What are the two major components of HIPAA?

At the statutory level, the two main components (or titles) of the Health Insurance Portability and Accountability Act (HIPAA) are Title I (Health Insurance Reform) and Title II (Administrative Simplification).

Title I: Health Insurance Reform

• Protects health insurance coverage for workers and their families when they change or lose jobs.
• Limits the ability of group health plans to deny coverage based on pre-existing medical conditions.

Title II: Administrative Simplification

• Directs national standards for processing electronic healthcare transactions.
• Contains the core rules most people associate with HIPAA data protection, which include:
  • HIPAA Privacy Rule: Governs the use and disclosure of Protected Health Information (PHI).
  • HIPAA Security Rule: Sets administrative, physical, and technical safeguards for electronic PHI (ePHI).
  • Breach Notification Rule: Requires reporting of unsecured data breaches.

The main components of HIPAA consist of five core rules that protect patient health information and standardize electronic healthcare data.

The Five Core Rules

• HIPAA Privacy Rule: Controls how medical records and Protected Health Information (PHI) are used and shared. It gives patients the right to see their own medical files and ask for corrections.
• HIPAA Security Rule: Protects electronic health information (ePHI). It requires administrative, physical, and technical safeguards like passwords and encryption.
• Breach Notification Rule: Requires healthcare groups to notify patients, the government, and sometimes the media if unsecured PHI is exposed.
• Transactions and Code Sets Rule: Creates a single national standard for electronic health care claims and billing data.
• Unique Identifiers Rule: Assigns standard identification numbers, such as the National Provider Identifier (NPI), to doctors, health plans, and employers.

Supporting Rules

• Enforcement Rule: Gives the government the power to investigate complaints and set financial penalties for breaking HIPAA rules.
• Omnibus Rule: Expands HIPAA rules to include business partners and vendors who handle patient data.

The three primary rules of the Health Insurance Portability and Accountability Act (HIPAA) are the Privacy Rule, the Security Rule, and the Breach Notification Rule.

1. The Privacy Rule

The Privacy Rule sets national standards for how medical records and other protected health information (PHI) can be used and shared.

• Scope: Applies to all forms of patient records, whether paper, electronic, or spoken.
• Patient Rights: Gives patients the right to see, get copies of, and correct their medical records.
• Disclosure: Limits when healthcare providers and organizations can share a person's private health data without direct permission.

2. The Security Rule

The Security Rule builds on the Privacy Rule by setting specific rules to protect electronic protected health information (ePHI). It requires organizations to use three types of safeguards:

• Administrative Safeguards: Security policies, risk management, and staff training.
• Physical Safeguards: Facility access controls, workstation security, and device safety.
• Technical Safeguards: Access controls, user authentication, audit logs, and data encryption.

3. The Breach Notification Rule

The Breach Notification Rule requires healthcare groups and their business partners to report when unsecured patient data is exposed or stolen.

• Individual Notice: Affected patients must be notified within 60 days of discovering the data breach.
• Government Notice: The Department of Health and Human Services (HHS) must also be informed within 60 days (or immediately for large breaches affecting over 500 people).
• Media Notice: Large breaches must be reported to prominent media outlets in the local jurisdiction.

You can read official guidance and legal details directly from the U.S. Department of Health & Human Services.

The main new HIPAA requirement for 2026 is updating privacy notices under the HHS Model Notices of Privacy Practices to include stricter protections for substance use disorder (SUD) patient records.

Key 2026 Privacy Rule Updates

• February 16, 2026 Deadline: Healthcare providers and health plans had to update their Notice of Privacy Practices (NPP).
• Substance Use Records: Notices must now explain how substance use disorder records are protected under 42 CFR Part 2.
• Legal Protections: Patient records generally cannot be used in civil or criminal legal cases without explicit consent or a court order.
• Patient Rights: Patients gained clearer rights to restrict sharing, opt out of fundraising, and file complaints.

Proposed Security Rule Changes (Under Review)

Regulators are also pushing a major update to the HIPAA Security Rule that changes how organizations handle data safety:

• No More "Addressable" Rules: Optional security steps are becoming mandatory.
• Mandatory MFA: Multi-factor authentication is required across all systems.
• Required Encryption: Patient data must be encrypted both in transit and at rest.

The two primary rules most famously referenced within Title II of HIPAA (known as the Administrative Simplification provisions) are the Privacy Rule and the Security Rule.

While Title II contains additional administrative components (such as the Transactions and Code Sets Rule, the Unique Identifiers Rule, and the Enforcement Rule), the two major standards governing patient data protection are:

• The HIPAA Privacy Rule: Focuses on the right to privacy and sets national standards for how Protected Health Information (PHI) can be used and disclosed across all mediums (written, oral, and electronic).
• The HIPAA Security Rule: Focuses specifically on securing electronic Protected Health Information (ePHI). It mandates specific administrative, physical, and technical safeguards to keep digital health data confidential and secure.

(Note: If you are answering a specific multiple-choice question about which of these two rules applies to ePHI, the answer is the Security Rule, though both technically work together to protect electronic data.)