What does the Health Insurance Portability and Accountability Act require?

Editorial team Published on

The Health Insurance Portability and Accountability Act (HIPAA) requires the protection and secure handling of private medical and health information.

Main Requirements

  • Privacy Rule: Gives patients rights over their health information and sets limits on who can look at or share health records.
  • Security Rule: Requires specific technical, physical, and administrative safeguards to keep electronic health records safe.
  • Breach Notification Rule: Forces health groups to tell patients and the government if private data is stolen or leaked.
  • Enforcement Rule: Sets financial penalties for companies that break these privacy and security laws.

What is an example of a Health Insurance Portability and Accountability Act (HIPAA) violation?

A common example of a HIPAA Violation is an employee snooping into a patient’s electronic medical records without a valid job-related reason.

Other Common Examples

  • Improper Disposal: Throwing paper charts, prescription bottles, or unencrypted flash drives containing Protected Health Information (PHI) into a regular trash can.
  • Insecure Communication: Texting patient details or test results to a personal phone or using an unencrypted messaging app.
  • Unauthorized Disclosure: Discussing a patient's diagnosis or treatment in a public space, such as a waiting room or cafeteria, where others can overhear.
  • Stolen Devices: Leaving an unencrypted laptop or smartphone containing patient records in an unattended car where it gets stolen.
  • Social Media Sharing: Posting a photo or detail from a workplace setting that inadvertently identifies a patient.

What are the 5 HIPAA rules?

The five primary components or rules that make up HIPAA compliance are the Privacy Rule, Security Rule, Breach Notification Rule, Omnibus Rule, and Enforcement Rule.

1. The Privacy Rule

  • Sets national standards for the use and disclosure of Protected Health Information (PHI).
  • Gives patients the right to view, obtain copies of, and request corrections to their medical records.
  • Limits the sharing of medical data to the "minimum necessary" required for patient care.

2. The Security Rule

  • Establishes technical, physical, and administrative safeguards specifically for electronic Protected Health Information (ePHI).
  • Requires organizations to control access to computer systems and encrypt digital data.
  • Mandates regular risk assessments to find and fix vulnerabilities.

3. The Breach Notification Rule

  • Requires covered entities to notify affected individuals, the government (HHS), and sometimes the media following a data breach.
  • Mandates notification without unreasonable delay and no later than 60 days after discovering a breach.

4. The Omnibus Rule

  • Expands HIPAA and HITECH Act requirements to cover business associates and their subcontractors.
  • Strengthens restrictions on using genetic information for health insurance underwriting and updates patient privacy rights.

5. The Enforcement Rule

  • Outlines how the Department of Health and Human Services (HHS) investigates compliance complaints.
  • Establishes the tiered civil and criminal penalty structures for HIPAA violations.

Which two major elements of the Healthcare Insurance Portability and Accountability Act of 1996 included regulations on?

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 included regulations on the privacy of health care records and the security of health care records.

  • Privacy of Health Care Records (The Privacy Rule): Established national standards to protect individuals' medical records and personal health information (PHI).
  • Security of Health Care Records (The Security Rule): Set national safeguards for protecting electronic protected health information (ePHI) from unauthorized access, use, or disclosure.

What is the new HIPAA rule in 2026?

The main new HIPAA requirement for 2026 is updating privacy notices under the HHS Model Notices of Privacy Practices to include stricter protections for substance use disorder (SUD) patient records.

Key 2026 Privacy Rule Updates

  • February 16, 2026 Deadline: Healthcare providers and health plans had to update their Notice of Privacy Practices (NPP).
  • Substance Use Records: Notices must now explain how substance use disorder records are protected under 42 CFR Part 2.
  • Legal Protections: Patient records generally cannot be used in civil or criminal legal cases without explicit consent or a court order.
  • Patient Rights: Patients gained clearer rights to restrict sharing, opt out of fundraising, and file complaints.

Proposed Security Rule Changes (Under Review)

Regulators are also pushing a major update to the HIPAA Security Rule that changes how organizations handle data safety:

  • No More "Addressable" Rules: Optional security steps are becoming mandatory.
  • Mandatory MFA: Multi-factor authentication is required across all systems.
  • Required Encryption: Patient data must be encrypted both in transit and at rest.

HIPAA Explained: Your Quick Guide to the Health Insurance Portability and Accountability Act

9 related questions found

What are three ways in which HIPAA may be violated?

Three common ways HIPAA may be violated include unauthorized viewing of patient records, improper disposal of protected health information (PHI), and using unsecured communication methods.

1. Unauthorized Access or Snooping

  • What it is: Staff members looking at patient medical files or information without a legitimate, job-related reason.
  • Example: A hospital employee checking the electronic health record of a celebrity, a neighbor, or a coworker out of personal curiosity.

2. Improper Disposal of PHI

  • What it is: Failing to securely destroy physical or electronic records containing sensitive patient details.
  • Example: Throwing paper charts containing patient names and diagnoses directly into a standard trash can instead of shredding them, or tossing out old hard drives without wiping the data.

