What is one thing HIPAA rules don't do?

Editorial team Published on

The HIPAA Privacy Rule does not create a private right of action, meaning individuals cannot sue a healthcare provider or organization directly in court for a HIPAA violation.

Key Limits of HIPAA

  • No individual lawsuits: Patients cannot file a civil lawsuit or collect personal monetary damages through court under HIPAA. Complaints must instead go to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights.
  • Not a universal law: It does not apply to non-covered entities, such as employers, schools, or tech companies, unless they are acting as a healthcare provider, health plan, or business associate.
  • Doesn't govern personal data: It does not regulate an individual's own use, storage, or sharing of their personal medical records.

What are the 5 main HIPAA rules?

The five main rules of the Health Insurance Portability and Accountability Act (HIPAA) are the Privacy Rule, Security Rule, Breach Notification Rule, Transactions and Code Sets Rule, and Unique Identifiers Rule.

1. The Privacy Rule

  • What it does: Controls how protected health information (PHI) is used and shared by healthcare providers and plans.
  • Key right: Gives patients the right to view, get copies of, and request corrections to their medical records.

2. The Security Rule

  • What it does: Protects electronic protected health information (ePHI).
  • Key controls: Requires administrative, physical, and technical safeguards—such as encryption and access controls—to secure digital medical data.

3. The Breach Notification Rule

  • What it does: Requires healthcare groups to report compromised PHI.
  • Key requirement: Mandates notifying affected individuals, the government, and sometimes the media without unreasonable delay (within 60 days).

4. The Transactions and Code Sets Rule

  • What it does: Standardizes electronic billing and data exchanges.
  • Key goal: Makes healthcare claims and transactions uniform and efficient by using standard coding formats like ICD-10.

5. The Unique Identifiers Rule

  • What it does: Assigns standard identification numbers to healthcare participants.
  • Key example: Requires providers to use a unique 10-digit National Provider Identifier (NPI).

What is not a main HIPAA rule?

Any regulation, standard, or law outside of the core administrative simplification rules—such as the Privacy Rule, Security Rule, Breach Notification Rule, Enforcement Rule, and Transactions and Code Sets (Portability) Rule—is not a main HIPAA rule.

Common examples of items that are not main HIPAA rules include:

  • The FTC Health Breach Notification Rule: Governs health apps and vendors of personal health records that are not covered by HIPAA.
  • FERPA (Family Educational Rights and Privacy Act): Manages student education and school medical records instead of HIPAA.
  • General commercial privacy laws: State-level consumer privacy acts or general corporate data laws that apply to non-covered entities like life insurers, employers, or fitness clubs.

What are the 10 most common HIPAA violations?

The 10 most common HIPAA violations involve mishandling protected health information (PHI) through employee error, weak security, or administrative oversight.

Top 10 Most Common Violations

  • Employee Snooping: Accessing patient files, family records, or coworker charts without a direct, professional need to know.
  • Lost or Stolen Devices: Leaving unencrypted laptops, smartphones, tablets, or USB drives where they can be stolen or accessed by outsiders.
  • Failure to Conduct Risk Analyses: Neglecting regular, organization-wide checkups to find and fix security gaps.
  • Improper Disposal of Records: Tossing paper charts in regular trash or failing to securely wipe old hard drives.
  • Weak Passwords and Access Controls: Using simple passwords or giving too many staff members broad, unmonitored access to electronic records (ePHI).
  • Unauthorized Texting or Emailing: Sending patient details over regular, unsecured text messages or standard email instead of encrypted platforms.
  • Missing Business Associate Agreements (BAAs): Failing to sign legal BAA contracts with outside vendors and cloud providers who handle patient data.
  • Delayed Breach Notifications: Missing the legal deadline to notify patients, the government, and the media within 60 days of discovering a data breach.
  • Inadequate Employee Training: Not providing regular, documented privacy and security awareness education for staff.
  • Denying or Delaying Patient Access: Taking longer than allowed (or refusing outright) to give patients copies of their own medical records.

What violates HIPAA rules?

A HIPAA violation occurs when a healthcare provider, health plan, clearinghouse, or its business associate fails to properly protect, use, or disclose a patient's Protected Health Information (PHI).

