Who doesn't have to comply with HIPAA?

Editorial team Published on

HIPAA does not apply to non-covered entities, which include most employers, life insurance companies, schools, and law enforcement agencies.

Entities Excluded from HIPAA

HIPAA only applies to covered entities (health care providers, health plans, and health care clearinghouses) and their business associates. It does not cover:

  • Most Employers: HR departments and employers are generally not bound by HIPAA, even when they collect medical notes or sick leave requests (though other laws like the ADA govern employee data).
  • Life and Property Insurers: Life insurance companies, auto insurers, and workers' compensation carriers do not fall under HIPAA rules.
  • Schools and School Districts: Student health records kept by K-12 schools and universities are protected by FERPA (Family Educational Rights and Privacy Act) instead of HIPAA.
  • Law Enforcement and Courts: Police departments, courts, and correctional facilities are not covered entities just because they hold health information.
  • Consumer Health Apps and Wearables: Fitness trackers and many health apps sold directly to consumers are usually regulated by the FTC (Federal Trade Commission), not HIPAA.

Types of Records Excluded

Even within healthcare settings, HIPAA does not protect:

  • Employment Records: Medical information that an employer holds about its own workers in an employment capacity.
  • De-Identified Data: Health information that has had all personal identifiers removed.
  • Personal Use: An individual sharing or storing their own medical records.

What are three exceptions to HIPAA?

The three specific exceptions under the HIPAA Breach Notification Rule define when unauthorized access to or acquisition of protected health information (PHI) is not legally considered a reportable breach.

Three Core Exceptions to a HIPAA Breach

  • Unintentional Acquisition, Access, or Use of PHI: An employee or workforce member accesses health data accidentally in good faith and within their authorized scope of work, without further improper disclosure. (Example: A nurse accidentally opens the wrong electronic chart but closes it immediately upon realizing the error.)
  • Inadvertent Disclosure Between Authorized Persons: A person who is authorized to access PHI mistakenly shares it with another authorized person within the same organization or health care arrangement. (Example: Two clinicians with proper authorization mistakenly swap a verbal update using the wrong patient file name, but the recipient cannot retain or misuse the data.)
  • Unauthorized Disclosure Where Data Cannot Be Retained: An unauthorized recipient receives PHI, but the covered entity has a good-faith belief that the person could not have reasonably retained or compromised the information. (Example: A misdirected fax or email sent to an external party who immediately calls to report it and confirms they did not read, save, or print the document.)

Other Common Exceptions to HIPAA Privacy Rules

Beyond breach notification, the Department of Health and Human Services (HHS) allows the disclosure of PHI without patient authorization in specific public interest scenarios, including:

  • Treatment, payment, and healthcare operations (TPO)
  • Public health activities and disease reporting
  • Judicial and administrative court orders
  • Law enforcement and public safety threats
  • Workers' compensation compliance

Which entities are exempt from HIPAA regulations?

Entities that are not classified as HIPAA covered entities or their business associates are exempt from HIPAA regulations.

Common Exempt Entities

  • Employers: Handled as employers, not healthcare providers. Employment records held by companies are excluded.
  • Life and Disability Insurers: Policies focused strictly on life, disability, or auto insurance do not count as health plans.
  • Schools and Universities: Student health records are generally governed by the Family Educational Rights and Privacy Act (FERPA) rather than HIPAA.
  • Law Enforcement Agencies: Police departments, sheriffs, and correctional facilities operate outside HIPAA when handling investigative files or public safety records.
  • Consumer Wellness Apps and Wearables: Fitness trackers, nutrition apps, and direct-to-consumer health tools are typically exempt unless they work directly on behalf of a covered hospital or health plan.
  • Workers’ Compensation Carriers: Entities providing only workers' compensation coverage are excluded from health plan definitions.
  • Banks and Financial Institutions: Credit card processors and financial institutions handling payment transactions for medical bills do not fall under HIPAA.

Healthcare Providers Who Do Not Transmit Electronic Data

Under the law, healthcare providers are only covered if they transmit health data electronically in connection with a standard HIPAA transaction (such as electronic billing or insurance claims). A doctor or clinic that relies strictly on paper files, phone calls, or mail for all billing and claims is exempt.

Is everyone bound by HIPAA?

No, HIPAA does not apply to everyone; it only applies to specific Covered Entities and Business Associates that handle protected health information (PHI).