3. Using Unsecured Communication Channels

  • What it is: Sharing electronic protected health information (ePHI) over standard, non-encrypted platforms or personal devices.
  • Example: Texting a patient’s name and medical condition to a colleague via a standard, unencrypted text message or a personal email account without a proper Business Associate Agreement.

What are the 10 most common HIPAA violations?

The 10 most common HIPAA violations involve mishandling protected health information (PHI) through employee error, weak security, or administrative oversight.

Top 10 Most Common Violations

  • Employee Snooping: Accessing patient files, family records, or coworker charts without a direct, professional need to know.
  • Lost or Stolen Devices: Leaving unencrypted laptops, smartphones, tablets, or USB drives where they can be stolen or accessed by outsiders.
  • Failure to Conduct Risk Analyses: Neglecting regular, organization-wide checkups to find and fix security gaps.
  • Improper Disposal of Records: Tossing paper charts in regular trash or failing to securely wipe old hard drives.
  • Weak Passwords and Access Controls: Using simple passwords or giving too many staff members broad, unmonitored access to electronic records (ePHI).
  • Unauthorized Texting or Emailing: Sending patient details over regular, unsecured text messages or standard email instead of encrypted platforms.
  • Missing Business Associate Agreements (BAAs): Failing to sign legal BAA contracts with outside vendors and cloud providers who handle patient data.
  • Delayed Breach Notifications: Missing the legal deadline to notify patients, the government, and the media within 60 days of discovering a data breach.
  • Inadequate Employee Training: Not providing regular, documented privacy and security awareness education for staff.
  • Denying or Delaying Patient Access: Taking longer than allowed (or refusing outright) to give patients copies of their own medical records.

What is not allowed under HIPAA?

Under the Health Insurance Portability and Accountability Act (HIPAA), healthcare providers, health plans, and clearinghouses are strictly not allowed to share or use a patient's Protected Health Information (PHI) without the patient’s written authorization, except for specific purposes like treatment, payment, or healthcare operations.

Prohibited Actions and Disclosures

  • Sharing with employers: Providers cannot give your health information or test results directly to your employer without your signed consent.
  • Marketing use: Selling patient information or using PHI for commercial marketing or advertising without explicit permission is barred.
  • Social media sharing: Posting patient photos, details, or identifying medical stories online is forbidden.
  • Gossip and casual talk: Discussing patient conditions in public areas or with unauthorized family and friends is prohibited.
  • Leaving unsecured records: Leaving paper charts, unencrypted laptops, or visible computer screens exposed to unauthorized people is a violation.

What HIPAA Does Not Cover

HIPAA only applies to covered entities and their business associates. It does not restrict:

  • Employment files: Health data kept in an employer's personnel or HR files (like sick notes or drug tests) is not protected by HIPAA.
  • Consumer apps: Fitness trackers, smartwatches, and period-tracking apps are generally not bound by HIPAA rules.
  • Public records: Information already made public through news or court filings.

What are the four most common HIPAA violations?

The four most common HIPAA violations are unauthorized access or "snooping" on patient records, failure to perform organization-wide risk analyses, improper disposal of protected health information (PHI), and insufficient staff training.

1. Unauthorized Access and Snooping

  • What it is: Staff members viewing patient charts, medical histories, or billing information without a legitimate, job-related reason to do so.
  • Example: An employee looking up the health records of a coworker, family member, or local celebrity out of curiosity.

2. Failure to Conduct Risk Analyses

  • What it is: Healthcare organizations neglecting to run systematic, comprehensive audits of their physical and digital environments to find security gaps.
  • Example: Failing to document vulnerabilities in software systems or electronic health record (EHR) portals before a breach occurs.

3. Improper Disposal of PHI

  • What it is: Throwing away paper records or electronic media that contain identifiable patient data without rendering them completely unreadable.
  • Example: Tossing un-shredded patient intake sheets, prescription bottles, or old computer hard drives directly into regular office trash or recycling bins.

4. Insufficient Employee Training

  • What it is: Failing to provide regular, documented HIPAA compliance and security awareness education to staff members.
  • Example: Onboarding a new medical receptionist without teaching them how to safely handle physical files or spot phishing emails.

You can review official government oversight details through the U.S. Department of Health and Human Services enforcement highlights.

What are the 7 patient rights under HIPAA?

Under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, patients have fundamental rights regarding their Protected Health Information (PHI).

The primary patient rights established under HIPAA include:

  • Right to Access and Copy: Patients can inspect and obtain copies of their medical and billing records.
  • Right to Request Amendments: Patients can ask to correct or amend incomplete or inaccurate information in their records.
  • Right to an Accounting of Disclosures: Patients can obtain a list of certain times and reasons a provider or health plan shared their health information.
  • Right to Request Restrictions: Patients can ask providers or health plans to limit how they use or share their health data.
  • Right to Confidential Communications: Patients can request that providers contact them via alternative methods or at alternative locations (such as a work phone instead of a home phone).
  • Right to a Notice of Privacy Practices: Patients have the right to receive a written explanation of how their health information is used and disclosed by a covered entity.
  • Right to File a Complaint: Patients can file a privacy complaint with the health provider's privacy officer or the U.S. Department of Health and Human Services (HHS) Office for Civil Rights if they believe their rights were violated.