Learning Objectives
- Explain what HIPAA is, why Congress passed it, and what problem it was created to solve.
- Define the core vocabulary you will use throughout the course: PHI, ePHI, covered entity, and business associate.
- Identify which organizations and people the law actually applies to — including hybrid entities.
- Describe how HIPAA is structured into its major rules and how the HITECH Act later strengthened it.
- See the road ahead: how the rest of this course builds on these foundations, lesson by lesson.
What HIPAA Is, and the Problem It Solves
The Health Insurance Portability and Accountability Act — HIPAA — is a U.S. federal law passed in 1996. The name reflects its original two-part purpose: keeping health insurance portable when people changed or lost jobs, and making the healthcare system more accountable by standardizing how it handled data and money. The part most people mean when they say "HIPAA," though, came from the law's administrative-simplification provisions, which set national standards for protecting health information.
The timing was not an accident. In the mid-1990s, healthcare was moving from filing cabinets to computers. Electronic records made care faster and cheaper — and made it dramatically easier to copy, transmit, or leak a patient's most sensitive information at scale. Before HIPAA, privacy protections varied state by state, with no consistent federal floor. HIPAA created that floor: a baseline set of rights for patients and obligations for the organizations that hold their data.
Key Principle
HIPAA exists to let health information move where care requires it while keeping it protected everywhere it goes. Privacy and the flow of information are not opposites under HIPAA — the law is the agreement that lets both happen at once.
HIPAA is enforced by the U.S. Department of Health and Human Services (HHS), primarily through its Office for Civil Rights (OCR). OCR investigates complaints and breaches, issues guidance, and can impose penalties for noncompliance. Those penalties scale with how serious and how willful a violation is, and the most egregious cases can carry criminal liability — but throughout this course we will focus on understanding the obligations themselves rather than memorizing dollar figures, which change over time.
The Vocabulary You Cannot Skip
Almost every requirement in HIPAA hinges on four terms. Get these right and the rest of the law becomes far easier to read. Get them wrong and you will misjudge what applies to you.
Protected Health Information (PHI) — individually identifiable health information held or transmitted by a covered entity or business associate, in any form: spoken, written, or electronic.
Electronic Protected Health Information (ePHI) — PHI that is created, stored, received, or transmitted electronically. ePHI is the specific subject of HIPAA's Security Rule.
Covered Entity — a healthcare provider that transmits health data electronically for standard transactions, a health plan, or a healthcare clearinghouse. These are the organizations directly bound by HIPAA.
Business Associate — a person or organization that creates, receives, maintains, or transmits PHI while performing work on behalf of a covered entity (for example, a billing service, cloud host, or transcription vendor).
Two things to notice right away. First, "health information" alone is not PHI — it only becomes protected when it can be tied to a specific person and is held by a covered entity or business associate. A step count on someone's personal fitness watch is not PHI; the same data sent to their doctor and stored in their chart is. Second, PHI is identified by what it reveals, not by where it lives. A patient's name and reason for a call jotted on a sticky note is PHI just as much as a record in an electronic health system.
Example
A clinic stores patient charts in a cloud system run by an outside vendor. The clinic is the covered entity; the chart data is ePHI; and the cloud vendor is a business associate because it maintains that ePHI on the clinic's behalf. All three of those labels carry obligations — which is why naming them correctly is the first step in any compliance program.
Who Actually Has to Comply
A common misconception is that HIPAA only governs hospitals and insurers. In practice the law reaches the whole chain of organizations that touch patient data.
Covered Entities
Providers (doctors, clinics, dentists, pharmacies, nursing homes), health plans (insurers, HMOs, Medicare and Medicaid), and clearinghouses that translate health data between formats.
Business Associates
Vendors and contractors that handle PHI for a covered entity — IT and cloud providers, billing and coding firms, transcription services, and law or accounting firms with access to PHI.
Hybrid Entities
Organizations that do both covered and non-covered work. A university with a medical center is the classic case: HIPAA applies to the medical center, not the classrooms.
