What is HIPAA compliance?

The Privacy Rule

45 CFR Part 160 and Subparts A and E of Part 164

The HIPAA Privacy Rule establishes national standards for when and how protected health information may be used and disclosed. It gives patients fundamental rights over their health information, including the right to examine and obtain a copy of their health records, the right to request corrections, and the right to know who has accessed their information. The Privacy Rule applies to all forms of PHI — electronic, paper, and verbal. It requires covered entities to implement policies that limit the use of PHI to the minimum necessary for the intended purpose, train all workforce members on privacy procedures, designate a Privacy Officer, and provide patients with a Notice of Privacy Practices explaining how their information will be used.

The Security Rule

45 CFR Part 160 and Subparts A and C of Part 164

The HIPAA Security Rule focuses specifically on electronic protected health information (ePHI) and requires covered entities and business associates to implement three categories of safeguards: administrative (risk assessments, workforce training, access management policies), physical (facility access controls, workstation security, device disposal procedures), and technical (access controls, audit controls, integrity controls, transmission security). The proposed 2026 update to the Security Rule introduces new mandatory requirements: organization-wide multi-factor authentication, encryption of all ePHI at rest and in transit (no longer 'addressable'), network segmentation, six-monthly vulnerability scanning, and annual penetration testing.

The Breach Notification Rule

45 CFR Sections 164.400–414

The Breach Notification Rule establishes specific procedures that covered entities and business associates must follow when a breach of unsecured PHI occurs. A breach is defined as the acquisition, access, use, or disclosure of PHI in a manner not permitted by the Privacy Rule that compromises the security or privacy of the information. When a breach occurs, covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovery. If the breach affects 500 or more individuals, the covered entity must also notify the HHS Secretary and prominent media outlets in the affected jurisdiction. Business associates must notify the covered entity of a breach no later than 60 days after discovery. All breaches affecting fewer than 500 individuals must be logged and reported to HHS annually.

The Enforcement Rule

45 CFR Part 160, Subparts C, D, and E

The Enforcement Rule defines the procedures for investigating HIPAA complaints, conducting compliance reviews, and imposing penalties for violations. It grants the HHS Office for Civil Rights the authority to investigate complaints filed by individuals, conduct proactive compliance audits, and negotiate resolution agreements with organizations found in violation. The Enforcement Rule establishes a tiered penalty structure based on the level of culpability — from violations where the organization was unaware and could not have reasonably known, to violations resulting from willful neglect. It also establishes procedures for hearings and appeals. The HITECH Act of 2009 significantly strengthened the Enforcement Rule by increasing penalty amounts, requiring HHS to investigate all complaints involving willful neglect, and extending enforcement authority directly to business associates.

Failing to Conduct a Comprehensive Risk Analysis

The Security Rule requires an "accurate and thorough assessment" of risks to ePHI — not a checkbox exercise. OCR has cited inadequate risk analysis in nearly every major HIPAA settlement, including Anthem, Premera, Excellus, and Banner Health. A proper risk analysis must cover all systems that create, receive, maintain, or transmit ePHI; identify all reasonably anticipated threats; assess current safeguards; determine the likelihood and impact of each threat; and assign risk levels.

Inadequate or Infrequent Workforce Training

HIPAA requires that all workforce members receive training on policies and procedures relevant to their job function. "All workforce members" includes employees, volunteers, trainees, contractors, and anyone else under the organization's direct control. Yet many organizations provide training only at hire, fail to update training when policies change, or cannot produce documentation proving training was completed. Annual refresher training with documented completion is the standard that OCR expects to see.

Operating Without Business Associate Agreements

Every vendor, contractor, or service provider that handles PHI on your behalf must have a signed, current BAA before they receive access to any patient information. This includes cloud storage providers, email services used for patient communication, shredding companies, IT support, and answering services. Organizations routinely discover they have dozens of vendors handling PHI without BAAs — each one representing a separate HIPAA violation.

Weak or Non-Existent Access Controls

HIPAA requires that access to ePHI be limited to authorized individuals on a need-to-know basis. Common failures include shared login credentials, failure to terminate access when employees leave (Memorial Healthcare System, $5.5M), granting administrative access to users who do not need it, and failing to implement automatic session timeouts. Every user who accesses ePHI should have a unique identifier, and access logs should be reviewed regularly.

No Documented Incident Response Plan

When a potential breach occurs, organizations without a documented incident response plan waste critical time determining what to do, who to notify, and how to investigate. The Breach Notification Rule imposes strict timelines — affected individuals must be notified within 60 days of discovery. Organizations that scramble to respond after an incident consistently make errors that increase their legal exposure: they miss notification deadlines, fail to preserve evidence, provide incomplete notifications, or fail to conduct the required four-factor breach risk assessment.

Treating Compliance as a One-Time Project

HIPAA compliance is not a checklist that you complete once and file away. It is an ongoing program that requires continuous monitoring, regular updates, and periodic reassessment. Policies must be reviewed and updated annually or whenever there are significant changes to your organization or environment. Risk assessments must be repeated regularly. Training must be refreshed. New vendors must be vetted and covered by BAAs. Organizations that treat compliance as a project rather than a program inevitably fall out of compliance within months of their initial implementation.