishes implementation specifications that are required from those that are addressable. Addressable has never meant optional: it means you implement it, or document why it is not reasonable and what you do instead.

That distinction has been widely misread as discretionary, and encryption is the recurring example — addressable, consistently expected by investigators, and the absence of which removes the safe harbour that would otherwise apply to lost devices.

Risk analysis is the foundational requirement

The Security Rule requires an accurate and thorough assessment of risks to electronic protected health information, and enforcement actions repeatedly cite its absence or inadequacy as the underlying failure.

It is not a one-off. Investigators look for periodic review, documented decisions and evidence that identified risks were actually addressed. See risk assessment.

Business associates and the contract chain

Any vendor handling protected health information on your behalf needs a business associate agreement, and they are directly liable under the rules rather than only contractually.

The chain extends: their subcontractors need equivalent agreements. Organisations are routinely surprised by how many vendors qualify — cloud hosting, transcription, billing, analytics, support tooling and backup providers all commonly do.

Where the rules are heading

A proposed overhaul of the Security Rule would remove the addressable category entirely, making specifications mandatory, and add explicit requirements around asset inventory, network mapping, encryption, multi-factor authentication and testing.

Organisations treating addressable as optional would face the largest change. Those already implementing the addressable specifications would find most of it familiar, which is the practical argument for doing so now.

Enforcement, and what actually triggers it

Investigations arise from individual complaints, from self-reported breaches, and from periodic audit programmes. The breach reporting obligation is therefore also the most common route to an investigation, which is an uncomfortable incentive the rules do not resolve.

Published settlements show a consistent pattern: absent or inadequate risk analysis, unencrypted devices, missing business associate agreements, and access controls that permitted far more than a role required. State attorneys general can also enforce, and several have pursued cases independently.

Where to start

Find your most recent risk analysis and check whether its findings were tracked to closure. That single document is what an investigator asks for first.

See a practical approach to risk analysis and cost for small practices. GuardsArm delivers HIPAA compliance.