Who qualifies under HIPAA?

Editorial team Published on

HIPAA applies strictly to covered entities and business associates that handle protected health information.

Covered Entities

These are the primary organizations that provide or pay for medical care and transmit health data electronically:

  • Healthcare providers: Doctors, clinics, dentists, pharmacies, psychologists, chiropractors, and hospitals that conduct standard electronic transactions like billing.
  • Health plans: Health insurance companies, HMOs, company health plans, Medicare, and Medicaid.
  • Healthcare clearinghouses: Entities that process non-standard health data into a standard electronic format (or vice versa).

Business Associates

These are third-party vendors, individuals, or subcontractors that perform services for a covered entity and require access to protected health information:

  • Billing companies, IT providers, and cloud storage services.
  • Accountants, lawyers, and consultants working with patient data.

Who It Does Not Apply To

  • General businesses and employers (unless they sponsor a self-insured group health plan or handle medical data outside standard employment records).
  • Standard employment records, such as sick leave notes, FMLA paperwork, or life insurance records.

What are the three exceptions to HIPAA?

The three specific exceptions under the HIPAA Breach Notification Rule determine whether an unauthorized acquisition, access, or use of Protected Health Information (PHI) constitutes a reportable breach.

The Three Exceptions to a HIPAA Breach

  • Unintentional acquisition, access, or use of PHI: An employee or workforce member accesses PHI unintentionally, in good faith, and within the scope of their authority, without further impermissible disclosure.
  • Inadvertent disclosure between authorized persons: A person authorized to access PHI at a covered entity or business associate accidentally discloses that information to another authorized person within the same organization or arrangement, without further impermissible use.
  • Good faith belief that the recipient could not retain the information: An unauthorized disclosure where the covered entity or business associate has a good faith belief that the unauthorized person who received the PHI could not have reasonably retained it.

What are the 7 patient rights under HIPAA?

Under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, patients have fundamental rights regarding their Protected Health Information (PHI).

The primary patient rights established under HIPAA include:

  • Right to Access and Copy: Patients can inspect and obtain copies of their medical and billing records.
  • Right to Request Amendments: Patients can ask to correct or amend incomplete or inaccurate information in their records.
  • Right to an Accounting of Disclosures: Patients can obtain a list of certain times and reasons a provider or health plan shared their health information.
  • Right to Request Restrictions: Patients can ask providers or health plans to limit how they use or share their health data.
  • Right to Confidential Communications: Patients can request that providers contact them via alternative methods or at alternative locations (such as a work phone instead of a home phone).
  • Right to a Notice of Privacy Practices: Patients have the right to receive a written explanation of how their health information is used and disclosed by a covered entity.
  • Right to File a Complaint: Patients can file a privacy complaint with the health provider's privacy officer or the U.S. Department of Health and Human Services (HHS) Office for Civil Rights if they believe their rights were violated.

What are the 5 main rules of HIPAA?

The five main rules of the Health Insurance Portability and Accountability Act (HIPAA) are the Privacy Rule, Security Rule, Breach Notification Rule, Transactions and Code Sets Rule, and Unique Identifiers Rule.

1. The Privacy Rule

The HIPAA Privacy Rule protects the confidentiality of individual health information and medical records.

  • Controls who can access Protected Health Information (PHI).
  • Gives patients the right to view and get copies of their medical records.
  • Limits how medical data can be shared or disclosed.

2. The Security Rule

The HIPAA Security Rule sets the standards for securing electronic Protected Health Information (ePHI).

  • Requires administrative, physical, and technical safeguards.
  • Protects data storage, systems, and networks from cyber threats.
  • Ensures data integrity and proper user authentication.

3. The Breach Notification Rule

The Breach Notification Rule requires healthcare groups to report compromised patient data.

  • Mandates notifying affected individuals without unreasonable delay (and within 60 days).
  • Requires reporting to the government and, in major cases, the media.

4. The Transactions and Code Sets Rule

The Transactions and Code Sets Rule standardizes electronic healthcare data exchange.

  • Standardizes billing and claims data formats.
  • Uses universal medical codes like ICD-10 and CPT to speed up processing.

5. The Unique Identifiers Rule

The Unique Identifiers Rule assigns universal identification numbers to healthcare participants.

  • Requires a National Provider Identifier (NPI) for healthcare providers.
  • Streamlines identification for employers and health plans.

(Note: The Enforcement Rule and Omnibus Rule are also frequently grouped in as vital updates that outline penalties for non-compliance and extend liability to business partners.)

How do I know if I am HIPAA compliant?

You can determine if you are HIPAA compliant by conducting a formal risk assessment and auditing your organization against the Privacy, Security, and Breach Notification rules using the guidelines provided by the U.S. Department of Health and Human Services.

There is no official government certification or seal that proves absolute HIPAA compliance. Instead, compliance is an ongoing state of meeting federal standards enforced by the HHS Office for Civil Rights (OCR).

Key Steps to Know If You Are Compliant

  • Check if you are a Covered Entity or Business Associate: HIPAA only applies if you are a health plan, a healthcare clearinghouse, a healthcare provider who transmits health data electronically, or a vendor/partner (business associate) handling Protected Health Information (PHI).
  • Perform a Risk Assessment: Review all systems, devices, and cloud platforms where electronic PHI (ePHI) is stored, received, or transmitted.
  • Verify the Three Safeguards: Ensure your organization meets administrative, physical, and technical safeguards. This includes user access controls, proper facility security, employee training, and data encryption.
  • Establish Business Associate Agreements (BAAs): Confirm that all third-party software vendors and service providers handling your data have signed a legal BAA.
  • Review Policies and Procedures: Maintain written documentation of your privacy practices, security measures, and incident response plans for at least six years.

