DocumentationSupportCosta Rica · Contact
ESENPT
Let’s talk
  • Legal

HIPAAHealth Insurance Portability and Accountability Act of 1996

In short

HIPAA is a 1996 US federal law whose rules, issued by the Department of Health and Human Services (HHS), protect health information handled by providers, health plans, clearinghouses and their business associates. It allows that information to be used for treatment, payment and operations without the patient's authorization, requires authorization for other uses and gives people a right to access their data. It does not cover anyone who is not a covered entity or acting for one.

Type
Legal framework
Steward
U.S. Congress; rules: HHS; enforcement of the Privacy, Security and Breach Notification Rules: HHS Office for Civil Rights
Current version
Pub. L. 104-191
Jurisdiction
United States
Reviewed
October 25, 2026

Explanation

What it is

The Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191, 21 August 1996) includes administrative simplification in its Title II. On that basis, HHS issued the rules now found in Title 45 of the Code of Federal Regulations (CFR):

RuleWhere
General provisions and enforcement45 CFR Part 160
Transactions, code sets and identifiers45 CFR Part 162
Security45 CFR Part 164, Subpart C
Breach notification45 CFR Part 164, Subpart D
Privacy45 CFR Part 164, Subpart E

The HHS Office for Civil Rights (OCR) enforces the privacy, security and breach notification rules.

Who it applies to

Covered entities are health plans, health care clearinghouses and providers that transmit health information electronically in standard transactions (§ 160.103), plus their business associates. For HIPAA, "State" includes Puerto Rico, the Virgin Islands, Guam, American Samoa and the Northern Mariana Islands.

Key privacy rules

  • Use and disclosure for treatment, payment and health care operations without authorization; obtaining consent for those purposes is optional (§ 164.506).
  • Written authorization for other uses (§ 164.508).
  • Right of access: the entity must act within 30 days, extendable once by up to 30 more days with a written notice (§ 164.524).
  • More stringent state privacy laws are not preempted (§ 160.203).

Status as of October 2026

  • Latest amendment in effect: the final rule of 24 March 2026 (91 FR 14350) adopted standards for claims attachments and electronic signatures; it took effect on 26 May 2026 and compliance is required by 26 May 2028.
  • Reproductive health: according to HHS, a federal court in Texas vacated most of the 2024 reproductive health care privacy rule on 18 June 2025.
  • Security: the Security Rule overhaul proposed on 6 January 2025 is still a proposal.

Common misconceptions

  • Believing it protects all health data. It only binds covered entities and business associates; other laws may apply outside that scope.
  • Believing it prevents sharing for care. Treatment is a permitted use without authorization.
  • Treating a proposal as a rule. Proposals published in the Federal Register are not binding until adopted as a final rule.

Usage examples

  1. HIPAA's definition of "State" (§ 160.103) includes Puerto Rico, the Virgin Islands, Guam, American Samoa and the Northern Mariana Islands, as well as the District of Columbia.

  2. A provider can send a clinical summary to another provider to treat the patient without asking for authorization (§ 164.506).

  3. When it receives an access request, a covered entity has 30 days to act and may extend once, by up to 30 more days, if it explains the reason in writing (§ 164.524).

  4. The 2026 final rule on claims attachments requires electronic signatures on those attachments to follow the HL7 CDA R2 Digital Signatures and Delegation of Rights guide.

  5. The Federal Trade Commission applies its own Health Breach Notification Rule, updated in 2024, to vendors of personal health records not covered by HIPAA.

Relation to other terms

Relies on0

This term does not rely on other glossary terms.

Depend on this one1

  • Information blockingStrong

    Electronic health information (EHI) is defined with HIPAA concepts: electronic protected health information included in a designated record set.

Sources

  1. Public Law 104-191 — Health Insurance Portability and Accountability Act of 1996 (govinfo)govinfo.gov
  2. eCFR — 45 CFR Part 160, General Administrative Requirementsecfr.gov
  3. eCFR — 45 CFR Part 164, Security and Privacyecfr.gov
  4. HHS — HIPAA and Reproductive Health (status of the 2024 rule after Purl v. HHS)hhs.gov
  5. Federal Register — HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (proposed rule, 90 FR 898, 6 January 2025)federalregister.gov
  6. Federal Register — Health Breach Notification Rule (FTC final rule, 89 FR 47028, 30 May 2024)federalregister.gov
  7. Federal Register — Administrative Simplification; Adoption of Standards for Health Care Claims Attachments Transactions and Electronic Signatures (91 FR 14350, 24 March 2026)federalregister.gov
Health interoperability glossary