HIPAA

HIPAA is the United States law that governs how protected health information is handled. The Privacy, Security, and Breach Notification Rules apply to covered entities — health plans, healthcare providers, and clearinghouses — and to the business associates that create, receive, or transmit protected health information on their behalf.

The Security Rule, at 45 CFR Part 164, divides safeguards into administrative, physical, and technical groups. The administrative group carries much of the weight: a documented risk analysis, a sanction policy, workforce training, and contingency planning. The technical group covers unique user identification, audit controls, integrity checks, and encryption of electronic protected health information in transit and at rest.

Business associate agreements are a condition of working together, not an afterthought: a vendor that touches protected health information signs one before the work starts. If unsecured information is breached, affected individuals must be notified without unreasonable delay and no later than 60 days after discovery. The documentation behind each safeguard is kept for six years from the date it was last in effect.