Health Insurance Portability and Accountability Act

HIPAA sets national standards for protecting Protected Health Information (PHI) through two core rules: the Privacy Rule, which governs the use and disclosure of PHI, and the Security Rule, which requires administrative, physical, and technical safeguards for electronic PHI (ePHI).

HIPAA applies directly to covered entities, such as providers, health plans, and clearinghouses, and extends to their business associates through required Business Associate Agreements. Violations carry tiered civil penalties and, in cases of willful neglect, criminal penalties.