(Note: While some private organizations offer third-party verifications like a "Seal of Compliance," passing a private vendor's course does not constitute a formal federal certification from the government.)

HIPAA Minimum Requirements

9 related questions found

Who does HIPAA not apply to?

HIPAA does not apply to non-covered entities such as employers, life insurers, most schools, and consumer wellness apps.

HIPAA only protects health information held by healthcare providers, health plans, healthcare clearinghouses, and their business associates.

Who Is Not Covered by HIPAA

  • Employers: Human resources and employment records are not regulated by HIPAA, even if your employer is a hospital. Other laws like the ADA may still apply.
  • Life and Disability Insurers: These companies handle health data for underwriting or claims, but they are not traditional health plans.
  • Workers' Compensation Carriers: They process injury claims under state insurance rules rather than HIPAA guidelines.
  • Law Enforcement and Courts: Police departments and courts are exempt. Read more in this A Guide for Law Enforcement.
  • Schools and Universities: Student health records are usually protected by FERPA instead of HIPAA.
  • Consumer Tech and Apps: Fitness trackers, smartwatches, and direct-to-consumer health apps do not fall under HIPAA rules.
  • Individuals: People can share their own medical data freely without breaking HIPAA.

What is the new HIPAA rule in 2026?

The main new HIPAA requirement for 2026 is updating privacy notices under the HHS Model Notices of Privacy Practices to include stricter protections for substance use disorder (SUD) patient records.

Key 2026 Privacy Rule Updates

  • February 16, 2026 Deadline: Healthcare providers and health plans had to update their Notice of Privacy Practices (NPP).
  • Substance Use Records: Notices must now explain how substance use disorder records are protected under 42 CFR Part 2.
  • Legal Protections: Patient records generally cannot be used in civil or criminal legal cases without explicit consent or a court order.
  • Patient Rights: Patients gained clearer rights to restrict sharing, opt out of fundraising, and file complaints.

Proposed Security Rule Changes (Under Review)

Regulators are also pushing a major update to the HIPAA Security Rule that changes how organizations handle data safety:

  • No More "Addressable" Rules: Optional security steps are becoming mandatory.
  • Mandatory MFA: Multi-factor authentication is required across all systems.
  • Required Encryption: Patient data must be encrypted both in transit and at rest.

What are the 10 most common HIPAA violations?

The 10 most common HIPAA violations involve mishandling protected health information (PHI) through employee error, weak security, or administrative oversight.

Top 10 Most Common Violations

  • Employee Snooping: Accessing patient files, family records, or coworker charts without a direct, professional need to know.
  • Lost or Stolen Devices: Leaving unencrypted laptops, smartphones, tablets, or USB drives where they can be stolen or accessed by outsiders.
  • Failure to Conduct Risk Analyses: Neglecting regular, organization-wide checkups to find and fix security gaps.
  • Improper Disposal of Records: Tossing paper charts in regular trash or failing to securely wipe old hard drives.
  • Weak Passwords and Access Controls: Using simple passwords or giving too many staff members broad, unmonitored access to electronic records (ePHI).
  • Unauthorized Texting or Emailing: Sending patient details over regular, unsecured text messages or standard email instead of encrypted platforms.
  • Missing Business Associate Agreements (BAAs): Failing to sign legal BAA contracts with outside vendors and cloud providers who handle patient data.
  • Delayed Breach Notifications: Missing the legal deadline to notify patients, the government, and the media within 60 days of discovering a data breach.
  • Inadequate Employee Training: Not providing regular, documented privacy and security awareness education for staff.
  • Denying or Delaying Patient Access: Taking longer than allowed (or refusing outright) to give patients copies of their own medical records.

Can HIPAA be violated by a patient?

No, a patient cannot violate the Health Insurance Portability and Accountability Act (HIPAA) because the law only applies to covered entities and their business associates.

Who HIPAA Applies To

  • Covered Entities: Healthcare providers, health plans, and healthcare clearinghouses.
  • Business Associates: Contractors or organizations that perform services involving protected health information on behalf of a covered entity.

Why Patients Are Exempt

  • Patients own their own medical records and can share their personal health information with anyone they choose.
  • If a patient posts about their own medical diagnosis, talks about another patient, or shares someone else's medical details publicly, it is not a legal violation of HIPAA.
  • However, if a patient works as a healthcare employee and improperly accesses or shares records using their professional access, they can be held liable under HIPAA as a member of the workforce.

What are the four most common HIPAA violations?

The four most common HIPAA violations are unauthorized access or "snooping" on patient records, failure to perform organization-wide risk analyses, improper disposal of protected health information (PHI), and insufficient staff training.

1. Unauthorized Access and Snooping

  • What it is: Staff members viewing patient charts, medical histories, or billing information without a legitimate, job-related reason to do so.
  • Example: An employee looking up the health records of a coworker, family member, or local celebrity out of curiosity.

2. Failure to Conduct Risk Analyses

  • What it is: Healthcare organizations neglecting to run systematic, comprehensive audits of their physical and digital environments to find security gaps.
  • Example: Failing to document vulnerabilities in software systems or electronic health record (EHR) portals before a breach occurs.

3. Improper Disposal of PHI

  • What it is: Throwing away paper records or electronic media that contain identifiable patient data without rendering them completely unreadable.
  • Example: Tossing un-shredded patient intake sheets, prescription bottles, or old computer hard drives directly into regular office trash or recycling bins.

4. Insufficient Employee Training

  • What it is: Failing to provide regular, documented HIPAA compliance and security awareness education to staff members.
  • Example: Onboarding a new medical receptionist without teaching them how to safely handle physical files or spot phishing emails.

You can review official government oversight details through the U.S. Department of Health and Human Services enforcement highlights.