What are the main sections of HIPAA?

Editorial team Published on

The main components of the Health Insurance Portability and Accountability Act (HIPAA) consist of five core rules that govern the privacy, security, and standardization of patient health data.

The Five Core HIPAA Rules

  • Privacy Rule: Governs the use and disclosure of Protected Health Information (PHI), giving patients rights over their medical records and defining when data can be shared.
  • Security Rule: Sets administrative, physical, and technical safeguards specifically to protect electronic Protected Health Information (ePHI).
  • Breach Notification Rule: Requires covered entities to notify affected individuals, the government, and sometimes the media when unsecured PHI is compromised.
  • Transactions and Code Sets Rule: Standardizes electronic healthcare billing, claims, and data exchanges using uniform formats and codes like ICD-10.
  • Unique Identifiers Rule: Assigns standard identification numbers, such as the National Provider Identifier (NPI), to healthcare providers, employers, and plans.

Supporting Components

  • Enforcement Rule: Establishes the guidelines for investigations and outlines civil and criminal penalties for HIPAA violations.
  • Omnibus Rule: Expands liability and strengthens privacy and security protections to include third-party business associates and their subcontractors.

What are the 5 main components of HIPAA?

The five main rules or components of HIPAA (Health Insurance Portability and Accountability Act) govern how patient health data is protected, shared, and managed.

The 5 Core HIPAA Rules

  • HIPAA Privacy Rule: Sets national standards to protect medical records and other personal health information (PHI). It gives patients rights over their health data, including the right to view or copy their records.
  • HIPAA Security Rule: Requires administrative, physical, and technical safeguards to secure electronic protected health information (ePHI).
  • HIPAA Breach Notification Rule: Mandates that healthcare providers and business associates notify affected individuals, the government, and sometimes the media when unsecured PHI is compromised.
  • HIPAA Transactions and Code Sets Rule: Standardizes electronic healthcare transactions (like billing and claim submissions) using uniform medical codes such as ICD-10 to make data exchange efficient.
  • HIPAA Unique Identifiers Rule: Establishes standard identification numbers—such as the National Provider Identifier (NPI)—for healthcare providers, employers, and health plans.

(Note: In the original 1996 legislative text, HIPAA is structured into five broader "Titles" covering health insurance reform, administrative simplification, tax-related provisions, group health insurance requirements, and revenue offsets. However, modern compliance discussions typically refer to the five foundational rules above under Administrative Simplification.)

What are the four main parts of HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) is commonly understood through its four core regulatory rules that protect patient data.

The Four Core HIPAA Rules

  • Privacy Rule: Sets national standards to protect medical records and other personal health information. It limits how patient data can be used and shared.
  • Security Rule: Requires administrative, physical, and technical safeguards to secure electronic protected health information (ePHI).
  • Breach Notification Rule: Mandates that covered entities notify patients, the government, and sometimes the media if unsecured protected health information is compromised.
  • Enforcement Rule: Details the financial penalties, investigation procedures, and civil money penalties for violating HIPAA rules.

(Note: While original legislation was split into 5 statutory "Titles" focusing on insurance reform and administrative simplification, modern compliance discussions center around these four main operational rules).

What are the six key components of HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) is commonly broken down into five core rules or components that govern the privacy, security, and standardization of health data, rather than six distinct statutory components.

1. The Privacy Rule

The HIPAA Privacy Rule sets national standards for the protection of medical records and Protected Health Information (PHI).

  • What it does: Limits how health data can be used and disclosed.
  • Key right: Gives patients the right to see, get a copy of, and correct their health records.

2. The Security Rule

The HIPAA Security Rule focuses specifically on electronic Protected Health Information (ePHI).

  • What it does: Requires administrative, physical, and technical safeguards.
  • Key goal: Ensures data confidentiality, integrity, and availability.

3. The Breach Notification Rule

This rule dictates how organizations respond to a data security incident.

  • What it does: Requires covered entities to notify affected individuals, the government (HHS), and sometimes the media when unsecured PHI is breached.
  • Timeline: Notifications must typically occur without unreasonable delay and within 60 days of discovering a breach.

4. The Transactions and Code Sets Rule

This rule standardizes electronic billing and administrative communication.

  • What it does: Creates uniform formats for electronic healthcare claims and data exchange.
  • Key goal: Speeds up payments and reduces administrative overhead.

5. The Unique Identifiers Rule

This rule assigns standard identification numbers to entities in the healthcare system.

  • What it does: Mandates the use of unique IDs like the National Provider Identifier (NPI) for healthcare providers and EINs for employers.
  • Key goal: Eliminates confusion and tracks claims accurately.

(Note: People referring to "six components" sometimes add the Enforcement Rule, which sets the civil and criminal penalties for violating the other rules.)

What are the two main categories of HIPAA?

The two main statutory titles or historical categories of the Health Insurance Portability and Accountability Act (HIPAA) are Title I (Insurance Reform) and Title II (Administrative Simplification).

Title I: Health Care Access, Portability, and Renewability

  • Focus: Protects health insurance coverage for workers and their families when they change or lose jobs.
  • Details: Limits new health plans from denying coverage based on pre-existing conditions and guarantees renewability for employers and individuals.

Title II: Administrative Simplification

  • Focus: Sets national standards for electronic health care transactions and the security of data.
  • Details: Contains the major rules most people mean when discussing compliance, including the HIPAA Privacy Rule (protecting medical records) and the HIPAA Security Rule (protecting electronic health data).

(Note: In modern compliance discussions, people also frequently divide HIPAA rules into two main groups of entities they apply to: Covered Entities and Business Associates.)

