HIPAA requirements explained: the Privacy, Security, Breach Notification and Enforcement Rules in plain language

How are the HIPAA requirements organised?

HIPAA requirements are not a single checklist. The 1996 statute had the Department of Health and Human Services write national rules, now in Title 45 of the Code of Federal Regulations, and the HHS Office for Civil Rights (OCR) enforces the four covered here. The transaction and code-set standards are administered by CMS and sit outside this guide.

Each rule answers a different question:

Who the rules bind matters as much as what they say. Covered entities are health plans, health care clearinghouses and health care providers that transmit health information electronically in a standard transaction. Business associates create, receive, maintain or transmit PHI on their behalf, as do their subcontractors. Your status, client by client, decides which parts of each rule you carry; the process guide covers how to establish it (HIPAA compliance process, step by step).

The Privacy Rule: permitted uses, rights and administration

The Privacy Rule protects individually identifiable health information held or transmitted by a covered entity or business associate, whether on paper, on screen or spoken. PHI may be used or disclosed only where the rule permits it or the individual has authorised it in writing.

Permitted uses and disclosures (164.502 to 164.514)

Disclosure to the individual and use for treatment, payment and health care operations are permitted. So are listed public-interest purposes such as public health, oversight, law enforcement and research, each with conditions. Anything outside those routes needs a plain-language authorisation (164.508). The minimum necessary standard requires reasonable efforts to use, disclose or request no more PHI than the purpose needs, with exceptions that include treatment disclosures and disclosures to the individual.

Individuals' rights (164.520 to 164.528)

Covered entities issue a notice of privacy practices, and direct treatment providers deliver it no later than the first service encounter. Individuals may access their records, request amendment, receive an accounting of certain disclosures covering six years, ask for restrictions and request confidential communications.

Administrative requirements (164.530)

A privacy official, written policies and procedures, workforce training, sanctions, a complaints route, mitigation of harmful disclosures, a ban on retaliation and documentation kept for six years.

The Security Rule: risk analysis and three families of safeguards

The Security Rule applies to electronic PHI only. The general rules in 164.306 require you to protect its confidentiality, integrity and availability, to guard against reasonably anticipated threats and impermissible uses, and to ensure your workforce complies. It is flexible by design, scaled to your size, infrastructure, costs and risks.

That flexibility is anchored by the risk analysis at 164.308(a)(1)(ii)(A), a required specification. HHS calls it the first step in choosing safeguards, and it must cover all ePHI you hold, not one flagship system. The method is yours to choose; the dedicated guide explains how to run one (The Security Rule risk analysis: how to conduct one).

Each safeguard standard carries implementation specifications marked required or addressable. A required one must be in place. An addressable one must be assessed: implement it if reasonable and appropriate, otherwise document why and adopt an equivalent measure where that is reasonable. Addressable never means optional.

The evaluation standard at 164.308(a)(8) asks for periodic technical and non-technical evaluation, done internally or by an outside organisation.

The Breach Notification Rule: from incident to notice

A breach is an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of PHI. The rule presumes a breach has occurred unless a documented risk assessment shows a low probability of compromise, weighing four factors: the nature and extent of the PHI, the unauthorised person involved, whether the PHI was actually acquired or viewed, and how far the risk has been mitigated.

Notification duties attach to unsecured PHI: PHI not rendered unusable, unreadable or indecipherable by the encryption or destruction methods HHS describes.

• Individuals (164.404): without unreasonable delay and no later than 60 days after discovery.
• Media (164.406): where more than 500 residents of a state or jurisdiction are affected.
• The Secretary (164.408): within 60 days for breaches of 500 or more; smaller breaches logged and reported within 60 days of the end of the calendar year.
• Business associates (164.410): notify the covered entity without unreasonable delay and within 60 days of discovery.

Under 164.414 the burden of proof sits with you: you must be able to show that notices went out, or that the incident was not a breach.

Enforcement and business associate obligations

The Enforcement Rule sets out how OCR handles complaints and compliance reviews, how civil money penalties are imposed and how hearings are conducted. Penalty tiers rise with culpability and are adjusted for inflation; many cases close through resolution agreements monitored by HHS, and state attorneys general may also bring civil actions.

Business associates became directly liable for certain requirements under the 2013 Omnibus Rule. In practice that means the Security Rule applies to the electronic PHI they handle, the Breach Notification Rule requires them to notify the covered entity, and the Privacy Rule reaches them through the uses and disclosures their agreements permit. The agreement itself must meet 164.504(e) and 164.314(a), including flow-down to subcontractors and return or destruction of PHI at termination; the agreements guide covers the terms (Business associate agreements: what to sign and what to issue).

What is proposed but not yet required

HHS published a proposed update to the Security Rule on 6 January 2025. It would make every specification required and add obligations such as encryption and multi-factor authentication. It remains a proposal and the current Security Rule is still the one in force; the separate guide tracks its status and what it would change (The proposed Security Rule update, explained).

Build to the rule in force, record a reasoned decision for every addressable specification, and a final rule, whatever form it takes, becomes a set of changes to an existing programme rather than a fresh start.

HIPAA requirements: questions buyers ask