HIPAA essentials

In one line

HIPAA is the US law that sets a floor for protecting PHI (protected health information). Its two pillars: the Privacy Rule (how PHI may be used and disclosed) and the Security Rule (safeguards for electronic PHI).

Who it covers

Covered entities (providers, health plans, clearinghouses) and their business associates (vendors handling PHI on their behalf, bound by a BAA). If you build a tool that touches real patient data for a US provider, you're almost certainly in scope.

The rules that bite

• Minimum necessary — access and disclose only what the task requires. A billing coder doesn't need psychotherapy notes.
• Permitted purposes — treatment, payment, operations need no extra authorisation; marketing and most other uses do.
• Safeguards — administrative, physical and technical (access controls, audit logs, encryption). Encryption to standard creates a safe harbor for breach notification.
• Breach notification — notify affected individuals (and HHS) without unreasonable delay, within 60 days; ≥500 affected triggers immediate HHS notice and media.

Practise it

The Audit & Compliance lab lets you rule on access-log violations, run a breach-notification calculator (HIPAA + DPDP

• GDPR), and de-identify a dataset to Safe Harbor.

Watch for

HIPAA is a floor, not a ceiling — states (and other countries) add more, and security best practice (like zero trust) goes well beyond it. Compliance is necessary, not sufficient, for actually being trustworthy.

Common pitfalls

• "De-identified" that isn't — stripping the name leaves quasi-identifiers; do it properly.
• Forgetting the BAA — a vendor touching PHI without a Business Associate Agreement is a violation in itself.
• PHI in logs — debug logs, analytics and crash reports quietly collect PHI; govern them too.
• Treating encryption as optional — encryption to standard is what creates the breach safe harbor.

Key takeaways

• HIPAA protects PHI via the Privacy (use/disclosure), Security (ePHI safeguards) and Breach rules.
• It covers covered entities + business associates (BAA); minimum necessary governs access.
• Breach: notify within 60 days; ≥500 affected escalates to HHS + media.
• It's a floor, not a ceiling — pair it with practices like zero trust and DPDP for cross-border work.