Common Examples of HIPAA Violations

  • Unauthorized Disclosure: Sharing patient details with friends, family, or unauthorized coworkers without explicit patient consent.
  • Looking at Records Out of Curiosity: Accessing a patient's medical file—such as a coworker, celebrity, or neighbor—without a valid, job-related reason.
  • Insecure Communication: Sending patient records or emails through unencrypted channels or unsecured platforms.
  • Leaving Data Exposed: Leaving physical charts in public areas, computer screens unlocked with visible patient data, or paper files in unsecured trash cans.
  • Casual Conversations: Discussing identifiable patient details in public spaces like elevators, cafeterias, or waiting rooms where others can listen.
  • Lost or Stolen Devices: Misplacing unencrypted laptops, smartphones, or USB drives containing patient data.

Categories and Penalties

Violations of the Health Insurance Portability and Accountability Act (HIPAA) range from simple accidents to deliberate crimes:

  • Civil Violations (Unintentional): Ranging from lack of knowledge to willful neglect, with fines scaling based on whether the issue was corrected promptly.
  • Criminal Violations (Intentional/Malicious): Stealing data for personal gain, selling PHI, or using it under false pretenses can lead to heavy financial penalties and up to 10 years in prison.

Why HIPAA was Created?

9 related questions found

What are the five most common HIPAA violations?

The five most common HIPAA violations are unauthorized access (employee snooping), theft or loss of unencrypted devices, lack of a comprehensive risk assessment, improper disposal of patient records, and failure to execute Business Associate Agreements (BAAs).

1. Unauthorized Access and Employee Snooping

  • What it is: Staff members viewing patient files, electronic health records (eHRs), or Protected Health Information (PHI) without a legitimate job-related reason.
  • Example: Looking up the medical history of a neighbor, coworker, or celebrity out of personal curiosity.

2. Lost or Stolen Unencrypted Devices

  • What it is: Laptops, tablets, smartphones, or USB drives containing electronic PHI (ePHI) going missing without encryption protections.
  • Example: Leaving a work laptop in an unlocked car where it gets stolen. Encryption renders the data unreadable and prevents it from automatically becoming a reportable breach.

3. Failure to Conduct Risk Assessments

  • What it is: Organizations neglecting to perform regular, thorough audits of their administrative, physical, and technical safeguards.
  • Example: Failing to review system vulnerabilities, software patches, or access logs, leaving backdoors open for hackers or internal data leaks.

4. Improper Disposal of Patient Records

  • What it is: Throwing away paper charts or un-wiped electronic media containing sensitive data into regular trash or recycling bins.
  • Example: Tossing intact prescription labels or printed lab results into an open dumpster instead of shredding or destroying them.

5. Missing Business Associate Agreements (BAAs)

  • What it is: Failing to sign a legal contract with third-party vendors or contractors who handle, store, or process PHI on your behalf.
  • Example: Using an IT service provider, cloud storage vendor, or billing company without a signed BAA in place.

What are the three main rules of HIPAA?

The three main rules of the Health Insurance Portability and Accountability Act (HIPAA) are the Privacy Rule, the Security Rule, and the Breach Notification Rule.

1. The HIPAA Privacy Rule

The Privacy Rule sets national standards to protect individuals' medical records and other protected health information (PHI).

  • Scope: Applies to paper, electronic, and spoken PHI.
  • Patient Rights: Gives patients the right to view, obtain copies of, and request corrections to their health records.
  • Use and Disclosure: Limits how organizations can share health data, enforcing the "minimum necessary" standard so staff only access data required for their specific jobs.

2. The HIPAA Security Rule

The Security Rule specifies the administrative, physical, and technical safeguards organizations must use to protect electronic protected health information (ePHI).

  • Administrative Safeguards: Security policies, staff training, and periodic risk assessments.
  • Physical Safeguards: Facility access controls, workstation security, and device protection.
  • Technical Safeguards: Access controls, password protection, and end-to-end data encryption.

3. The HIPAA Breach Notification Rule

The Breach Notification Rule requires covered entities to notify affected individuals, the government, and sometimes the media when unsecured PHI is compromised.

