What are the 5 main rules of HIPAA?


Editorial team Published on

The five main components or rules of the Health Insurance Portability and Accountability Act (HIPAA) are the Privacy Rule, Security Rule, Transactions and Code Sets Rule, Unique Identifiers Rule, and Enforcement (including Breach Notification) Rule.

1. The Privacy Rule

  • What it does: Dictates how, when, and why Protected Health Information (PHI) can be used and shared in any format (paper, oral, or electronic).
  • Key detail: Gives patients the right to view, obtain copies of, and request corrections to their medical records. It also mandates the "minimum necessary" standard, meaning organizations should only share the amount of data needed for a specific task.

2. The Security Rule

  • What it does: Sets national standards specifically to protect electronic Protected Health Information (ePHI).
  • Key detail: Requires covered entities to implement three types of safeguards: administrative procedures, physical barriers (like locked server rooms), and technical controls (like encryption and audit logs).

3. The Transactions and Code Sets Rule

  • What it does: Standardizes the electronic transmission of healthcare data (such as billing, claims, and health plan enrollments) across organizations.
  • Key detail: Requires standard coding systems (like ICD-10 and CPT) so different healthcare computer systems can talk to each other without errors.

4. The Unique Identifiers Rule

  • What it does: Assigns standard national identification numbers to healthcare providers, health plans, and employers.
  • Key detail: Uses identifiers like the National Provider Identifier (NPI) to uniquely and securely identify healthcare professionals and organizations on all electronic transactions.

5. The Enforcement and Breach Notification Rules

  • What it does: Establishes the framework for investigating complaints, imposing civil or criminal penalties for non-compliance, and reporting data breaches.
  • Key detail: Requires organizations to notify affected individuals, the government (HHS), and sometimes the media without unreasonable delay (within 60 days) if unsecured PHI is compromised. You can read more about enforcement via the Department of Health and Human Services Privacy Summary.