What Is HIPAA? A Plain-English Explanation (2026)

By ComplyCreate Editorial Team  ·  Published Apr 24, 2026  ·  Last reviewed Apr 24, 2026

The Health Insurance Portability and Accountability Act — enacted by Congress in 1996 and significantly strengthened by the HITECH Act in 2009 — is the primary federal law governing the privacy and security of protected health information (PHI) in the United States. Despite its name, HIPAA's most impactful provisions are not about portability or insurance — they are about privacy and security.

For healthcare providers, health plans, and the technology companies that serve them, understanding what HIPAA requires is not optional. Violations can result in civil penalties up to $1.9 million per year per provision category and, in cases of willful neglect, criminal referral to the Department of Justice.

Who Does HIPAA Apply To?

HIPAA applies to two categories of organizations:

Covered Entities

Under 45 CFR § 160.103, a covered entity is any of the following:

• Healthcare providers that conduct certain transactions electronically — including hospitals, physician practices, dental offices, chiropractors, physical therapists, mental health counselors, and pharmacies
• Health plans — insurance companies, HMOs, Medicare and Medicaid programs, and employer-sponsored health plans with 50 or more participants
• Healthcare clearinghouses — entities that translate nonstandard health information into standard formats for billing

Business Associates

A business associate is any person or entity that performs functions involving access to PHI on behalf of a covered entity. Following HITECH, business associates are directly subject to HIPAA's Security Rule and many Privacy Rule provisions. Common business associates include EHR vendors, medical billing companies, cloud storage providers, and IT support firms. See our dedicated guide on HIPAA business associates for a full breakdown.

What Are the Five HIPAA Rules?

HIPAA is not a single rule — it is a set of five related regulations:

What Is Protected Health Information (PHI)?

Protected health information is any individually identifiable health information held or transmitted by a covered entity or business associate — in any form (electronic, paper, or oral). HIPAA identifies 18 categories of identifiers that, when combined with health data, create PHI. These include names, dates (other than year), geographic subdivisions smaller than state, phone numbers, email addresses, Social Security numbers, medical record numbers, and biometric identifiers. See our full guide on PHI and the 18 identifiers.

What Does HIPAA Actually Require?

The practical requirements of HIPAA fall into several areas:

Privacy Rule — what you can and cannot do with PHI

The Privacy Rule (45 CFR §§ 164.500–164.534) limits when and how covered entities may use or disclose PHI. In general, a covered entity may only use or disclose PHI: (1) for treatment, payment, or healthcare operations; (2) to the individual; (3) with a valid written authorization; or (4) under one of the specific permitted disclosures listed in § 164.512 (public health, law enforcement, required by law, etc.).

The Privacy Rule also grants patients affirmative rights: the right to access and obtain copies of their health records (§ 164.524), the right to request amendments (§ 164.526), the right to an accounting of disclosures (§ 164.528), and the right to receive a Notice of Privacy Practices (§ 164.520). The NPP is a patient-facing document covered entities are required to provide — and it must reflect the HHS February 2026 model language.

Security Rule — safeguards for electronic PHI

The Security Rule (45 CFR §§ 164.302–164.318) applies only to electronic PHI (ePHI). It requires covered entities and business associates to implement administrative, physical, and technical safeguards. The rule is deliberately flexible — it specifies "required" and "addressable" implementation specifications rather than mandating specific technologies. The one non-negotiable: a documented Security Risk Analysis under § 164.308(a)(1), which assesses vulnerabilities to ePHI confidentiality, integrity, and availability. For a walkthrough, see our guide on HIPAA risk assessments.

Breach Notification Rule — what to do when things go wrong

Under 45 CFR § 164.400 et seq., when unsecured PHI is breached, covered entities must notify affected individuals within 60 days, notify HHS, and (for breaches affecting 500+ individuals in a state) notify prominent media outlets. Business associates must notify covered entities within 60 days of discovering a breach. The definition of "breach" is presumptive: if PHI is impermissibly accessed, used, or disclosed, it is a breach unless the covered entity can demonstrate a low probability that PHI was compromised.

Business Associate Agreements — mandatory vendor contracts

Any covered entity that shares PHI with a business associate must have a signed Business Associate Agreement (BAA) in place before the sharing begins. The BAA must contain the provisions specified in 45 CFR § 164.504(e), including permitted uses, safeguard obligations, and breach notification timelines. Operating without a required BAA is an independent HIPAA violation regardless of whether a breach occurs.

How HITECH Changed HIPAA

The Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 — and the implementing Omnibus Rule of 2013 — made three major changes: it extended direct HIPAA liability to business associates (previously they were only indirectly regulated through BAAs); it significantly raised the civil penalty ceiling; and it changed the standard for "harm threshold" in breach notification to a stricter low-probability standard. See our guide on the HITECH Act for a full explanation.

HIPAA and State Law

HIPAA preempts state law — except where state law is more protective of individual privacy. Many states have enacted health privacy statutes that exceed HIPAA in specific areas: California's Confidentiality of Medical Information Act (CMIA), the Washington My Health My Data Act, and Texas Health & Safety Code Chapter 181 are prominent examples. If your organization operates across multiple states, you must track the strictest applicable standard. See our guide on HIPAA vs. state privacy laws.

Frequently Asked Questions