  • Individual Notice: Affected patients must be notified without unreasonable delay and within 60 days of discovering the breach.
  • Government Notice: The Department of Health and Human Services (HHS) must be notified within 60 days (or immediately if 500 or more individuals are affected).
  • Media Notice: Prominent local media outlets must be alerted if a breach affects more than 500 residents in a single state or jurisdiction.

What isn't protected by HIPAA?

HIPAA does not protect health-related information held by non-covered entities, employment records, or data that has been made public.

The Health Insurance Portability and Accountability Act (HHS HIPAA Guide) only applies to specific "covered entities" (like doctors, hospitals, and health insurance plans) and their business associates.

Unprotected Information and Categories

  • Consumer Apps and Wearables: Fitness trackers, smartwatches, and period-tracking or mental health apps are generally not covered by HIPAA unless they are directly provided or contracted by a healthcare provider.
  • Employment Records: Health information kept in an employer's human resources files—such as sick notes, FMLA (Family and Medical Leave Act) forms, ADA (Americans with Disabilities Act) accommodation requests, or drug test results—is treated as an employment record rather than protected health data.
  • Publicly Available Information: Details about your health that appear in news reports, court records, public registries, or your own social media posts are not protected.
  • Life and Disability Insurance: Records you share with life insurance companies, auto insurers, or workers’ compensation carriers during underwriting or claims are outside HIPAA boundaries.
  • De-Identified Data: Health data that has had all 18 personal identifiers (like name, birth date, and social security number) safely removed is no longer restricted as Protected Health Information (PHI).
  • Education Records: Student health records maintained by most K-12 schools or universities are generally governed by FERPA (Family Educational Rights and Privacy Act) instead of HIPAA.

What are the two rules under HIPAA?

The two foundational rules of HIPAA are the Privacy Rule and the Security Rule.

1. The HIPAA Privacy Rule

  • What it does: Protects all personal health data (known as Protected Health Information or PHI), regardless of whether it is spoken, written on paper, or stored digitally.
  • Key focus: Controls how patient information is used and shared by healthcare providers and health plans.
  • Patient rights: Gives people the right to look at their own medical records, ask for corrections, and know who has seen their information.

2. The HIPAA Security Rule

  • What it does: Focuses specifically on electronic protected health information (ePHI).
  • Key focus: Requires safeguards to keep digital patient data confidential, accurate, and available only to authorized people.
  • Safeguard types: Uses administrative rules (staff training, risk plans), physical controls (locked server rooms), and technical measures (passwords, encryption).

(Note: While these are the original two main rules, modern HIPAA compliance also includes the Breach Notification, Enforcement, and Omnibus rules.)

What is not a HIPAA violation?

Because you didn't include the specific multiple-choice options from your test, it is not possible to point directly to one answer. However, if this is a standard quiz question, it usually looks like one of the following scenarios:

Scenario 1: A common compliance test question

If your options look like this:

  • ❌ Accessing the health record of family members or friends out of curiosity
  • ❌ Accidentally losing an unencrypted laptop containing patient files
  • 💚 Providing court-ordered health information (or providing a patient with a copy of their own records)

Correct Answer: Providing court-ordered health information or providing a patient with a copy of requested health records within the legal timeframe. HIPAA allows the disclosure of Protected Health Information (PHI) without patient consent for judicial and administrative proceedings if a direct court order is issued. Patients also have a legal right under HIPAA to access their own records.

Scenario 2: Medical training or clinical scenario

If your options look like this:

  • ❌ Leaving patient charts visible at a nurses' station
  • ❌ Discussing a patient's case with a colleague to tell an amusing story
  • 💚 Sharing patient information with another healthcare provider for the purpose of providing treatment

Correct Answer: Sharing information for treatment purposes. Under the HIPAA Privacy Rule, covered entities are fully permitted to share PHI with other doctors, specialists, or nurses who are actively treating the patient to ensure proper care.

Scenario 3: Technology and security scenario

If your options look like this:

  • ❌ Posting about a patient on social media (even without names)
  • ❌ Sending unencrypted patient data over the internet
  • 💚 Sending encrypted patient information across the internet per healthcare organization policy

Correct Answer: Sending encrypted patient information. Using approved, secure communication channels that leverage proper encryption safely protects PHI during transit and meets HIPAA Security Rule standards.

Please reply with your exact multiple-choice options if none of these match, and I will gladly tell you the precise answer!