What companies need to be HIPAA compliant?

Firms must comply with HIPAA if they are classified as covered entities or business associates that handle protected health information.

Covered Entities

These primary organizations create, receive, or transmit patient data:

• Healthcare Providers: Doctors, clinics, dentists, pharmacies, psychologists, and nursing homes that conduct standard electronic transactions.
• Health Plans: Health insurance companies, HMOs, company-sponsored health plans, Medicare, and Medicaid.
• Healthcare Clearinghouses: Entities that process nonstandard health data into standard electronic formats, or vice versa.

Business Associates

These external vendors and service providers handle or touch protected health information on behalf of a covered entity:

• IT and Cloud Providers: Data storage vendors, software developers, and managed service providers.
• Administrative Services: Medical billing companies, accountants, and legal firms working with patient records.
• Consultants: Collection agencies, shredding services, and telehealth platforms.

The top 5 most common HIPAA violations involve failing to protect patient data through unauthorized access, weak safeguards, or delayed notifications.

1. Unauthorized Access to Patient Records

• What it is: Staff members viewing Protected Health Information (PHI) out of curiosity or without a direct clinical need.
• Example: Looking up the medical chart of a coworker, family member, or celebrity.

2. Theft or Loss of Unencrypted Devices

• What it is: Laptops, phones, or USB drives containing electronic PHI (ePHI) going missing without proper encryption.
• Example: Leaving a portable hard drive in an unlocked car where it gets stolen.

3. Lack of an Enterprise Risk Analysis

• What it is: Failing to conduct regular, thorough security reviews of organizational systems and vulnerabilities.
• Example: Not checking software or networks for security gaps that later lead to ransomware attacks.

4. Improper Disposal of Patient Records

• What it is: Tossing physical paper files or un-wiped electronic media straight into standard trash or recycling bins.
• Example: Putting printed daily appointment schedules into an open office dumpster.

5. Failure to Issue Timely Breach Notifications

• What it is: Failing to notify affected individuals, the government, or the media within the mandatory 60-day window following a discovered data breach.
• Example: Waiting six months to tell patients that their health records were exposed in a cyberattack.

HIPAA does not protect health information held by non-covered entities, such as employers, life insurance companies, and consumer wellness apps.

HIPAA (Health Insurance Portability and Accountability Act) only applies to HIPAA Covered Entities (health care providers, health plans, and clearinghouses) and their business associates.

Entities Not Protected or Covered

• Employers and HR departments: Sick notes, FMLA (Family and Medical Leave Act) forms, and drug test results kept in personnel files are employment records, not protected health information (PHI).
• Life and disability insurers: Sharing your medical history for life or disability insurance applications is not covered.
• Schools and school districts: Student health records are generally governed by FERPA (Family Educational Rights and Privacy Act) instead of HIPAA.
• Consumer apps and wearables: Fitness trackers, smartwatches, period-tracking apps, and mental health apps are usually not bound by HIPAA unless contracted by a healthcare provider.
• Law enforcement and public agencies: Police departments, child protective services, and legal offices do not operate as healthcare entities during regular investigations.
• Financial and data institutions: Banks, credit bureaus, and data brokers handling health-related purchases or data are exempt from HIPAA rules.

Information Types Not Protected

• Employment records: Health details kept by an employer in a workplace capacity.
• Education records: Student records managed under FERPA.
• Publicly available data: News reports, court documents, or your own social media posts.
• De-identified data: Health information stripped of all personal identifiers.

The 10 most common HIPAA violations involve mishandling protected health information (PHI) through employee error, weak security, or administrative oversight.

Top 10 Most Common Violations

• Employee Snooping: Accessing patient files, family records, or coworker charts without a direct, professional need to know.
• Lost or Stolen Devices: Leaving unencrypted laptops, smartphones, tablets, or USB drives where they can be stolen or accessed by outsiders.
• Failure to Conduct Risk Analyses: Neglecting regular, organization-wide checkups to find and fix security gaps.
• Improper Disposal of Records: Tossing paper charts in regular trash or failing to securely wipe old hard drives.
• Weak Passwords and Access Controls: Using simple passwords or giving too many staff members broad, unmonitored access to electronic records (ePHI).
• Unauthorized Texting or Emailing: Sending patient details over regular, unsecured text messages or standard email instead of encrypted platforms.
• Missing Business Associate Agreements (BAAs): Failing to sign legal BAA contracts with outside vendors and cloud providers who handle patient data.
• Delayed Breach Notifications: Missing the legal deadline to notify patients, the government, and the media within 60 days of discovering a data breach.
• Inadequate Employee Training: Not providing regular, documented privacy and security awareness education for staff.
• Denying or Delaying Patient Access: Taking longer than allowed (or refusing outright) to give patients copies of their own medical records.

The five main rules of the Health Insurance Portability and Accountability Act (HIPAA) are the Privacy Rule, Security Rule, Breach Notification Rule, Transactions and Code Sets Rule, and Unique Identifiers Rule.

1. The Privacy Rule

• What it does: Controls how protected health information (PHI) is used and shared by healthcare providers and plans.
• Key right: Gives patients the right to view, get copies of, and request corrections to their medical records.

2. The Security Rule

• What it does: Protects electronic protected health information (ePHI).
• Key controls: Requires administrative, physical, and technical safeguards—such as encryption and access controls—to secure digital medical data.

3. The Breach Notification Rule

• What it does: Requires healthcare groups to report compromised PHI.
• Key requirement: Mandates notifying affected individuals, the government, and sometimes the media without unreasonable delay (within 60 days).

4. The Transactions and Code Sets Rule

• What it does: Standardizes electronic billing and data exchanges.
• Key goal: Makes healthcare claims and transactions uniform and efficient by using standard coding formats like ICD-10.

5. The Unique Identifiers Rule

• What it does: Assigns standard identification numbers to healthcare participants.
• Key example: Requires providers to use a unique 10-digit National Provider Identifier (NPI).