HIPAA compliance means following federal rules that protect patients' health information and privacy. Covered entities and business associates must meet applicable requirements for handling protected health information (PHI), implementing security safeguards, training their workforce, and responding to breaches.
HIPAA compliance is not just about keeping records private. It also means making sure employees know their duties, computer systems are protected, and patient information is shared only when allowed.
A small mistake, such as sending a medical record to the wrong person, can create serious problems. Weak passwords, missing vendor agreements, and poor staff training can also put patient information at risk.
This guide explains who must follow HIPAA, the main rules, key compliance requirements, common violations, and practical steps your organization can take.
HIPAA compliance means meeting the rules that apply to your organization under the Health Insurance Portability and Accountability Act of 1996 and its regulations.
HIPAA helps protect certain health information while allowing it to be used for important purposes, such as treatment, payment, and healthcare operations.
For example, a doctor's office may need to protect patient files, limit access to electronic records, and train employees on how to handle private information.
HIPAA compliance is an ongoing responsibility. An organization must maintain appropriate safeguards, review risks, and update its practices when needed.
Protected health information, or PHI, is individually identifiable health information protected by HIPAA when held or handled by a regulated organization in the relevant circumstances.
Examples include medical histories, diagnoses, prescriptions, lab results, and health insurance records linked to an identifiable person.
Electronic protected health information (ePHI) is PHI stored or sent electronically. Examples include electronic medical records, patient information in cloud systems, and certain emails containing health information.
The Privacy Rule protects applicable PHI in paper, electronic, and spoken forms. The Security Rule focuses on ePHI.
Not every piece of health information falls under HIPAA. Information in a personal wellness app, for example, may fall outside HIPAA when the app is not acting for a covered entity or business associate. Other privacy laws may still apply.
HIPAA Privacy, Security, and Breach Notification certification covering PHI/ePHI protection, risk assessment, and security safeguards — built for healthcare compliance leaders and executives.
HIPAA generally applies to covered entities and business associates. Whether an organization must comply depends on its role and activities, not simply whether it handles health-related information.
Covered entities include three main groups.
Healthcare providers: Doctors, hospitals, clinics, and other providers that conduct certain standard healthcare transactions electronically.
Health plans: Health insurance companies, Medicare, Medicaid, and certain employer-sponsored health plans.
Healthcare clearinghouses: Organizations that process health information between standard and nonstandard formats.
For example, a medical practice that sends standard insurance claims electronically is generally a covered entity.
HHS explains the legal categories and exceptions in its guidance on HIPAA covered entities and business associates.
Business associates are people or organizations that perform certain services or functions for covered entities involving PHI.
They may include medical billing companies, IT providers, consultants, and cloud service providers.
For example, a company that stores patient records for a hospital may be a business associate even if its employees do not regularly open those records.
A vendor is not automatically a business associate just because it works with a healthcare organization. The services it provides and its relationship to PHI matter.
Business associates must follow applicable HIPAA requirements directly. They may also need written agreements with their subcontractors.
Four principal rules form the core of HIPAA privacy, security, breach notification, and enforcement requirements.
The HIPAA Privacy Rule controls how covered entities may use and disclose PHI. Some requirements also apply directly to business associates.
It gives patients important rights, including the right to access certain medical records and request corrections.
HIPAA generally permits the use or disclosure of PHI for treatment, payment, and healthcare operations without separate patient authorization, subject to applicable conditions.
For example, a doctor may share relevant information with another healthcare provider for treatment.
The minimum necessary standard generally requires limiting certain uses, disclosures, and requests to the information reasonably needed. It does not apply to every situation. Disclosures to healthcare providers for treatment are an important exception.
The HIPAA Security Rule sets requirements for protecting ePHI.
It requires reasonable and appropriate administrative, physical, and technical safeguards.
These measures help protect electronic information from unauthorized access, improper changes, and loss of availability.
Examples include user access controls, workstation security, audit controls, and workforce security awareness training.
The rule allows flexibility based on an organization's risks and circumstances. However, flexibility does not mean that required safeguards can be ignored.
The HIPAA Breach Notification Rule requires notification after certain breaches of unsecured PHI.
Covered entities generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a reportable breach.
Notification to HHS follows different timelines depending on the number of people affected. Breaches affecting 500 or more individuals generally require faster HHS reporting than smaller breaches.
Business associates generally must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery, unless a shorter contractual deadline applies.
Not every security incident requires breach notification. HIPAA includes exceptions and a process for assessing whether information was compromised.
The Enforcement Rule explains how HIPAA violations are investigated and addressed.
The HHS Office for Civil Rights (OCR) reviews complaints, conducts compliance investigations, and may require corrective action or impose civil monetary penalties.
Some knowing violations may also result in criminal enforcement.
The HITECH Act and the 2013 Omnibus Rule amendments strengthened parts of HIPAA, including business associate responsibilities and enforcement provisions.
Regulatory update: HHS proposed changes to strengthen the HIPAA Security Rule in January 2025. As of October 29, 2026, those proposed cybersecurity changes have not become final requirements. Organizations should follow the rules currently in force and monitor official updates.
HIPAA compliance involves written procedures, employee responsibilities, security safeguards, vendor management, and breach preparation.
The exact requirements depend on your organization's role and the information it handles.
A security risk analysis is a required part of the HIPAA Security Rule.
It helps organizations find potential risks and weaknesses that could affect ePHI.
For example, a clinic may discover that former employees still have active accounts, laptops are not properly protected, or patient records are stored in an unsecured location.
A risk analysis should consider where ePHI is stored, who can access it, how it moves between systems, and what could go wrong.
HHS explains the required approach in its HIPAA security risk analysis guidance.
HIPAA does not set one universal annual deadline for completing a risk analysis. Organizations must keep their analysis accurate and review it as needed, including when significant changes affect their systems or risks.
The Security Rule requires three categories of safeguards.
| Safeguard | What it protects | Example |
|---|---|---|
| Administrative | Security planning and responsibilities | Risk management, workforce security training |
| Physical | Facilities, equipment, and workstations | Controlled entry, secure device storage |
| Technical | Electronic systems and ePHI | Access controls, audit controls, authentication |
These measures work together.
For example, a hospital may establish a policy limiting access to patient records, train employees on that policy, and configure its systems to enforce access restrictions.
Some Security Rule implementation specifications are called addressable. This does not mean they are optional. Organizations must assess whether the stated measure is reasonable and appropriate and follow the rule's requirements for implementation, alternatives, and documentation.
Encryption can be an important way to protect ePHI, but the current rule requires a risk-based assessment of applicable addressable encryption specifications rather than treating encryption as a universal, unconditional requirement in every situation.
Organizations must maintain applicable written privacy and security policies.
These documents should explain how employees handle PHI, protect electronic systems, report incidents, and follow organizational responsibilities.
Policies should match actual workplace practices.
For example, a reception employee should know how to verify someone's identity before sharing patient information.
A clinic should also have clear procedures for employee access, record disposal, patient requests, and reporting suspected privacy problems.
HIPAA includes documentation retention requirements. Certain required records and policies must be retained for six years from creation or the date last in effect, whichever is later.
This is not a universal six-year rule for keeping every patient's medical record. Medical record retention requirements can differ under state law and other rules.
Training is an important part of HIPAA compliance.
The Privacy Rule requires covered entities to train workforce members on relevant privacy policies and procedures as necessary and appropriate for their jobs.
The Security Rule requires a security awareness and training program for workforce members, including management, at regulated organizations.
Employees should understand how to recognize PHI, use patient information appropriately, protect their accounts, and report concerns.
Healthcare organizations can review what HIPAA compliance training covers when developing instruction for different roles.
HIPAA does not establish a universal federal rule requiring every worker to complete training annually. Still, regular refreshers are a useful practice. Additional privacy training may be required when relevant policies or procedures materially change.
When a vendor qualifies as a business associate, HIPAA generally requires a written business associate agreement, or BAA.
The agreement explains how PHI may be used, how it must be protected, and what happens when certain incidents occur.
For example, a healthcare practice using a qualifying cloud provider to store patient records generally needs an appropriate BAA with that provider.
A signed agreement is only one part of compliance. Both organizations must still follow their applicable HIPAA duties.
Every regulated organization needs a way to recognize and respond to possible security incidents and breaches.
Employees should know whom to contact when information is lost, sent to the wrong person, or accessed without permission.
The organization should investigate the event, document its findings, assess notification duties, and take appropriate corrective action.
For example, when an employee sends PHI to the wrong email address, the organization should act promptly. It should not automatically assume the incident is harmless or that every mistaken email is a reportable breach.
A clear response process helps teams make better decisions when time matters.
HIPAA compliance starts with understanding which rules apply to your organization.
Next, identify where PHI is created, received, stored, used, and shared. Review who can access it and whether appropriate protections are in place.
Then examine your risk analysis, policies, workforce training, vendor relationships, and breach response procedures.
HHS provides Security Rule guidance materials that can help organizations understand requirements and review their safeguards.
Use this checklist as a practical starting point.
Confirm HIPAA applicability. Identify whether your organization is a covered entity or business associate.
Assess security risks. Review potential threats and weaknesses affecting ePHI.
Implement safeguards. Put appropriate administrative, physical, and technical protections in place.
Maintain written policies. Keep required privacy and security procedures current.
Train your workforce. Make sure employees understand their responsibilities.
Manage business associates. Identify qualifying vendors and maintain required agreements.
Prepare for breaches. Establish procedures for reporting, assessing, and responding to incidents.
Review and improve. Monitor practices and correct identified problems.
A completed checklist does not prove that an organization meets every HIPAA requirement. It helps identify areas that need closer review.
Hospital administrators can also use a broader hospital compliance checklist to coordinate HIPAA responsibilities with other healthcare obligations.
Start by identifying the problem and the information at risk.
Then assign responsibility, set a reasonable deadline, and document the steps needed to correct it.
For example, if former employees still have active system accounts, disable the accounts promptly. Then review the employee departure process to prevent the problem from happening again.
Follow-up matters. A problem is not fully addressed simply because someone writes a new policy.
Review whether the change works and keep appropriate records of the corrective action.
Common HIPAA violations involve improper access, unauthorized disclosure, weak security practices, or failure to meet applicable requirements.
Examples include an employee opening a patient's record out of curiosity, sending PHI to an unauthorized recipient, or failing to address known security risks.
Lost devices, poor record disposal practices, and missing business associate agreements can also create compliance problems.
Imagine an employee looking up a neighbor's medical history without a work-related reason. Even if the employee never shares the information, the unauthorized access may violate HIPAA.
Learning about common HIPAA compliance mistakes can help organizations recognize risks before they lead to more serious incidents.
Not every mistake leads to the same outcome. The circumstances, applicable rules, and organization's response all matter.
HIPAA noncompliance can lead to corrective action, civil monetary penalties, and, in certain cases, criminal penalties.
The HHS Office for Civil Rights considers factors such as the type of violation, its seriousness, and the organization's level of responsibility.
Civil monetary penalties follow a tiered framework, and dollar amounts are subject to inflation adjustments.
Organizations should use current official penalty information rather than rely on outdated charts.
Through the HIPAA enforcement process, OCR may resolve violations through voluntary compliance, corrective action, resolution agreements, or monetary penalties.
Not every violation results in a fine.
A privacy or security failure may also lead to recovery costs, interrupted operations, and reduced patient trust.
Organizations can lower risk by identifying problems early, responding promptly, and keeping records of their compliance efforts.
HIPAA compliance training helps employees understand how to protect patient information during everyday work.
A worker may need to send records, answer patient questions, use an electronic health record system, or report a suspicious email. Training helps employees recognize the rules that apply to those tasks.
It also gives managers an opportunity to explain workplace procedures and answer questions before mistakes occur.
Organizations can strengthen workforce awareness through a HIPAA compliance training program that addresses privacy, security, and breach response.
Training should fit each person's role. A receptionist, nurse, billing employee, and IT administrator may face different risks.
US Compliance Institute offers the HIPAA Compliance Training – Executive Certification Program for professionals seeking structured education on HIPAA requirements.
HIPAA Privacy, Security, and Breach Notification certification covering PHI/ePHI protection, risk assessment, and security safeguards — built for healthcare compliance leaders and executives.
The course is self-paced and delivered online. Its published curriculum includes 24 lessons across six modules, with an estimated duration of 2–4 hours.
Topics include PHI and ePHI, HIPAA Privacy and Security Rules, risk analysis, safeguards, breach response, and compliance leadership.
The program is suited to healthcare administrators, practice managers, compliance officers, executives, and relevant business associate personnel.
Before enrolling, professionals can also review guidance on choosing online HIPAA training that fits their responsibilities.
USCI awards a Certificate of Completion upon successful completion. This is not a government-issued HIPAA compliance certification.
Completing the course does not make an organization HIPAA compliant. Employers must still provide any required job-specific training, maintain safeguards, and meet their legal obligations.
HIPAA compliance is not a task that ends when an employee finishes training or an organization completes a checklist.
It requires clear policies, appropriate safeguards, regular risk reviews, and people who understand their responsibilities.
Organizations should continue checking their systems, updating procedures when needed, and correcting problems before they become more serious.
Good training supports those efforts by helping employees make safer decisions when handling patient information.
For healthcare professionals who want structured education, USCI's HIPAA training program can be a useful part of a broader approach to privacy, security, and compliance.
News
News
News