HIPAA is a US federal law that sets national standards for protecting patients' health information and gives patients rights over that information. It applies to health plans, healthcare clearinghouses, most healthcare providers and the vendors that handle health information for them.
What HIPAA means
HIPAA stands for the Health Insurance Portability and Accountability Act of 1996.
HIPAA does not apply to everyone who handles health information. It applies to covered entities and their business associates. Covered entities are health plans, healthcare clearinghouses and healthcare providers that conduct certain transactions electronically. Business associates are vendors that create, receive, maintain or transmit health information on a covered entity's behalf. A fitness app you download yourself is usually outside HIPAA. Your clinic's billing company usually is not.
In practice at a clinic or small practice
At the front desk, HIPAA shows up in small, routine steps. Before you share appointment details on the phone, confirm you are speaking with the patient or someone they have authorized. Keep sign-in sheets, schedules and computer screens out of view of other patients in the waiting room. Give new patients the Notice of Privacy Practices, which explains how the practice uses their protected health information (PHI). When a patient asks for a copy of their records, pass the request to the right person so the practice can respond within the required timeframe.
For nurses and the office manager, the core habit is sharing only the minimum necessary information for the task. For example, a scheduling question to a colleague usually needs a time slot, not a diagnosis. HIPAA does not ban texting or chat. However, patient details should not go into personal texting apps or group chats unless the vendor has signed a business associate agreement (BAA) and your practice's policy allows that use. The office manager makes sure staff complete HIPAA training and that every vendor handling PHI has a signed BAA on file.
Not to be confused with
- "HIPPA" is a common misspelling. The acronym does not contain the word "privacy," even though privacy is a large part of the law. The correct spelling is HIPAA: two A's at the end.
- "HIPAA certification": HHS does not certify vendors or organizations as HIPAA compliant. A vendor can support compliance, for example by signing a BAA and providing access controls. Whether a practice is compliant depends on how the practice itself uses the tool, trains staff and manages access. No software makes an organization compliant by itself.
- HIPAA vs. the HIPAA Rules: HIPAA is the law. The Privacy Rule, Security Rule and Breach Notification Rule are regulations issued under it.
What the rules say
The HIPAA regulations are in Title 45 of the Code of Federal Regulations, Parts 160 and 164.
| Rule | What it covers |
|---|---|
| HIPAA Privacy Rule | Limits on how PHI can be used and disclosed, plus patient rights such as access to their records |
| HIPAA Security Rule | Administrative, physical and technical safeguards for electronic PHI (ePHI) |
| Breach Notification Rule | Notice duties after a breach of unsecured PHI |
The HITECH Act of 2009, implemented through the 2013 Omnibus Rule, made business associates directly liable for complying with parts of the HIPAA Rules.
The HHS Office for Civil Rights (OCR) enforces the Privacy, Security and Breach Notification Rules. Penalties depend on the type of violation. Current amounts are published by HHS.
This entry is a plain-language summary, not legal advice. For official guidance, see hhs.gov/hipaa or ask your practice's privacy officer.
Related reading
- Protected health information (PHI): what counts as PHI and ePHI.
- Business associate agreement (BAA): what a vendor signs before handling PHI.
- How a staff chat handles HIPAA and BAAs: BAAs, retention and access controls in a staff chat workspace.
- More terms in the healthcare operations glossary.
Where Chanty fits. chanty.health is published by Chanty, a team chat for clinic staff with a signed BAA from the Business plan. If your team still coordinates in personal group chats, see how HIPAA-compliant staff chat works or start free.