What does HIPAA actually protect?

Editorial team Published on

HIPAA protects Protected Health Information (PHI), which includes any individually identifiable health, treatment, or payment records held or transmitted by a covered entity in any form—whether electronic, paper, or spoken.

What Information is Protected (PHI)

  • Personal identifiers: Names, Social Security numbers, phone numbers, email addresses, and physical addresses.
  • Medical details: Past, present, or future physical or mental health conditions, diagnoses, and treatment notes.
  • Payment history: Information about past healthcare payments and insurance coverage or claims.

Who Must Follow HIPAA

  • Healthcare providers: Doctors, clinics, hospitals, dentists, and pharmacies that conduct electronic transactions.
  • Health plans: Health insurance companies, HMOs, Medicare, and Medicaid.
  • Healthcare clearinghouses: Entities that process nonstandard health data into standard formats.
  • Business associates: Third-party vendors and contractors who handle PHI on behalf of covered entities.

You can learn more about individual rights and regulations through the U.S. Department of Health and Human Services Privacy Guide.

What does HIPAA not cover?

HIPAA does not cover health information held by non-healthcare organizations, employment records, or data from standard consumer wellness apps.

The HIPAA Privacy Rule strictly applies only to covered entities (health plans, healthcare clearinghouses, and certain healthcare providers) and their business associates.

Uncovered Entities and Organizations

  • Employers and HR departments: Sick notes, FMLA forms, and accommodation requests kept in personnel files are employment records, not protected health information (PHI).
  • Life and disability insurers: Providing medical data for underwriting purposes is not protected because these insurers are not covered entities.
  • Schools and universities: Student health records are governed by the Family Educational Rights and Privacy Act (FERPA) rather than HIPAA.
  • Law enforcement and public agencies: Police departments, courts, and child protective services operate outside HIPAA when handling investigative files.

Uncovered Technologies and Data

  • Consumer wellness apps: Period trackers, fitness wearables, and mental health chatbots are typically exempt unless they contract directly with a healthcare provider.
  • De-identified data: Medical records stripped of personal identifiers can be shared freely.
  • Publicly available details: News reports, court records, or your own social media posts lose HIPAA protection once made public.

What are the 7 patient rights under HIPAA?

Under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, patients have fundamental rights regarding their Protected Health Information (PHI).

The primary patient rights established under HIPAA include:

  • Right to Access and Copy: Patients can inspect and obtain copies of their medical and billing records.
  • Right to Request Amendments: Patients can ask to correct or amend incomplete or inaccurate information in their records.
  • Right to an Accounting of Disclosures: Patients can obtain a list of certain times and reasons a provider or health plan shared their health information.
  • Right to Request Restrictions: Patients can ask providers or health plans to limit how they use or share their health data.
  • Right to Confidential Communications: Patients can request that providers contact them via alternative methods or at alternative locations (such as a work phone instead of a home phone).
  • Right to a Notice of Privacy Practices: Patients have the right to receive a written explanation of how their health information is used and disclosed by a covered entity.
  • Right to File a Complaint: Patients can file a privacy complaint with the health provider's privacy officer or the U.S. Department of Health and Human Services (HHS) Office for Civil Rights if they believe their rights were violated.

What is the most common HIPAA violation?

The most common HIPAA violation is the impermissible use and disclosure of Protected Health Information (PHI), driven heavily by unauthorized internal access or employee snooping.

Most Common Types of Violations

  • Unauthorized Access / Insider Snooping: Employees looking at patient files, charts, or records out of curiosity or without a direct clinical need to know.
  • Impermissible Disclosures: Sharing patient information with unauthorized friends, family members, or undesignated third parties without proper signed authorization.
  • Inadequate Safeguards: Failing to properly secure electronic PHI (ePHI), such as leaving screens unlocked, using weak passwords, or lacking encryption on mobile devices.
  • Improper Disposal: Throwing away physical paper records containing personal health information in regular trash or recycling bins instead of shredding them.
  • Lost or Stolen Devices: Misplacing unencrypted laptops, smartphones, or USB drives that contain patient data.
  • Denial of Patient Access: Failing to provide patients with copies of their own medical records within the required legal timeframe.