HIPAA Training 101: The Four Rules of HIPAA Compliance

9 related questions found

What are the sections of HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is divided into five main sections, known as Titles, which address insurance reform, administrative simplification, and healthcare accountability.

HIPAA Titles Breakdown

  • Title I: Health Care Access, Portability, and Renewability
    • Protects health insurance coverage for workers and their families when they change or lose their jobs.
    • Limits new health plans from denying coverage due to pre-existing conditions.
  • Title II: Administrative Simplification
    • Directs the standardization of electronic health care transactions and national identifiers.
    • Contains the core rules for protecting health data, enforced by the HHS Office for Civil Rights:
      • Privacy Rule: Protects the privacy of medical records and Protected Health Information (PHI).
      • Security Rule: Sets technical, physical, and administrative safeguards for electronic protected health information (e-PHI).
      • Breach Notification Rule: Requires covered entities to notify affected individuals and the government following a data breach.
      • Enforcement Rule: Establishes guidelines for civil money penalties and criminal prosecution for violations.
  • Title III: Tax-Related Health Provisions
    • Standardizes guidelines for pre-tax medical savings accounts.
    • Governs guidelines for life insurance policies connected to employer health plans.
  • Title IV: Application and Enforcement of Group Health Plan Requirements
    • Clarifies group health plan conditions concerning policies like continuation of coverage.
    • Modifies provisions for individuals with continuous coverage issues.
  • Title V: Revenue Offsets
    • Manages company-owned life insurance tax rules.
    • Handles provisions regarding the loss of tax deductions for certain employer-backed plans.

What are the 5 sections on a claim?

The five major sections of a standard electronic healthcare claim (such as a HIPAA 837 transaction) are the provider, subscriber/patient, payer, claim details, and services.

  • Provider: Identifies the healthcare professionals or facilities involved, including the billing, rendering, and referring providers.
  • Subscriber and Patient: Contains details about the policyholder (subscriber) and the individual receiving treatment (who may be the same person).
  • Payer: Specifies the insurance company or health plan responsible for receiving and adjudicating the claim.
  • Claim Details: Outlines overall data for the visit, such as the total charges, place of service, diagnosis codes, and signature certifications.
  • Services: Provides specific line-item data for each individual procedure, treatment, or service rendered along with corresponding codes and costs.

What are the three major elements of HIPAA?

The three major elements or primary rules of HIPAA (Health Insurance Portability and Accountability Act) are the Privacy Rule, the Security Rule, and the Breach Notification Rule.

1. The Privacy Rule

  • Purpose: Sets national standards to protect individuals' medical records and other personal health information (PHI).
  • Key Details: Controls how and when a patient's data is used or shared. It gives patients the right to view and get copies of their medical records.

2. The Security Rule

  • Purpose: Protects electronic protected health information (ePHI).
  • Key Details: Focuses on safeguarding data integrity, confidentiality, and availability. It is split into three safeguard categories:
    • Administrative: Policies, procedures, and staff training.
    • Physical: Facility controls and hardware protection.
    • Technical: Access controls, audits, and encryption.

3. The Breach Notification Rule

  • Purpose: Mandates reporting procedures when unsecured PHI is compromised.
  • Key Details: Requires covered entities to notify affected individuals, the Department of Health and Human Services (HHS), and sometimes the media within 60 days of discovering a breach.

What are the four subcategories of HIPAA?

The four primary rules of HIPAA (Health Insurance Portability and Accountability Act) are the Privacy Rule, the Security Rule, the Breach Notification Rule, and the Omnibus (or Enforcement) Rule.

1. The HIPAA Privacy Rule

  • What it does: Sets national standards to protect medical records and other personal health information (PHI).
  • Key details: Restricts how patient data is used or shared without authorization. It also gives patients the right to view, get copies of, and correct their health records.

2. The HIPAA Security Rule

  • What it does: Protects electronic protected health information (ePHI).
  • Key details: Requires administrative, physical, and technical safeguards to keep digital patient data confidential, safe, and available. Examples include passwords, encryption, and secure server rooms.

3. The Breach Notification Rule

  • What it does: Sets the steps to follow if health data is exposed or stolen.
  • Key details: Requires healthcare groups to notify affected patients and the government (the Department of Health and Human Services) within 60 days of discovering an unsecured data breach. Large breaches affecting over 500 people also require media notice.

4. The Omnibus Rule (and Enforcement)

  • What it does: Expands liability and sets penalties for breaking HIPAA laws.
  • Key details: Extends HIPAA rules so that third-party vendors and business associates face the same legal responsibilities as healthcare providers. The Enforcement Rule covers how violations are investigated and sets heavy fines for non-compliance.

What is the new HIPAA rule in 2026?

The main new HIPAA requirement for 2026 is updating privacy notices under the HHS Model Notices of Privacy Practices to include stricter protections for substance use disorder (SUD) patient records.

Key 2026 Privacy Rule Updates

  • February 16, 2026 Deadline: Healthcare providers and health plans had to update their Notice of Privacy Practices (NPP).
  • Substance Use Records: Notices must now explain how substance use disorder records are protected under 42 CFR Part 2.
  • Legal Protections: Patient records generally cannot be used in civil or criminal legal cases without explicit consent or a court order.
  • Patient Rights: Patients gained clearer rights to restrict sharing, opt out of fundraising, and file complaints.

Proposed Security Rule Changes (Under Review)

Regulators are also pushing a major update to the HIPAA Security Rule that changes how organizations handle data safety:

  • No More "Addressable" Rules: Optional security steps are becoming mandatory.
  • Mandatory MFA: Multi-factor authentication is required across all systems.
  • Required Encryption: Patient data must be encrypted both in transit and at rest.