Who Must Follow HIPAA

HIPAA (Health Insurance Portability and Accountability Act) regulates specific groups in the healthcare industry:

  • Healthcare Providers: Doctors, clinics, dentists, pharmacies, hospitals, and nursing homes that transmit health data electronically.
  • Health Plans: Health insurance companies, HMOs, company health plans, Medicare, and Medicaid.
  • Healthcare Clearinghouses: Entities that process nonstandard health data into standard electronic formats (or vice versa).
  • Business Associates: Outside vendors, billing companies, IT providers, and legal or accounting consultants who access PHI while performing services for a covered entity.

Who is NOT Covered by HIPAA

Many people assume HIPAA is a universal medical privacy law, but it does not apply to:

  • Most Employers: Employers cannot look at employee medical records under HIPAA, but HIPAA generally does not regulate general employment records held by a company.
  • Schools and School Districts: Educational records and student health records managed by most schools fall under FERPA (Family Educational Rights and Privacy Act) instead.
  • Life and Auto Insurers: Life insurance companies and workers' compensation carriers are usually exempt.
  • Consumer Wellness Apps and Fitness Trackers: Apps, smartwatches, and independent websites that track your sleep, steps, or weight typically do not fall under HIPAA unless they are officially contracted by a covered entity.
  • Private Individuals: Friends, family members, or patients sharing their own medical information are not bound by HIPAA rules.

As noted by a consensus of users on Quora, HIPAA does not apply universally to all individuals or all medical personnel, though other professional or state confidentiality rules may still apply.

Who is mandated to follow HIPAA requirements?

HIPAA requirements are legally mandated for covered entities and their business associates that handle protected health information (PHI).

Covered Entities

Covered entities are traditional healthcare organizations that create, receive, or transmit health data electronically. They include:

  • Healthcare Providers: Doctors, clinics, hospitals, dentists, pharmacies, chiropractors, and mental health facilities that conduct standard electronic transactions like billing.
  • Health Plans: Health insurance companies, HMOs, company health plans, and government programs like Medicare and Medicaid.
  • Healthcare Clearinghouses: Entities that process non-standard health data into standard formats (or vice versa).

Business Associates

Business associates are third-party vendors or persons who perform services for or on behalf of a covered entity that involve access to PHI. They include:

  • Medical billing companies and revenue cycle managers.
  • Cloud hosting providers, IT managed service vendors, and data backup companies.
  • Legal, accounting, and consulting firms that access patient data.
  • Subcontractors hired by a business associate to handle PHI.

When HIPAA Doesn't Protect You

9 related questions found

What is considered not a HIPAA violation?

Because you didn't include the specific multiple-choice options from your test, it is not possible to point directly to one answer. However, if this is a standard quiz question, it usually looks like one of the following scenarios:

Scenario 1: A common compliance test question

If your options look like this:

  • ❌ Accessing the health record of family members or friends out of curiosity
  • ❌ Accidentally losing an unencrypted laptop containing patient files
  • 💚 Providing court-ordered health information (or providing a patient with a copy of their own records)

Correct Answer: Providing court-ordered health information or providing a patient with a copy of requested health records within the legal timeframe. HIPAA allows the disclosure of Protected Health Information (PHI) without patient consent for judicial and administrative proceedings if a direct court order is issued. Patients also have a legal right under HIPAA to access their own records.

Scenario 2: Medical training or clinical scenario

If your options look like this:

  • ❌ Leaving patient charts visible at a nurses' station
  • ❌ Discussing a patient's case with a colleague to tell an amusing story
  • 💚 Sharing patient information with another healthcare provider for the purpose of providing treatment

Correct Answer: Sharing information for treatment purposes. Under the HIPAA Privacy Rule, covered entities are fully permitted to share PHI with other doctors, specialists, or nurses who are actively treating the patient to ensure proper care.

Scenario 3: Technology and security scenario

If your options look like this:

  • ❌ Posting about a patient on social media (even without names)
  • ❌ Sending unencrypted patient data over the internet
  • 💚 Sending encrypted patient information across the internet per healthcare organization policy

Correct Answer: Sending encrypted patient information. Using approved, secure communication channels that leverage proper encryption safely protects PHI during transit and meets HIPAA Security Rule standards.

Please reply with your exact multiple-choice options if none of these match, and I will gladly tell you the precise answer!

What is the new HIPAA rule in 2026?

The main new HIPAA requirement for 2026 is updating privacy notices under the HHS Model Notices of Privacy Practices to include stricter protections for substance use disorder (SUD) patient records.

Key 2026 Privacy Rule Updates

  • February 16, 2026 Deadline: Healthcare providers and health plans had to update their Notice of Privacy Practices (NPP).
  • Substance Use Records: Notices must now explain how substance use disorder records are protected under 42 CFR Part 2.
  • Legal Protections: Patient records generally cannot be used in civil or criminal legal cases without explicit consent or a court order.
  • Patient Rights: Patients gained clearer rights to restrict sharing, opt out of fundraising, and file complaints.

