What is HIPAA?

HIPAA stands for Health Insurance Portability and Accountability Act. It is a federal law that defines standards for safeguarding medical data. The law came into effect in 1996 and has been augmented through updates like the 2009 HITECH Act. Organizations that violate HIPAA rules face stiff civil fines, and individuals could be prosecuted for willful violations of the law’s provisions.

HIPAA covers individually identifiable healthcare information, whether in paper or electronic form, and includes data such as medical records, billing details, laboratory results, treatment plans, and insurance claims data. The law applies to Covered Entities such as hospitals, clinics, doctors’ offices, and nursing homes; Health Plan Entities like health insurance companies; and Healthcare Clearinghouses, which transform nonstandard data into a standard format. It also covers Business Associates (BAs), third-party service providers who create, receive, maintain, or transmit ePHI on behalf of covered entity. Examples of BAs include IT contractors and cloud storage vendors.

HIPAA’s Privacy Rule requires organizations to implement policies and procedures to protect data from unauthorized access by individuals who do not have a legitimate need for it. It also requires that organizations train employees to obtain consent from patients before sharing data for purposes unrelated to patient care or billing. Organizations should also implement a system for tracking access to PHI. StrongDM is a security solution that helps teams meet this requirement by restricting employee access to sensitive information. The system uses administrative controls and a robust audit log to ensure employees are only accessing the information they need.