Who is subject to HIPAA rules?

Editorial team Published on

HIPAA applies strictly to covered entities and business associates that handle protected health information.

Covered Entities

These are the primary organizations that provide or pay for medical care and transmit health data electronically:

  • Healthcare providers: Doctors, clinics, dentists, pharmacies, psychologists, chiropractors, and hospitals that conduct standard electronic transactions like billing.
  • Health plans: Health insurance companies, HMOs, company health plans, Medicare, and Medicaid.
  • Healthcare clearinghouses: Entities that process non-standard health data into a standard electronic format (or vice versa).

Business Associates

These are third-party vendors, individuals, or subcontractors that perform services for a covered entity and require access to protected health information:

  • Billing companies, IT providers, and cloud storage services.
  • Accountants, lawyers, and consultants working with patient data.

Who It Does Not Apply To

  • General businesses and employers (unless they sponsor a self-insured group health plan or handle medical data outside standard employment records).
  • Standard employment records, such as sick leave notes, FMLA paperwork, or life insurance records.

Who is subject to the HIPAA privacy rule?

The HIPAA Privacy Rule applies to covered entities and their business associates.

Covered Entities

The rule covers three main types of organizations and practitioners:

  • Health care providers: Doctors, clinics, dentists, pharmacies, psychologists, nursing homes, and hospitals that transmit any health information electronically in connection with standard transactions like billing.
  • Health plans: Health insurance companies, HMOs, company health plans, and government programs like Medicare and Medicaid.
  • Health care clearinghouses: Entities that process nonstandard health data into standard electronic formats, or the reverse.

Business Associates

  • Definition: Any person or company (other than a member of a covered entity's workforce) that performs services or activities involving protected health information on behalf of a covered entity.
  • Examples: Billing companies, cloud storage vendors, IT providers, legal consultants, accounting firms, and document shredding services.
  • Liability: Business associates have direct legal liability to protect health data under HIPAA.

What are the 7 patient rights under HIPAA?

Under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, patients have fundamental rights regarding their Protected Health Information (PHI).

The primary patient rights established under HIPAA include:

  • Right to Access and Copy: Patients can inspect and obtain copies of their medical and billing records.
  • Right to Request Amendments: Patients can ask to correct or amend incomplete or inaccurate information in their records.
  • Right to an Accounting of Disclosures: Patients can obtain a list of certain times and reasons a provider or health plan shared their health information.
  • Right to Request Restrictions: Patients can ask providers or health plans to limit how they use or share their health data.
  • Right to Confidential Communications: Patients can request that providers contact them via alternative methods or at alternative locations (such as a work phone instead of a home phone).
  • Right to a Notice of Privacy Practices: Patients have the right to receive a written explanation of how their health information is used and disclosed by a covered entity.
  • Right to File a Complaint: Patients can file a privacy complaint with the health provider's privacy officer or the U.S. Department of Health and Human Services (HHS) Office for Civil Rights if they believe their rights were violated.

What are the 5 main rules of HIPAA?

The five main rules of the Health Insurance Portability and Accountability Act (HIPAA) are the Privacy Rule, Security Rule, Breach Notification Rule, Transactions and Code Sets Rule, and Unique Identifiers Rule.

1. The Privacy Rule

The HIPAA Privacy Rule protects the confidentiality of individual health information and medical records.

  • Controls who can access Protected Health Information (PHI).
  • Gives patients the right to view and get copies of their medical records.
  • Limits how medical data can be shared or disclosed.

2. The Security Rule

The HIPAA Security Rule sets the standards for securing electronic Protected Health Information (ePHI).

  • Requires administrative, physical, and technical safeguards.
  • Protects data storage, systems, and networks from cyber threats.
  • Ensures data integrity and proper user authentication.

3. The Breach Notification Rule

The Breach Notification Rule requires healthcare groups to report compromised patient data.

  • Mandates notifying affected individuals without unreasonable delay (and within 60 days).
  • Requires reporting to the government and, in major cases, the media.

