HIPAA
What it is
The Health Insurance Portability and Accountability Act — US law (enforced by HHS Office for Civil Rights) governing Protected Health Information (PHI). It is a legal obligation, not a certification you obtain; there is no official “HIPAA certified” stamp.
Who it applies to
Covered entities (providers, health plans, clearinghouses) and their business associates (vendors that handle PHI on their behalf — most health-tech SaaS). Touch PHI for a covered entity and you must sign a Business Associate Agreement (BAA).
Disclaimer. Not legal advice. Verified 2026-05-29.
The rules that matter to engineers
| Rule | What it requires |
|---|---|
| Privacy Rule | Limits use/disclosure of PHI; “minimum necessary”; patient access rights. |
| Security Rule | Administrative, physical, and technical safeguards for electronic PHI (ePHI) — access control, audit controls, integrity, transmission security, encryption (addressable but expected). |
| Breach Notification Rule | Notify affected individuals, HHS, and (if large) the media within defined windows. |
Watch for change: HHS issued a proposed update to the Security Rule (NPRM, late 2024 / early 2025) that would make several currently “addressable” safeguards (notably encryption and MFA) explicitly required. Confirm the final rule status before relying on the older “addressable” framing.
How to satisfy it in practice
HIPAA’s Security Rule is less prescriptive than NIST 800-53; NIST even publishes SP 800-66 mapping HIPAA to 800-53. So:
- Build to the FedRAMP/800-53 control baseline → you exceed HIPAA’s technical safeguards.
- Add the BAA, minimum-necessary access design, and breach notification runbook.
- Most health-tech also pursues SOC 2 or HITRUST as the demonstrable artifact, since HIPAA has no certificate.
Related resources
- NIST 800-53 — exceeds HIPAA technical safeguards
- SOC 2 — the artifact buyers actually ask for alongside HIPAA
- Security Overview & decision guide
Sources (verified 2026-05-29)
| Claim | Source |
|---|---|
| HIPAA rules (Privacy/Security/Breach) | HHS — HIPAA |
| Security Rule NPRM (proposed 2024–2025 update) | HHS OCR |
| HIPAA-to-NIST mapping | NIST SP 800-66 Rev 2 |