What is HIPAA (Health Insurance Portability and Accountability Act)?
HIPAA is a US federal law that establishes national standards for protecting the privacy and security of individuals' health information, applying to covered entities and their business associates.
The Health Insurance Portability and Accountability Act (HIPAA) is a US federal law enacted in 1996 that establishes national standards for the protection of individually identifiable health information, known as Protected Health Information (PHI). HIPAA applies to covered entities (health plans, healthcare clearinghouses, and healthcare providers who conduct certain electronic transactions) and their business associates (organizations that perform functions or activities involving PHI on behalf of covered entities).
HIPAA consists of several rules: the Privacy Rule establishes standards for the use and disclosure of PHI; the Security Rule sets standards for safeguarding electronic PHI (ePHI) through administrative, physical, and technical safeguards; the Breach Notification Rule requires notification of breaches of unsecured PHI; and the Enforcement Rule establishes procedures for investigations and penalties. The Privacy Rule permits use and disclosure of PHI for treatment, payment, and healthcare operations without individual authorization, while most other uses require written authorization.
The Office for Civil Rights (OCR) within the Department of Health and Human Services enforces HIPAA, with penalties ranging from $100 to $50,000 per violation, up to $1.5 million per year for each violation category. Criminal penalties can also apply. Organizations handling PHI can leverage IQWorks to identify and protect health information across systems using DiscoverIQ for locating PHI and ProtectIQ for implementing appropriate safeguards.
How IQWorks Helps
Related Terms
Protected Health Information (PHI)
PHI is individually identifiable health information held or transmitted by a covered entity or its business associate, protected under HIPAA regulations.
Personally Identifiable Information (PII)
PII is any information that can be used to identify a specific individual, including names, addresses, email addresses, phone numbers, Social Security numbers, and biometric data.
Data Encryption
Encryption transforms readable data into an unreadable format using cryptographic algorithms, protecting confidentiality by ensuring only authorized parties with the correct key can access the data.
Access Control
Access control restricts who can view, modify, or delete data based on identity, role, and authorization policies, ensuring only authorized personnel access personal data.
Data Breach Notification
Data breach notification is the legal requirement for organizations to inform supervisory authorities and affected individuals when a security incident results in unauthorized access to, or loss of, personal data.