4. The Transactions and Code Sets Rule

The Transactions and Code Sets Rule standardizes electronic healthcare data exchange.

  • Standardizes billing and claims data formats.
  • Uses universal medical codes like ICD-10 and CPT to speed up processing.

5. The Unique Identifiers Rule

The Unique Identifiers Rule assigns universal identification numbers to healthcare participants.

  • Requires a National Provider Identifier (NPI) for healthcare providers.
  • Streamlines identification for employers and health plans.

(Note: The Enforcement Rule and Omnibus Rule are also frequently grouped in as vital updates that outline penalties for non-compliance and extend liability to business partners.)

Who is responsible for HIPAA rules?

The U.S. Department of Health and Human Services (HHS), specifically through the Office for Civil Rights (OCR), is primarily responsible for enforcing HIPAA regulations.

Responsibility for HIPAA is divided between the agencies that enforce the law and the organizations required to follow it.

Who Enforces HIPAA

  • Office for Civil Rights (OCR): Investigates complaints, conducts audits, and imposes civil penalties for privacy and security violations.
  • Department of Justice (DOJ): Handles criminal violations of HIPAA, such as knowingly misusing patient data for personal gain.
  • State Attorneys General: Can enforce HIPAA rules and file civil lawsuits on behalf of state residents.

Who Must Comply with HIPAA

  • Covered Entities: Directly responsible organizations include healthcare providers (doctors, clinics, hospitals), health insurance plans, and healthcare clearinghouses.
  • Business Associates: Vendors, contractors, and third-party service providers that handle protected health information on behalf of covered entities are also directly liable.
  • Internal Officers: Covered entities and business associates must appoint designated privacy and security officers to oversee compliance.
  • Individual Employees: Staff members can face personal liability or penalties if they willfully break privacy and security rules.

What is HIPAA and its three main rules

9 related questions found

Who is subject to HIPAA requirements?

HIPAA requirements apply strictly to covered entities and business associates that create, receive, store, or transmit protected health information.

Covered Entities

Covered entities are direct providers of healthcare, payers, or data processors. They include:

  • Healthcare Providers: Doctors, clinics, dentists, pharmacies, psychologists, and hospitals that transmit health data electronically for standard transactions like billing.
  • Health Plans: Health insurance companies, HMOs, company health plans, Medicare, and Medicaid.
  • Healthcare Clearinghouses: Entities that process non-standard health data into standard electronic formats (or vice versa).

Business Associates

Business associates are vendors or persons who perform services for or on behalf of a covered entity—or another business associate—that involve access to protected health information. They include:

  • Medical billing companies and revenue management firms
  • Cloud hosting providers, IT support, and data backup vendors
  • Software vendors (SaaS) and electronic health record systems
  • Legal, accounting, or consulting firms handling patient data
  • Subcontractors hired by business associates to handle data

Common Exemptions

Many organizations that handle personal data are not subject to HIPAA, including:

  • Most employers (regarding standard employment records)
  • Life insurers and workers' compensation carriers
  • Most schools and law enforcement agencies (which fall under FERPA or other laws)
  • Consumer wellness apps and fitness trackers not acting on behalf of a covered entity

What is the new HIPAA rule in 2026?

The main new HIPAA requirement for 2026 is updating privacy notices under the HHS Model Notices of Privacy Practices to include stricter protections for substance use disorder (SUD) patient records.

Key 2026 Privacy Rule Updates

  • February 16, 2026 Deadline: Healthcare providers and health plans had to update their Notice of Privacy Practices (NPP).
  • Substance Use Records: Notices must now explain how substance use disorder records are protected under 42 CFR Part 2.
  • Legal Protections: Patient records generally cannot be used in civil or criminal legal cases without explicit consent or a court order.
  • Patient Rights: Patients gained clearer rights to restrict sharing, opt out of fundraising, and file complaints.

