Health Insurance Portability and Accountability Act of 1996

PrivacyLawHub should not represent HIPAA as one standalone "privacy regulation."

The operational HIPAA framework includes:

• Privacy Rule

• Security Rule

• Breach Notification Rule

• Enforcement Rule.

The HIPAA Privacy/Security rules principally apply to:

• health plans

• health-care clearinghouses

• covered health-care providers

• business associates.

HHS explicitly states that organisations which do not meet the definition of covered entity or business associate generally do not have to comply with the HIPAA Rules. (HHS.gov)

The Privacy Rule regulates:

• use/disclosure

• minimum necessary principle

• patient access

• certain amendments

• accounting

• permitted disclosures

• business associates.

HHS confirms the current Security Rule establishes:

• administrative safeguards

• physical safeguards

• technical safeguards.

It protects ePHI maintained/transmitted electronically. (HHS.gov)

Business associates can be directly liable for certain HIPAA requirements, including:

• Security Rule compliance

• impermissible PHI use/disclosure

• breach notification

• cooperation with HHS

• minimum necessary requirements.

(HHS.gov)

The Breach Notification Rule, 45 CFR §§164.400–414, governs breaches of unsecured PHI.

Affected individuals generally must be notified without unreasonable delay and no later than 60 days after discovery. Different rules apply to HHS notification depending on the number of affected individuals. (HHS.gov)