What are the categories of protected information on the HIPAA?

The HIPAA Privacy Rule protects Protected Health Information (PHI), which is individually identifiable health information held or transmitted by a covered entity or its business associate in any form.

What Protected Health Information Includes

• Health status: Records of past, present, or future physical or mental health conditions.
• Healthcare services: Details regarding the provision of health care treatment and medical histories.
• Payment data: Financial information and records relating to the payment for past, present, or future healthcare services.
• Identifying identifiers: Any data linked to personal identifiers—such as names, addresses, birth dates, or Social Security numbers—that can be used to identify the individual.

Formats and Scope

• Medium neutral: Protection applies across electronic records (ePHI), paper documents, and oral communications.
• Applicability: Governs actions by covered entities (health plans, healthcare clearinghouses, and certain healthcare providers) and their business associates.
• Exclusions: Does not apply to properly de-identified data, employment records held by a covered entity in its role as an employer, or certain educational records.

You can read the full breakdown directly on the Department of Health and Human Services portal.

The two main statutory titles or historical categories of the Health Insurance Portability and Accountability Act (HIPAA) are Title I (Insurance Reform) and Title II (Administrative Simplification).

Title I: Health Care Access, Portability, and Renewability

• Focus: Protects health insurance coverage for workers and their families when they change or lose jobs.
• Details: Limits new health plans from denying coverage based on pre-existing conditions and guarantees renewability for employers and individuals.

Title II: Administrative Simplification

• Focus: Sets national standards for electronic health care transactions and the security of data.
• Details: Contains the major rules most people mean when discussing compliance, including the HIPAA Privacy Rule (protecting medical records) and the HIPAA Security Rule (protecting electronic health data).

(Note: In modern compliance discussions, people also frequently divide HIPAA rules into two main groups of entities they apply to: Covered Entities and Business Associates.)

The five main rules or components of HIPAA (Health Insurance Portability and Accountability Act) govern how patient health data is protected, shared, and managed.

The 5 Core HIPAA Rules

• HIPAA Privacy Rule: Sets national standards to protect medical records and other personal health information (PHI). It gives patients rights over their health data, including the right to view or copy their records.
• HIPAA Security Rule: Requires administrative, physical, and technical safeguards to secure electronic protected health information (ePHI).
• HIPAA Breach Notification Rule: Mandates that healthcare providers and business associates notify affected individuals, the government, and sometimes the media when unsecured PHI is compromised.
• HIPAA Transactions and Code Sets Rule: Standardizes electronic healthcare transactions (like billing and claim submissions) using uniform medical codes such as ICD-10 to make data exchange efficient.
• HIPAA Unique Identifiers Rule: Establishes standard identification numbers—such as the National Provider Identifier (NPI)—for healthcare providers, employers, and health plans.

(Note: In the original 1996 legislative text, HIPAA is structured into five broader "Titles" covering health insurance reform, administrative simplification, tax-related provisions, group health insurance requirements, and revenue offsets. However, modern compliance discussions typically refer to the five foundational rules above under Administrative Simplification.)

The HIPAA Security Rule outlines three categories of safeguards to protect electronic protected health information (ePHI): administrative, physical, and technical safeguards.

1. Administrative Safeguards

Administrative safeguards involve the policies, procedures, and management actions used to select, develop, implement, and maintain security measures. They protect ePHI by setting clear rules for workforce conduct and organizational governance.

• Security Management Process: Policies to analyze risks, manage threats, review activity, and apply sanctions.
• Assigned Security Responsibility: Designation of a security official responsible for overseeing security procedures.
• Workforce Security: Screening procedures and authorization controls for employees handling data.
• Information Access Management: Restricting and monitoring access to patient information.
• Security Awareness and Training: Providing ongoing security training and updates for staff.
• Security Incident Procedures: Protocols to report, document, and respond to security incidents.
• Contingency Planning: Establishing data backup, disaster recovery, and emergency operation plans.
• Evaluation: Regular periodic assessments of security policies and performance.
• Business Associate Contracts: Agreements ensuring third parties adequately protect ePHI.

2. Physical Safeguards

Physical safeguards focus on protecting physical computer systems, equipment, and the surrounding buildings from natural disasters, environmental hazards, and unauthorized intrusion.

• Facility Access Controls: Limiting physical access to data centers and server rooms using badges, locks, or guards.
• Workstation Use: Policies defining proper functions, physical positioning, and appropriate use of monitors and terminals.
• Workstation Security: Safeguarding specific physical hardware and access points.
• Device and Media Controls: Rules governing the receipt, removal, movement, and secure disposal of hardware and electronic media containing ePHI.

3. Technical Safeguards

Technical safeguards involve the technology and associated policies used to protect data and control individual access to computer systems.

• Access Control: Unique user identification, emergency access procedures, and automated logoff.
• Audit Controls: Hardware, software, and procedural mechanisms that record and examine activity in information systems.
• Integrity: Policies and mechanisms to protect ePHI from improper alteration or destruction.
• Person or Entity Authentication: Procedures to verify that a person or system seeking access is genuine.
• Transmission Security: Guarding against unauthorized access to data sent over an electronic communications network via encryption or secure channels.

You can read the official guidelines directly on the HHS Summary of the HIPAA Security Rule.

The four primary rules of HIPAA (Health Insurance Portability and Accountability Act) are the Privacy Rule, the Security Rule, the Breach Notification Rule, and the Omnibus (or Enforcement) Rule.

1. The HIPAA Privacy Rule

• What it does: Sets national standards to protect medical records and other personal health information (PHI).
• Key details: Restricts how patient data is used or shared without authorization. It also gives patients the right to view, get copies of, and correct their health records.

2. The HIPAA Security Rule

• What it does: Protects electronic protected health information (ePHI).
• Key details: Requires administrative, physical, and technical safeguards to keep digital patient data confidential, safe, and available. Examples include passwords, encryption, and secure server rooms.

3. The Breach Notification Rule

• What it does: Sets the steps to follow if health data is exposed or stolen.
• Key details: Requires healthcare groups to notify affected patients and the government (the Department of Health and Human Services) within 60 days of discovering an unsecured data breach. Large breaches affecting over 500 people also require media notice.

4. The Omnibus Rule (and Enforcement)

• What it does: Expands liability and sets penalties for breaking HIPAA laws.
• Key details: Extends HIPAA rules so that third-party vendors and business associates face the same legal responsibilities as healthcare providers. The Enforcement Rule covers how violations are investigated and sets heavy fines for non-compliance.