Business associates are not loosely connected to HIPAA — since the HITECH Act they are directly liable for much of it, and they must sign a Business Associate Agreement (BAA) with the covered entity spelling out how they will protect PHI. A hybrid entity, meanwhile, has to formally designate which of its components are healthcare components, so the rules land on the right parts of the organization and not the rest.
⚠ Important
If you handle PHI on a covered entity's behalf, "we're just a vendor" is not a defense. Misclassifying your role — assuming you are outside HIPAA when you are a business associate — is one of the most common and most costly compliance mistakes.
We unpack each of these roles in depth later: see Compliance for Covered Entities and Compliance for Business Associates for the specific duties each one carries.
How the Law Is Built
HIPAA is not a single instruction. It is a set of rules issued under the law, each governing a different slice of the problem. Three of them form the backbone of this course.
Privacy Rule
Governs how PHI in any form may be used and disclosed, and establishes patients' rights over their own information. Covered in HIPAA Privacy Rule.
Security Rule
Focuses specifically on ePHI, requiring administrative, physical, and technical safeguards. Covered in HIPAA Security Rule.
Breach Notification Rule
Defines what counts as a breach and who must be notified when protected data is exposed. Covered in HIPAA Breach Notification Rule.
Two ideas thread through all three rules and are worth holding onto from the start. The minimum necessary principle says you should only access, use, or disclose the smallest amount of PHI needed to do a given job. And the security goal is always stated as three properties: keeping data confidential (seen only by those authorized), intact (not improperly altered), and available (there when legitimate care requires it).
HITECH: HIPAA's Upgrade
In 2009, as part of a broader push to digitize medical records, Congress passed the Health Information Technology for Economic and Clinical Health (HITECH) Act. HITECH did not replace HIPAA — it strengthened it. It made business associates directly accountable, put real teeth into breach notification, and raised the stakes for enforcement. When you see references later in the course to business associates being "on the hook" or to mandatory breach reporting, HITECH is usually the reason.
HITECH Act — a 2009 law that expanded and toughened HIPAA, extending direct liability to business associates and reinforcing breach notification and enforcement.
Your Roadmap for This Course
This lesson is the orientation. From here, the course moves outward from the foundations you just met, then into application:
- The three core rules — Privacy, Security, and Breach Notification — each get a dedicated lesson that turns the overview above into concrete requirements.
- Compliance by role — separate deep dives for Covered Entities and Business Associates, since their duties differ.
- HIPAA and Technology — how the rules play out across EHRs, cloud systems, encryption, and access control.
- Documentation, Auditing & Risk Management — proving compliance through risk analysis, audit trails, and policy.
- Enforcement and Penalties — how OCR investigates and what noncompliance actually leads to.
- Advanced Topics and Compliance for Non-Traditional & Emerging Environments — the edges: telehealth, mobile apps, AI, and other contexts the original law never anticipated.
- Real-World Application & Best Practices — bringing it all together into day-to-day habits and a working compliance posture.
Keep the four core terms and the three core rules close as you go. Nearly every later lesson is a more detailed answer to a question this one raised.
Key Takeaways
- HIPAA is a 1996 federal law that sets a national baseline for protecting health information while still letting it flow where care needs it; HHS's Office for Civil Rights enforces it.
- Four terms anchor everything: PHI, ePHI, covered entity, and business associate. Information is only PHI when it identifies a person and is held by a covered entity or business associate.
- HIPAA reaches the whole data chain — providers, plans, clearinghouses, their vendors (business associates), and the healthcare components of hybrid entities. Misclassifying your role is a top compliance failure.
- The law is built from rules: Privacy (use and disclosure), Security (safeguards for ePHI), and Breach Notification (response to exposure), unified by the minimum-necessary principle and the confidentiality–integrity–availability goal.
- The HITECH Act (2009) strengthened HIPAA, notably by making business associates directly liable and reinforcing breach notification and enforcement.
UKPRN 10092631