You can review official enforcement data and statistics through the U.S. Department of Health and Human Services (HHS) compliance guidelines.

What are the downsides of HIPAA?

The primary downsides of HIPAA include high compliance costs, administrative burdens, and potential barriers to efficient care coordination and medical research.

Enacted in 1996, the Health Insurance Portability and Accountability Act (HIPAA) protects patient medical data, but it also creates several challenges for healthcare providers, patients, and researchers.

Administrative and Financial Costs

  • High Compliance Expenses: Healthcare groups must spend money on secure technologies, audits, risk assessments, and dedicated compliance officers.
  • Burden on Small Practices: Independent or small clinics often lack the money and staff to properly manage complex rules, leading to operational strain.
  • Heavy Documentation and Training: Staff must spend valuable time logging policies, managing paperwork, and completing mandatory ongoing training.

Impact on Patient Care and Communication

  • Slower Workflows: Strict identity checks and data-sharing rules can delay everyday tasks, referrals, and urgent communication during medical emergencies.
  • Restricted Information Sharing: Overly cautious interpretations of the law can block doctors from sharing critical details with other providers or family caregivers, sometimes fragmenting patient care.
  • Patient Frustration: Strict rules can create delays when people try to view their own medical records, causing annoyance for patients.

Innovation and Research Barriers

  • Hinders Medical Research: Strict consent rules make it difficult and slow for scientists to access large pools of patient data needed for clinical studies and public health breakthroughs.
  • Slows Digital Health Startups: Complex regulatory hurdles make it harder for new developers to launch modern healthcare apps or software quickly.

Protection Gaps

  • Excludes Modern Tech: HIPAA applies to traditional medical providers and their business associates. Consumer wellness devices, fitness trackers, and many health apps fall outside its scope, leaving some consumer data unprotected.
  • No Absolute Security: Even with strict rules in place, hospitals and clinics remain frequent targets for damaging cyberattacks and ransomware.

Understanding Protected Health Information (PHI) and HIPAA Compliance

9 related questions found

What are three exceptions to HIPAA?

The three specific exceptions under the HIPAA Breach Notification Rule define when unauthorized access to or acquisition of protected health information (PHI) is not legally considered a reportable breach.

Three Core Exceptions to a HIPAA Breach

  • Unintentional Acquisition, Access, or Use of PHI: An employee or workforce member accesses health data accidentally in good faith and within their authorized scope of work, without further improper disclosure. (Example: A nurse accidentally opens the wrong electronic chart but closes it immediately upon realizing the error.)
  • Inadvertent Disclosure Between Authorized Persons: A person who is authorized to access PHI mistakenly shares it with another authorized person within the same organization or health care arrangement. (Example: Two clinicians with proper authorization mistakenly swap a verbal update using the wrong patient file name, but the recipient cannot retain or misuse the data.)
  • Unauthorized Disclosure Where Data Cannot Be Retained: An unauthorized recipient receives PHI, but the covered entity has a good-faith belief that the person could not have reasonably retained or compromised the information. (Example: A misdirected fax or email sent to an external party who immediately calls to report it and confirms they did not read, save, or print the document.)

Other Common Exceptions to HIPAA Privacy Rules

Beyond breach notification, the Department of Health and Human Services (HHS) allows the disclosure of PHI without patient authorization in specific public interest scenarios, including:

  • Treatment, payment, and healthcare operations (TPO)
  • Public health activities and disease reporting
  • Judicial and administrative court orders
  • Law enforcement and public safety threats
  • Workers' compensation compliance

What is the new HIPAA rule in 2026?

The main new HIPAA requirement for 2026 is updating privacy notices under the HHS Model Notices of Privacy Practices to include stricter protections for substance use disorder (SUD) patient records.

