The four main purposes of HIPAA, the Health Insurance Portability and Accountability Act of 1996, are to protect patient privacy, secure electronic health information, standardize common healthcare transactions, and make health insurance more portable when people change or lose jobs. The law reaches health plans, healthcare clearinghouses, and providers that transmit health information electronically, along with the business associates that handle data for them.
Protecting Patient Privacy
The HIPAA Privacy Rule set the first national standard for how health information can be used and shared. It covers protected health information (PHI), meaning any health data that can identify a specific person: medical records, billing details, lab results, insurance claims, and demographic information tied to a healthcare encounter.
The Privacy Rule gives you concrete rights over that information. Covered entities must let you access and receive copies of your records, with 30 calendar days to respond and one 30-day extension available if records are hard to retrieve. You can request corrections to inaccurate information. You must receive a notice explaining how your information may be used and shared. You can control certain disclosures, such as those for marketing. You can ask for restrictions on how your data is used or shared. And you can request an accounting showing when and why your information was disclosed for certain purposes.1HHS.gov. Your Rights Under HIPAA
When a covered entity does share PHI, it must limit the disclosure to the minimum amount necessary for the task. Disclosures between providers for treatment are exempt, and so are disclosures you specifically authorize, but the “minimum necessary” standard applies to most other uses.2eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information
What HIPAA Does Not Cover
HIPAA is often assumed to protect all health-related data everywhere. It doesn’t. It applies only to covered entities and their business associates. Fitness trackers, downloadable health apps, and most wearables are not covered entities, so the health data they collect falls outside HIPAA. Most elementary and secondary schools also sit outside HIPAA because they don’t bill health plans electronically; student health records kept by a school nurse fall under FERPA instead.3U.S. Department of Health & Human Services. Does the HIPAA Privacy Rule Apply to an Elementary or Secondary School Employers handling employee health information in typical HR contexts are also outside HIPAA’s reach, though a company-sponsored health plan is itself a covered entity.
Securing Electronic Health Information
The HIPAA Security Rule focuses on electronic protected health information (ePHI): PHI that is created, stored, or transmitted digitally. That includes electronic health records, digital lab results, emailed referrals, and online billing systems. The rule requires three categories of safeguards:4HHS.gov. Summary of the HIPAA Security Rule
- Administrative safeguards: policies, procedures, and workforce training that govern how security measures are chosen, developed, and maintained.
- Physical safeguards: controls on physical access to facilities and equipment where ePHI is stored, from locked server rooms to workstation placement.
- Technical safeguards: technology-based protections such as encryption, access controls, audit logs, and automatic session timeouts.
Together these safeguards are meant to protect three things: confidentiality (only authorized people see the data), integrity (no one alters or destroys the data without authorization), and availability (authorized users can reach the data when they need it).
Business Associates
The Security Rule reaches beyond hospitals and insurers. Any vendor that handles ePHI on behalf of a covered entity qualifies as a “business associate” and faces direct liability for compliance. The 2009 HITECH Act made that explicit, extending safeguard and documentation obligations to business associates and subjecting them to the same civil and criminal penalties as covered entities.5U.S. Department of Health & Human Services. Direct Liability of Business Associates
Before a covered entity shares PHI with a vendor, the two must sign a Business Associate Agreement. That contract must spell out what the vendor can do with the information, require appropriate safeguards, require reporting of unauthorized disclosures or breaches, guarantee individual access rights, and require the return or destruction of the information when the contract ends. Subcontractors that touch the data must agree to the same restrictions.6eCFR. 45 CFR 164.504 – Uses and Disclosures: Organizational Requirements
Standardizing Healthcare Transactions
Before HIPAA, every health plan and clearinghouse could use its own format for electronic claims, eligibility checks, and payment processing. Providers often needed different software and workflows for every payer. HIPAA’s Administrative Simplification provisions fixed this by requiring standard formats for key electronic transactions.7eCFR. 45 CFR Part 162 – Administrative Requirements
Standardized transactions include claims and encounter information sent from providers to health plans, eligibility inquiries to check coverage and benefits, referral authorization requests, and electronic funds transfers and remittance advice describing what a plan paid and why.
Administrative Simplification also created standard unique identifiers for entities across the healthcare system. The most visible is the National Provider Identifier (NPI), a 10-digit number assigned to every healthcare provider. Before the NPI, a single doctor might carry dozens of different ID numbers across different payers. Standard employer identifiers were adopted as well.
Making Health Insurance Portable
The “P” in HIPAA stands for portability, and it was the law’s original headline purpose. Title I of HIPAA targeted a specific problem: workers who changed or lost jobs often couldn’t get new coverage because insurers could exclude pre-existing conditions for long periods or deny coverage entirely based on health status.8U.S. Department of Health & Human Services. Summary of the HIPAA Privacy Rule
HIPAA’s fix was partial. It limited pre-existing condition exclusion periods to 12 months, or 18 months for late enrollees, and required insurers to credit time spent under prior coverage toward that waiting period. It also barred health plans from discriminating based on health status when setting premiums or determining eligibility. These protections mattered, but gaps remained, especially in the individual insurance market.
How the ACA Changed the Portability Picture
The Affordable Care Act effectively superseded HIPAA’s portability provisions starting January 1, 2014. Where HIPAA limited how long an insurer could exclude pre-existing conditions, the ACA banned the practice outright. Federal law now provides that a group health plan or individual health insurance issuer “may not impose any preexisting condition exclusion.”9Office of the Law Revision Counsel. 42 U.S. Code 300gg-3 – Prohibition of Preexisting Condition Exclusions Coverage begins on the first day of the plan regardless of medical history. For children under 19, the ban took effect in September 2010. HIPAA’s portability rules remain on the books and would matter again if the ACA’s protections were repealed.
A Related Obligation: Breach Notification
The HITECH Act of 2009 added a breach notification obligation that often gets counted alongside HIPAA’s core purposes. When unsecured PHI is accessed or disclosed without authorization, the covered entity must notify affected individuals no later than 60 calendar days after discovering the breach.10Office of the Law Revision Counsel. 42 USC 17932 – Notification in the Case of Breach If a breach affects 500 or more people in a single state or jurisdiction, the entity must also notify prominent local media within that 60-day window and report the breach to HHS immediately. Smaller breaches can be reported to HHS annually, with the log due within 60 days of the end of the calendar year.11HHS.gov. Breach Notification Rule
Notification letters must be written in plain language and describe what happened, the types of information involved, steps the person should take to protect themselves, what the entity is doing to investigate and prevent future breaches, and contact details including a toll-free number.12eCFR. 45 CFR 164.404 – Notification to Individuals