HIPAA, the United States rules protecting health information

It applies to covered entities and their business associates, and to nobody else merely because they handle health data. A covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a transaction for which the Department of Health and Human Services has adopted a standard, such as a claim for payment. A business associate is a person or organisation that creates, receives, maintains or transmits protected health information on a covered entity's behalf, and a subcontractor doing the same for a business associate is one too. The definitions are in section 160.103 of title 45 of the Code of Federal Regulations, and sections 164.104 and 164.302 extend the Security Rule to both.

It is federal regulation made under the Health Insurance Portability and Accountability Act of 1996, and it applies throughout the United States, with state law that protects health information more strictly able to add to it. Part 164 holds the three rules a security team meets: the Security Rule in Subpart C, setting administrative, physical and technical safeguards for electronic protected health information; the breach notification rule in Subpart D; and the Privacy Rule in Subpart E, which limits how protected health information may be used and disclosed. There is no certification. The Department certifies and endorses no one, so a certificate offered as proof of compliance was issued by a private party and binds nobody.

The Department's Office for Civil Rights enforces it. It investigates complaints and breach reports, carries out compliance reviews, and can impose civil money penalties or settle with a corrective action plan. Since the Health Information Technology for Economic and Clinical Health Act (HITECH Act) of 2009, state attorneys general can also bring civil actions in federal court on behalf of their state's residents.

A supplier outside the United States is caught the same way as one inside it, by what it does. A software or hosting company in the European Union that handles protected health information for a United States covered entity is a business associate, and will be asked to sign a business associate agreement before it receives any data.

The Security Rule may change, but has not yet. The Department published a proposed rule in the Federal Register on 6 January 2025, at 90 FR 898, that would remove the distinction between required and addressable implementation specifications and add specific duties, among them an asset inventory, encryption and multi-factor authentication. It is a proposal and creates no obligation; the rule in force is the current text. The government's most recent Unified Agenda of regulatory actions lists final action as a long-term item, dated July 2027.

The common error runs both ways. Handling health information does not by itself bring an organisation under these rules: a consumer fitness or wellness app that people use on their own account, with no covered entity behind it, is generally outside them, although other federal and state law may reach it. And a business associate agreement does not make a vendor compliant. It is a contract the rules require, setting out what the vendor may do with the information; the vendor is directly liable for meeting the Security Rule whatever the contract says, and signing one is no evidence that it does.