Key 2026 Privacy Rule Updates

  • February 16, 2026 Deadline: Healthcare providers and health plans had to update their Notice of Privacy Practices (NPP).
  • Substance Use Records: Notices must now explain how substance use disorder records are protected under 42 CFR Part 2.
  • Legal Protections: Patient records generally cannot be used in civil or criminal legal cases without explicit consent or a court order.
  • Patient Rights: Patients gained clearer rights to restrict sharing, opt out of fundraising, and file complaints.

Proposed Security Rule Changes (Under Review)

Regulators are also pushing a major update to the HIPAA Security Rule that changes how organizations handle data safety:

  • No More "Addressable" Rules: Optional security steps are becoming mandatory.
  • Mandatory MFA: Multi-factor authentication is required across all systems.
  • Required Encryption: Patient data must be encrypted both in transit and at rest.

Can HIPAA be violated by a patient?

No, a patient cannot violate the Health Insurance Portability and Accountability Act (HIPAA) because the law only applies to covered entities and their business associates.

Who HIPAA Applies To

  • Covered Entities: Healthcare providers, health plans, and healthcare clearinghouses.
  • Business Associates: Contractors or organizations that perform services involving protected health information on behalf of a covered entity.

Why Patients Are Exempt

  • Patients own their own medical records and can share their personal health information with anyone they choose.
  • If a patient posts about their own medical diagnosis, talks about another patient, or shares someone else's medical details publicly, it is not a legal violation of HIPAA.
  • However, if a patient works as a healthcare employee and improperly accesses or shares records using their professional access, they can be held liable under HIPAA as a member of the workforce.

What patient right is most often violated?

The right to privacy and confidentiality under HIPAA—specifically unauthorized access or "snooping" into patient medical records—is the most frequently violated patient right.

Common Privacy Violations

  • Employee Snooping: Staff members looking at electronic health records (EHR) of relatives, neighbors, or celebrities without a direct care need.
  • Improper Disclosure: Sharing protected health information (PHI) with unauthorized individuals or releasing the wrong patient's details.
  • Unprotected Devices: Storing private medical data on unencrypted smartphones, laptops, or mobile devices.

Other Frequently Violated Rights

  • Right of Access: Providers delaying the release of medical records, failing to respond within legal timeframes, or charging excessive fees.
  • Informed Consent: Obtaining signatures on medical forms without properly explaining the risks, alternatives, or the patient's right to refuse.
  • Dignity and Proper Care: Facilities failing to meet minimum staffing ratios, resulting in ignored call lights or neglected basic needs.

What are the three main rules of HIPAA?

The three main rules of the Health Insurance Portability and Accountability Act (HIPAA) are the Privacy Rule, the Security Rule, and the Breach Notification Rule.

1. The HIPAA Privacy Rule

The Privacy Rule sets national standards to protect individuals' medical records and other protected health information (PHI).

  • Scope: Applies to paper, electronic, and spoken PHI.
  • Patient Rights: Gives patients the right to view, obtain copies of, and request corrections to their health records.
  • Use and Disclosure: Limits how organizations can share health data, enforcing the "minimum necessary" standard so staff only access data required for their specific jobs.

2. The HIPAA Security Rule

The Security Rule specifies the administrative, physical, and technical safeguards organizations must use to protect electronic protected health information (ePHI).

  • Administrative Safeguards: Security policies, staff training, and periodic risk assessments.
  • Physical Safeguards: Facility access controls, workstation security, and device protection.
  • Technical Safeguards: Access controls, password protection, and end-to-end data encryption.

3. The HIPAA Breach Notification Rule

The Breach Notification Rule requires covered entities to notify affected individuals, the government, and sometimes the media when unsecured PHI is compromised.

  • Individual Notice: Affected patients must be notified without unreasonable delay and within 60 days of discovering the breach.
  • Government Notice: The Department of Health and Human Services (HHS) must be notified within 60 days (or immediately if 500 or more individuals are affected).
  • Media Notice: Prominent local media outlets must be alerted if a breach affects more than 500 residents in a single state or jurisdiction.