{"id":8900,"date":"2024-10-11T08:17:45","date_gmt":"2024-10-11T06:17:45","guid":{"rendered":"https:\/\/stage.usercentrics.com\/?post_type=knowledge&p=8900"},"modified":"2025-06-26T12:21:47","modified_gmt":"2025-06-26T10:21:47","slug":"health-insurance-portability-and-accountability-act-hipaa","status":"publish","type":"knowledge","link":"https:\/\/usercentrics.com\/us\/knowledge-hub\/health-insurance-portability-and-accountability-act-hipaa\/","title":{"rendered":"Health Insurance Portability and Accountability Act (HIPAA): An overview"},"content":{"rendered":"\n

When the Health Insurance Portability and Accountability Act (HIPAA) came into effect in 1996, the law governed a very different information landscape than that of today. Then, individuals did far less online, including relating to their healthcare. We produced less data, especially digitally, so there was less need to regulate access to it and use of it.<\/p>\n\n\n\n

However, today the HIPAA law is more relevant and important than ever, particularly because digital footprints have proliferated, including the ways that people create and disseminate their data \u2014 often without knowing it \u2014 including for healthcare. There are also a startling variety of ways health data can be used, from diagnosis and treatment to online advertising, thus creating an ever-expanding need for clear guidelines and robust protections. <\/p>\n\n\n\n

Here, we look at what HIPAA is, why it\u2019s so relevant today in data privacy, how it\u2019s become interlinked with other regulations, and what its requirements mean for individuals and companies in healthcare and related industries.<\/p>\n\n\n\n

What is the Health Insurance Portability and Accountability Act (HIPAA)?<\/h2>\n\n\n\n

The Health Insurance Portability and Accountability Act (HIPAA)<\/a> is a US federal regulation that was signed into law in 1996, and is managed by the U.S. Department of Health and Human Services. Its purpose is to protect the privacy and security of American citizens\u2019 protected health information. The HIPAA law has been updated several times, most recently in 2020.<\/p>\n\n\n\n

The US does not have a universal healthcare system like the majority of countries in the world, and a significant portion of the regulation\u2019s contents reflect resulting requirements for managing healthcare and how it\u2019s paid for, including through insurance.<\/p>\n\n\n\n

The Act\u2019s main provisions are five \u201cTitles\u201d to protect healthcare data and establish responsibilities for organizations using it. Within Title sections there are also a number of Rules governing access to and use of data, plus security requirements and enforcement. <\/p>\n\n\n\n

HIPAA is designed to protect individuals\u2019 privacy and promote security for healthcare data, but also to increase efficiency in healthcare services and management, and the portability of healthcare information.<\/p>\n\n\n\n

\"Table<\/figure>\n\n\n\n

More about HIPAA Title II: Privacy Rule<\/h4>\n\n\n\n

Within Title II, maybe the most relevant section of HIPAA for data privacy and compliance, and most connected to requirements in other data privacy laws, is the Privacy Rule<\/a>. It addresses the use and disclosure of individuals\u2019 protected health information by organizations, and provides privacy rights for individuals and requirements for them to understand and control the use of their health information. The Privacy Rule also outlines compliance requirements and enforcement.<\/p>\n\n\n\n

Overall, a major goal of the Privacy Rule is to ensure adequate protection of health information, while maintaining the flow of that information as needed to provide quality healthcare and promote health and well-being.<\/p>\n\n\n\n

Key definitions in HIPAA<\/h2>\n\n\n\n

Like all regulations, the terms included in the Definitions section of HIPAA provide a lot of information about the focus of the law and how it views individuals and organizations and the expectations on them.  Below we summarize some of these key definitions.<\/p>\n\n\n\n

Administrative simplification provision<\/h3>\n\n\n\n

This provision refers to any requirement or prohibition established by HIPAA or other relevant regulation, primarily designed to improve standardization and efficiency. It governs how providers, health plans, and clearinghouses must conduct electronic administrative transactions, and sets standards for transmitting electronic health information.<\/p>\n\n\n\n

Business associate<\/h3>\n\n\n\n

A business associate is a person who creates, receives, maintains, or transmits protected health information on behalf of a covered entity, with exceptions. Comparable to a third-party data processor under many data privacy laws.<\/p>\n\n\n\n

Covered entity<\/h3>\n\n\n\n

Refers to:<\/p>\n\n\n\n

    \n
  1. a health plan<\/li>\n\n\n\n
  2. a healthcare clearinghouse<\/li>\n\n\n\n
  3. a healthcare provider who transmits any health information in electronic form in connection with a transaction.<\/li>\n<\/ol>\n\n\n\n

    This definition is comparable to a data controller under many data privacy laws, but in the healthcare context.<\/p>\n\n\n\n

    Disclosure<\/h3>\n\n\n\n

    The release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information. <\/p>\n\n\n\n

    Electronic media<\/h3>\n\n\n\n

    Electronic storage material on which data is or may be recorded digitally, including computer hard drives, external portable drives, or removable\/transportable digital memory media such as memory cards or USB keys.<\/p>\n\n\n\n

    Healthcare clearinghouse<\/h3>\n\n\n\n

    A public or private entity that processes or facilitates processing of health information received from another entity in a nonstandard format or containing nonstandard data content into standard data elements or a standard transaction. Includes billing services, repricing companies, community health management information systems, or community health information systems, or value-added networks and switches.<\/p>\n\n\n\n

    Health information<\/h3>\n\n\n\n

    Any information, including genetic information, whether oral or recorded in any form or medium, that is: <\/p>\n\n\n\n