Proposed Security Rule Changes (Under Review)

Regulators are also pushing a major update to the HIPAA Security Rule that changes how organizations handle data safety:

  • No More "Addressable" Rules: Optional security steps are becoming mandatory.
  • Mandatory MFA: Multi-factor authentication is required across all systems.
  • Required Encryption: Patient data must be encrypted both in transit and at rest.

Who is not eligible for HIPAA coverage?

HIPAA does not apply to non-covered entities, which include most employers, life insurance companies, schools, and law enforcement agencies.

Entities Excluded from HIPAA

HIPAA only applies to covered entities (health care providers, health plans, and health care clearinghouses) and their business associates. It does not cover:

  • Most Employers: HR departments and employers are generally not bound by HIPAA, even when they collect medical notes or sick leave requests (though other laws like the ADA govern employee data).
  • Life and Property Insurers: Life insurance companies, auto insurers, and workers' compensation carriers do not fall under HIPAA rules.
  • Schools and School Districts: Student health records kept by K-12 schools and universities are protected by FERPA (Family Educational Rights and Privacy Act) instead of HIPAA.
  • Law Enforcement and Courts: Police departments, courts, and correctional facilities are not covered entities just because they hold health information.
  • Consumer Health Apps and Wearables: Fitness trackers and many health apps sold directly to consumers are usually regulated by the FTC (Federal Trade Commission), not HIPAA.

Types of Records Excluded

Even within healthcare settings, HIPAA does not protect:

  • Employment Records: Medical information that an employer holds about its own workers in an employment capacity.
  • De-Identified Data: Health information that has had all personal identifiers removed.
  • Personal Use: An individual sharing or storing their own medical records.

What are the top 10 most common HIPAA violations?

The most common HIPAA violations involve employee snooping, lost or stolen unencrypted devices, and failing to conduct organization-wide risk analyses.

The Health Insurance Portability and Accountability Act (HIPAA) protects patient health information. When healthcare groups or their business partners break these rules, it leads to heavy fines and legal trouble.

Top 10 Most Common HIPAA Violations

  • Employee Snooping: Staff members look at patient files, such as records for coworkers or neighbors, without a valid work reason.
  • Lost or Stolen Devices: Laptops, phones, or USB drives containing unencrypted electronic protected health information (ePHI) go missing in public.
  • Lack of Organization-Wide Risk Analysis: Clinics fail to perform regular security audits to find weak spots in their computer and paper systems.
  • Improper Disposal of Records: Staff throw away paper files with patient data in normal trash or fail to securely wipe old hard drives.
  • Weak Access Controls: Offices use shared passwords, leave computer screens unlocked, or do not use multi-factor authentication.
  • Unauthorized Texting or Emailing: Workers send patient data over regular, unsecured text messages or consumer email apps instead of encrypted platforms.
  • Missing Business Associate Agreements (BAAs): Companies hire outside vendors—like billing firms or cloud software providers—without signing a legal BAA contract.
  • Delayed Breach Notifications: Organizations take longer than the allowed 60 days to report a data breach to the government or affected patients.
  • Inadequate Employee Training: Staff do not receive annual or proper education on how to handle private patient data safely.
  • Denying Patient Record Access: Providers take more than 30 days to give patients copies of their own medical records.

To learn more, you can read the Most Common HIPAA Violations Guide.

Does HIPAA apply to family members?

No, HIPAA does not give family members an automatic or inherent right to access a patient's medical records or health information just because of their relationship.

How HIPAA Relates to Family Members

  • No Automatic Access: Being a spouse, parent, or adult child does not legally grant someone full access to another adult's private health information (PHI).
  • Involvement in Care: Doctors and health plans may share relevant health information with family members or friends if the patient is present, has capacity, and agrees—or does not object—when given the chance.
  • Incapacitated Patients: If a patient is unconscious or not present, a healthcare provider may use professional judgment to share relevant information with family if they believe it is in the patient's best interest.
  • Personal Representatives: A family member only gains full, legal access rights if they are officially designated as a personal representative (such as holding a medical power of attorney or acting as a legal guardian under state law).
  • Family Liability: Family members themselves are not regulated by HIPAA unless they work for a healthcare provider, health plan, or medical clearinghouse. A family member gossiping about a secret you told them directly does not violate HIPAA, though a clinic that improperly hands over records to them does.

You can read more about your rights and rules on Sharing Health Information with Family Members and Friends or visit the official Family Members and Friends Guide from the U.S. Department of Health and Human Services.