HIPAA Requirements: Complete Guide to Healthcare Data Protection
The Health Insurance Portability and Accountability Act (HIPAA) protects the privacy and security of Protected Health Information (PHI) in the United States. HIPAA applies to covered entities (healthcare providers, health plans, healthcare clearinghouses) and their business associates. The three main rules are the Security Rule, Privacy Rule, and Breach Notification Rule. Violations can result in fines from $100 to $50,000 per violation, up to $1.5 million per year.
Table of Contents
Security Rule — Administrative Safeguards (SS 164.308)
Administrative actions, policies, and procedures to manage the development, implementation, and maintenance of security measures to protect electronic PHI (ePHI).
Security Management Process
You must implement policies and procedures to prevent, detect, contain, and correct security violations. This includes conducting a thorough risk analysis and implementing a risk management program to reduce risks to a reasonable level.
Assigned Security Responsibility
You must designate a security official responsible for developing and implementing security policies. This person is accountable for your organization HIPAA security compliance.
Workforce Security
You must have policies ensuring that workforce members have appropriate access to ePHI based on their role, and that access is terminated when employment ends. This includes authorization, supervision, and clearance procedures.
Information Access Management
You must implement policies for authorizing access to ePHI. This includes procedures for granting access based on need-to-know, access establishment, and access modification when roles change.
Security Awareness and Training
You must implement a security awareness and training program for all workforce members. This includes training on malicious software protection, login monitoring, and password management.
Security Incident Procedures
You must have formal procedures to identify, report, and respond to security incidents. This includes documenting incidents, their outcomes, and remediation actions taken.
Contingency Plan
You must establish policies for responding to emergencies or disasters that damage systems containing ePHI. This includes data backup plans, disaster recovery plans, and emergency mode operation plans, all of which must be tested regularly.
Business Associate Contracts
You must have written contracts (Business Associate Agreements) with any third party that creates, receives, maintains, or transmits ePHI on your behalf. The BAA must specify how the associate will safeguard ePHI.
Security Rule — Physical Safeguards (SS 164.310)
Physical measures, policies, and procedures to protect electronic information systems and related buildings and equipment from natural and environmental hazards and unauthorized intrusion.
Facility Access Controls
You must limit physical access to your facilities while ensuring authorized access is allowed. This includes contingency operations procedures, facility security plans, access control and validation, and maintenance records.
Workstation Use
You must specify the proper functions, manner of use, and physical attributes of workstations that access ePHI. This includes policies about where and how workstations can be used.
Device and Media Controls
You must have policies governing the receipt, removal, disposal, and reuse of electronic media containing ePHI. This includes secure disposal procedures, media reuse procedures, and tracking of hardware and media movements.
Security Rule — Technical Safeguards (SS 164.312)
Technology-based policies and procedures that protect ePHI and control access to it.
Access Control
You must implement technical policies to allow only authorized persons to access ePHI. This includes unique user identification, emergency access procedures, automatic logoff, and encryption/decryption of data.
Audit Controls
You must implement hardware, software, and procedural mechanisms to record and examine activity in systems containing ePHI. This means logging access, modifications, and other actions on systems with ePHI.
Integrity Controls
You must implement policies and procedures to protect ePHI from improper alteration or destruction. This includes mechanisms to authenticate ePHI and verify that data has not been altered or destroyed improperly.
Transmission Security
You must implement technical measures to guard against unauthorized access to ePHI transmitted over electronic networks. This typically means encryption (like TLS) for all ePHI in transit.
Privacy Rule and Breach Notification
Rules governing the use and disclosure of PHI and requirements for reporting breaches.
Privacy Rule: Uses and Disclosures of PHI
PHI may only be used or disclosed for treatment, payment, or healthcare operations without patient authorization. Any other use requires written patient authorization. You must apply the minimum necessary standard, using only the minimum PHI needed for the purpose.
Breach Notification Rule
If a breach of unsecured PHI occurs, you must notify affected individuals within 60 days, HHS within 60 days (or annually for breaches affecting fewer than 500 individuals), and prominent media outlets if the breach affects more than 500 residents of a state.
Frequently Asked Questions
Who needs to comply with HIPAA?
HIPAA applies to covered entities (healthcare providers, health plans, healthcare clearinghouses) and their business associates. If your software handles Protected Health Information on behalf of a covered entity, you are a business associate and must comply.
What is a Business Associate Agreement?
A BAA is a required contract between a covered entity and a business associate that establishes how the associate will safeguard PHI. It must specify permitted uses, security requirements, breach notification obligations, and termination procedures.
What are HIPAA penalties?
HIPAA penalties range from $100 to $50,000 per violation, with annual maximums of $1.5 million per violation category. Criminal penalties can include fines up to $250,000 and imprisonment for knowing misuse of PHI.
Is HIPAA certification possible?
There is no official HIPAA certification. Unlike SOC 2 or ISO 27001, HHS does not endorse or recognize HIPAA certifications. Organizations demonstrate compliance through risk assessments, policies, and ongoing security practices. Some third parties offer HIPAA assessments, but these are not official certifications.
What is the difference between PHI and ePHI?
PHI (Protected Health Information) is any individually identifiable health information. ePHI is PHI in electronic form. The HIPAA Security Rule specifically addresses ePHI, while the Privacy Rule covers PHI in all forms (paper, oral, and electronic).
What policies do I need for HIPAA?
Key HIPAA policies include a Security Rule policy (covering administrative, physical, and technical safeguards), Privacy Rule policy (covering PHI use and disclosure), Breach Notification policy, Business Associate Agreement template, and workforce training procedures. PoliWriter generates all of these.
Other Requirements Guides
Generate HIPAA policies automatically
PoliWriter creates all the policies you need to satisfy HIPAA requirements, customized to your organization. AI-powered, audit-ready, hours not months.
Get Started Free