Two-minute brief
HIPAA requirements explained: video brief
A two-minute brief on the four HIPAA rules and what each one asks of covered entities and business associates that handle protected health information.
Key takeaways
- HIPAA has four rules: Privacy, Security, Breach Notification and Enforcement.
- The minimum necessary standard limits how much PHI is used or disclosed.
- Security safeguards are selected from an accurate and thorough risk analysis.
- Addressable specifications are documented decisions, not optional extras.
- Business associates and their subcontractors carry obligations of their own.
Four rules, one programme
HIPAA's obligations sit in four rules. The Privacy Rule governs the use and disclosure of protected health information in any form. The Security Rule governs the safeguarding of electronic PHI. The Breach Notification Rule sets what happens after an impermissible disclosure, and the Enforcement Rule sets how the HHS Office for Civil Rights investigates and penalises. This short film sets the four side by side.
Under the Privacy Rule, PHI is used and disclosed only as permitted or authorised, the minimum necessary standard applies and individuals' rights are honoured. In practice that means a privacy official, a notice of privacy practices for covered entities, authorisation forms, access and amendment requests met on time, training, sanctions, complaints handling and records kept for six years.
The useful question is narrower than the statute: do you know where PHI enters, sits and leaves your organisation, and could you show an auditor the evidence without a week of preparation?
The Security Rule and the risk analysis
The Security Rule asks you to protect the confidentiality, integrity and availability of all electronic PHI and to select safeguards from an accurate and thorough risk analysis. Its implementation specifications are either required, which are mandatory, or addressable, which are documented decisions rather than optional extras. The administrative safeguards include a security official, workforce access control, security awareness training, incident procedures, contingency planning, periodic evaluation and business associate agreements, alongside physical and technical safeguards.
The rules apply to covered entities, meaning US health plans, health care clearinghouses and providers that transmit health information electronically in standard transactions, and to their business associates and subcontractors down the chain. The rules in force are at 45 CFR Parts 160 and 164, as amended by the 2013 Omnibus Rule; the Security Rule update proposed in January 2025 remains a proposal. HIPAA is a law, and no certificate exists for it.
HIPAA at a glance
- Purpose
- Protecting individually identifiable health information in the United States: how it may be used and disclosed, how it is secured, and what happens when it is breached
- Relevant to
- US health plans, providers and clearinghouses, and every business associate handling their PHI: BPO and contact centres, billing and coding, SaaS and cloud providers, IT services and analytics, wherever they are located
- Edition
- 45 CFR Parts 160 and 164: the Privacy, Security, Breach Notification and Enforcement Rules, as amended by the 2013 Omnibus Rule; the Security Rule update proposed in January 2025 remains a proposal
- Certification
- None exists. Compliance is demonstrated to the regulator, your customers and their auditors through a documented programme; SOC 2, HITRUST and ISO/IEC 27001 can evidence it
- Sterling's role
- Programme build with your team, Effivity, training, internal audit and review readiness, then Sustain™
- Cost and timing
- Total investment for a HIPAA compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 6 months
HIPAA: questions people ask
Is there such a thing as HIPAA certification?
No. HHS states that it does not endorse or recognise any private organisation's certification of Security Rule compliance, that such a certificate does not absolve an organisation of its obligations, and that it does not prevent OCR from finding a violation. Compliance is demonstrated through a documented programme and its evidence. A SOC 2 report, HITRUST or ISO/IEC 27001 certification can support it; none is HIPAA certification.
We are outside the United States. Does HIPAA apply to us?
If you create, receive, maintain or transmit PHI for a US covered entity or another business associate, you are a business associate, and the obligations follow the data rather than the office address. Your customer will require a business associate agreement and its auditors will expect the programme behind it. Local privacy law applies as well, not instead.
What is a business associate agreement, and who has to sign one?
The contract between a covered entity, or a business associate, and the business associate that handles PHI for it: permitted uses and disclosures, safeguards, incident and breach reporting, flow-down to subcontractors, support for individuals' rights, HHS access to books and records, and what happens to the PHI at termination. You sign one with every client that gives you PHI and issue one to every vendor that touches it.
What is the difference between required and addressable specifications?
Required specifications must be implemented as written. For addressable ones, you assess whether the specification is reasonable and appropriate for your environment; if not, you document why and implement an equivalent alternative where reasonable. Addressable never means optional. The January 2025 proposal would remove the distinction; it is not final.
What has to happen when PHI is breached?
An impermissible use or disclosure of unsecured PHI is presumed to be a breach unless a four-factor risk assessment shows a low probability of compromise. Individuals are notified without unreasonable delay and no later than sixty days after discovery; HHS within sixty days for breaches affecting 500 or more people and annually for smaller ones; the media for breaches affecting more than 500 residents of a state. A business associate notifies the covered entity within sixty days, and usually much faster under its contract.
Keep exploring
Related to this video
Read next
Services
The complete guide
Everything on HIPAA
Start with the HIPAA page, or go straight to the guide you need.
On the HIPAA page
Guides
More videos: Privacy and data protection
- How to implement ISO/IEC 27701Implementation walkthrough · 3 min 14 s
- ISO/IEC 27701 requirements explainedTwo-minute brief · 2 min
- How to comply with GDPRCompliance walkthrough · 3 min 24 s
- GDPR requirements explainedTwo-minute brief · 2 min
- How to comply with the Philippine Data Privacy ActCompliance walkthrough · 3 min 15 s
- Philippine Data Privacy Act requirements explainedTwo-minute brief · 2 min
- How to comply with India's DPDP Act 2023Compliance walkthrough · 3 min 15 s
- India's DPDP Act 2023 requirements explainedTwo-minute brief · 2 min
- How to comply with Singapore's PDPACompliance walkthrough · 3 min 15 s
Talk to a consultant
Plan your HIPAA compliance programme with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice