What is HIPAA?

HIPAA, the Health Insurance Portability and Accountability Act, was enacted by the U.S. Congress in 1996. It is a federal law that established, among other provisions, a set of national standards for the privacy and security of protected health information (PHI). The law applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses, as well as their business associates who handle PHI on their behalf.

The Privacy Rule (45 CFR 164.500-534) governs the use and disclosure of PHI, giving patients rights over their health information and setting limits on how that data can be used without authorization. The Security Rule (45 CFR 164.302-318) specifically addresses electronic PHI (ePHI) and requires administrative, physical, and technical safeguards to ensure its confidentiality, integrity, and availability. The Breach Notification Rule (45 CFR 164.400-414) mandates that covered entities notify affected individuals, the Secretary of HHS, and in some cases the media, following a breach of unsecured PHI.

In the wider infrastructure stack, HIPAA is not a technical protocol but a regulatory requirement that influences system architecture and data handling practices. Encryption of data at rest and in transit, access controls, audit logs, and business associate agreements are all common compliance measures. Engineers designing systems that process PHI must understand HIPAA's requirements as they affect deployment decisions, third-party vendor selection, and incident response procedures.