HIPAA has five titles. The Health Insurance Portability and Accountability Act of 1996 is best known for medical privacy, but privacy is only one piece of one title. The other four cover insurance portability when you change jobs, tax-advantaged medical savings, group health plan protections, and federal revenue provisions that pay for the rest of the law.
Title I: Health Care Access, Portability, and Renewability
Title I was written to help workers keep health coverage when they change or lose a job. In 1996, insurers could refuse to cover pre-existing conditions for up to 12 months after a person enrolled in a new group plan. Title I capped that exclusion and created a credit system: if you maintained continuous coverage without a gap of more than 63 days, your prior coverage counted toward reducing or eliminating any waiting period at the new plan.1GovInfo. Health Insurance Portability and Accountability Act of 1996 Public Law 104-191
Title I also created special enrollment rights. Gaining a dependent through birth, adoption, or marriage lets you enroll that person outside the normal open enrollment window. Insurers were barred from charging higher premiums to individual employees based on health status, genetic information, or claims history.
Much of Title I’s original framework has since been superseded. Since 2014, the Affordable Care Act has banned pre-existing condition exclusions in group and individual plans entirely, so the 12-month cap and 63-day gap rule are no longer the operative limits.2Office of the Law Revision Counsel. 42 USC 300gg-3 Prohibition of Preexisting Condition Exclusions Title I’s portability and special enrollment protections still stand.
Title II: Preventing Health Care Fraud and Administrative Simplification
Title II is the longest and most widely discussed part of HIPAA. Its full heading — “Preventing Health Care Fraud and Abuse; Administrative Simplification; Medical Liability Reform” — signals three purposes, though the administrative simplification piece is what most people mean when they say “HIPAA.”1GovInfo. Health Insurance Portability and Accountability Act of 1996 Public Law 104-191
Fraud and Abuse Prevention
Title II created the Health Care Fraud and Abuse Control Program, a joint HHS and Department of Justice effort to investigate and prosecute healthcare fraud. It also established new federal crimes covering healthcare fraud schemes, theft or embezzlement from health care programs, and false statements in healthcare transactions. These provisions reach both public programs like Medicare and Medicaid and private insurance.
Privacy, Security, and Breach Notification
The administrative simplification provisions directed HHS to adopt national standards for electronic healthcare transactions and unique identifiers for providers, employers, and health plans.3Office of the Law Revision Counsel. 42 USC 1320d-2 Standards for Information Transactions and Data Elements That authority produced the three regulations the public associates with HIPAA:
- The Privacy Rule, which governs how organizations use and disclose protected health information in electronic, paper, or oral form, and gives patients rights over their records.
- The Security Rule, which requires physical, technical, and administrative safeguards for electronic health records, including access controls, automatic logoff, and encryption.
- The Breach Notification Rule, which requires notice to affected individuals within 60 days of discovering a breach of unsecured health information. Breaches affecting 500 or more people in a state also trigger media notification and immediate HHS reporting.4HHS.gov. Breach Notification Rule
Title II is also where the National Provider Identifier comes from, a 10-digit number assigned to every healthcare provider for use in standardized electronic transactions.
Who Title II Applies To
The privacy and security requirements apply to three categories of “covered entities” — health plans, healthcare clearinghouses, and healthcare providers that transmit health information electronically — and to the business associates that handle protected health information on their behalf, such as billing companies, IT contractors, and cloud storage providers.5eCFR. 45 CFR 160.103 Definitions
A lot of organizations that hold health-related data are not covered. Employers holding employee medical information as employers, life insurers, workers’ compensation carriers, most schools, and consumer fitness apps generally fall outside HIPAA. State privacy laws may reach them, but the federal rules do not.
Penalties and Enforcement
The Office for Civil Rights at HHS enforces the civil penalty structure, which runs in four tiers based on culpability, from “did not know” up to “willful neglect, not corrected.” Amounts are adjusted annually for inflation and, as of January 2026, top out at $2,190,294 per violation category per year.6Federal Register. Annual Civil Monetary Penalties Inflation Adjustment Criminal prosecution is handled by the Department of Justice, with fines up to $250,000 and prison terms up to 10 years for offenses committed for commercial advantage, personal gain, or malicious harm.7Office of the Law Revision Counsel. 42 USC 1320d-6 Wrongful Disclosure of Individually Identifiable Health Information
One boundary worth knowing: HIPAA does not let you sue a provider or insurer directly. Federal courts have held that HIPAA creates no private right of action, and enforcement authority sits with the Secretary of HHS.8U.S. Court of Appeals for the Fifth Circuit. Acara v. Banks, No. 06-30356 The federal remedy is a complaint to the Office for Civil Rights. A state medical privacy law may allow a private lawsuit depending on where you live.
Title III: Tax-Related Health Provisions
Title III created tax incentives to help people pay for medical care. Its signature provision was the Archer Medical Savings Account, a pre-tax account for qualified medical expenses available to self-employed individuals and employees at businesses with 50 or fewer workers, paired with a high-deductible health plan.1GovInfo. Health Insurance Portability and Accountability Act of 1996 Public Law 104-191
Archer MSAs were largely overtaken by Health Savings Accounts, which Congress created in 2003 with broader eligibility. For 2026, the annual HSA contribution limit is $4,400 for self-only coverage and $8,750 for family coverage under a high-deductible plan.9Internal Revenue Service. Revenue Procedure 2025-19 Distributions used for qualified medical expenses remain tax-free under both account types.
Title III also set the schedule that eventually took the health insurance deduction for self-employed workers up to a full 100 percent of premiums, making individual coverage far more affordable on an after-tax basis.10ASPE. Health Insurance Portability and Accountability Act of 1996
Title IV: Group Health Plan Requirements
Title IV extends Title I with detailed rules on how group health plans must treat employees and dependents. Group plans cannot discriminate against individual participants based on health status, medical history, genetic information, disability, or evidence of insurability. The protection covers both eligibility and the premium charged to individual employees within a group.
Title IV also amended the Consolidated Omnibus Budget Reconciliation Act (COBRA), which lets workers who lose their jobs continue employer-sponsored coverage temporarily by paying the full premium. HIPAA clarified how COBRA interacts with Title I’s portability rules so that time on COBRA counts as prior coverage when a person later joins a new group plan.11Centers for Medicare and Medicaid Services. COBRA Continuation Coverage
Title V: Revenue Offsets
Title V is the funding side of the law. It amends the Internal Revenue Code to raise revenue that offsets the cost of Titles I through IV. Two provisions do most of the work.
The first targets company-owned life insurance. Before HIPAA, businesses could deduct interest on loans taken against life insurance policies covering their employees. Section 501 of the act amended IRC Section 264(a) to deny most of those deductions, with a narrow exception for policies covering “key persons” and a cap tied to corporate bond yields.1GovInfo. Health Insurance Portability and Accountability Act of 1996 Public Law 104-191
The second is the expatriation tax. Someone treated as a “covered expatriate” when giving up U.S. citizenship or long-term residency is taxed as if they had sold all of their property at fair market value the day before expatriation. Gains above an inflation-adjusted exclusion (originally $600,000) are subject to income tax, and deferred compensation and certain trust distributions carry a 30 percent withholding rate.12Office of the Law Revision Counsel. 26 USC 877A Tax Responsibilities of Expatriation