What is HIPAA?
HIPAA is a U.S. federal law. For IT work, the parts that matter are the rules the Department of Health and Human Services (HHS) issued under it, chiefly the Privacy Rule, the Security Rule and the Breach Notification Rule. Together they govern how health information about identifiable people is used, protected and disclosed. The HHS Office for Civil Rights enforces them. Watch the spelling: it is HIPAA, with one P and two As, not "HIPPA."
Who and what it covers
- Covered entities: health plans, health care clearinghouses and health care providers that conduct certain transactions electronically. That includes most hospitals, clinics, doctors' and dentists' offices and pharmacies.
- Business associates: outside organizations that create, receive, store or transmit PHI on a covered entity's behalf, such as billing companies, cloud services and IT providers. They sign a business associate agreement (BAA) and carry their own obligations. An IT company whose work gives it access to a clinic's patient data is usually a business associate.
- Protected health information (PHI): individually identifiable health information, such as diagnoses, treatment notes, test results, prescriptions and insurance or billing details, when it can be tied to a person by name, address, dates, record numbers or similar identifiers. PHI in electronic form is often called ePHI.
The main rules in brief
| Rule | What it addresses |
|---|---|
| Privacy Rule | When PHI may be used or disclosed, patients' rights to see their records, and using only the minimum necessary information for a task |
| Security Rule | Administrative, physical and technical safeguards for ePHI, such as risk analysis, access controls, unique user IDs, audit logging, integrity protections and secure transmission |
| Breach Notification Rule | Notifying affected individuals, HHS and, for larger breaches, the media after a breach of unsecured PHI |
What it means for a technician
- Access only the PHI your task requires. Do not browse patient records or talk about what you saw.
- Lock unattended screens, use privacy filters and angle monitors away from waiting rooms and public counters.
- Never copy PHI to personal devices, personal email, unapproved cloud storage or a help desk ticket.
- Encrypt laptops and removable media that hold ePHI. A lost device with properly encrypted data is treated very differently under breach rules from a lost unencrypted one.
- Wipe or destroy storage from PCs, medical devices, copiers and printers with approved methods, and keep the destruction records.
- Report a possible exposure, such as a misdirected email, a lost phone or malware on a clinic PC, through proper channels right away.
Penalties
Violations can lead to civil monetary penalties scaled to the level of negligence, required corrective action plans and, for knowingly obtaining or disclosing PHI improperly, criminal penalties. Dollar amounts are adjusted over time, so focus on the fact that penalties exist rather than on the figures.
HIPAA vs related terms
HIPAA applies to health information in the United States. Personally identifiable information (PII) is the broader category of data that identifies a person. PCI DSS is a payment card industry standard enforced through contracts, not a law. GDPR is the European Union's general data protection law.
HIPAA on the CompTIA A+ exam
Core 2 (220-1202) objective 4.6 covers regulated data, and health information protected under HIPAA is one of the types to recognize. If a question mentions patient records, a medical office or health insurance details, think PHI and HIPAA. If it mentions credit card numbers, think PCI DSS. If it mentions personal data of EU residents, think GDPR. Expect questions about how a technician should behave around PHI: limit exposure, follow policy, keep it out of tickets and personal storage, report incidents and dispose of media securely.