Proposed Security Rule Changes (Under Review)

Regulators are also pushing a major update to the HIPAA Security Rule that changes how organizations handle data safety:

  • No More "Addressable" Rules: Optional security steps are becoming mandatory.
  • Mandatory MFA: Multi-factor authentication is required across all systems.
  • Required Encryption: Patient data must be encrypted both in transit and at rest.

What are the 10 most common HIPAA violations?

The 10 most common HIPAA violations involve mishandling protected health information (PHI) through employee error, weak security, or administrative oversight.

Top 10 Most Common Violations

  • Employee Snooping: Accessing patient files, family records, or coworker charts without a direct, professional need to know.
  • Lost or Stolen Devices: Leaving unencrypted laptops, smartphones, tablets, or USB drives where they can be stolen or accessed by outsiders.
  • Failure to Conduct Risk Analyses: Neglecting regular, organization-wide checkups to find and fix security gaps.
  • Improper Disposal of Records: Tossing paper charts in regular trash or failing to securely wipe old hard drives.
  • Weak Passwords and Access Controls: Using simple passwords or giving too many staff members broad, unmonitored access to electronic records (ePHI).
  • Unauthorized Texting or Emailing: Sending patient details over regular, unsecured text messages or standard email instead of encrypted platforms.
  • Missing Business Associate Agreements (BAAs): Failing to sign legal BAA contracts with outside vendors and cloud providers who handle patient data.
  • Delayed Breach Notifications: Missing the legal deadline to notify patients, the government, and the media within 60 days of discovering a data breach.
  • Inadequate Employee Training: Not providing regular, documented privacy and security awareness education for staff.
  • Denying or Delaying Patient Access: Taking longer than allowed (or refusing outright) to give patients copies of their own medical records.

Which are the four rules of HIPAA?

The four core rules of HIPAA (Health Insurance Portability and Accountability Act) are the Privacy Rule, the Security Rule, the Breach Notification Rule, and the Enforcement Rule.

1. The Privacy Rule

  • What it does: Protects all medical records and other individually identifiable health information (called Protected Health Information or PHI).
  • Key details: Gives patients the right to see, get copies of, and correct their health records. It also limits how healthcare providers and insurers can share this private data.

2. The Security Rule

  • What it does: Sets rules specifically for electronic protected health information (known as ePHI).
  • Key details: Requires administrative, physical, and technical safeguards. Organizations must keep digital medical data safe, confidential, and secure from hackers or unauthorized access.

3. The Breach Notification Rule

  • What it does: Tells organizations what to do if patient data is stolen, lost, or exposed.
  • Key details: Requires healthcare groups to notify affected patients within 60 days of finding a data breach. If a breach affects more than 500 people, the government and media must also be told.

4. The Enforcement Rule

  • What it does: Explains how the government investigates violations and handles complaints.
  • Key details: Sets the financial penalties and fines for organizations that break HIPAA laws.

Does HIPAA apply to family members?

No, HIPAA does not give family members an automatic or inherent right to access a patient's medical records or health information just because of their relationship.

How HIPAA Relates to Family Members

  • No Automatic Access: Being a spouse, parent, or adult child does not legally grant someone full access to another adult's private health information (PHI).
  • Involvement in Care: Doctors and health plans may share relevant health information with family members or friends if the patient is present, has capacity, and agrees—or does not object—when given the chance.
  • Incapacitated Patients: If a patient is unconscious or not present, a healthcare provider may use professional judgment to share relevant information with family if they believe it is in the patient's best interest.
  • Personal Representatives: A family member only gains full, legal access rights if they are officially designated as a personal representative (such as holding a medical power of attorney or acting as a legal guardian under state law).
  • Family Liability: Family members themselves are not regulated by HIPAA unless they work for a healthcare provider, health plan, or medical clearinghouse. A family member gossiping about a secret you told them directly does not violate HIPAA, though a clinic that improperly hands over records to them does.

You can read more about your rights and rules on Sharing Health Information with Family Members and Friends or visit the official Family Members and Friends Guide from the U.S. Department of Health and Human Services.