25 Things Every Business Should Know About HIPAA

The short answer

HIPAA is a U.S. federal framework that sets standards for specified health information and healthcare transactions. Its Privacy, Security, and Breach Notification Rules apply to covered entities and business associates according to their roles, information, and activities; practical compliance combines written procedures with safeguards that work in daily operations.

Start with scope and context

Begin by identifying the organization’s role and the information involved. HIPAA applicability is based on regulated roles and activities, not merely on having a healthcare customer, operating a clinic, or holding data someone considers sensitive.

Start with HIPAA’s scope, terminology, and the core obligations that shape responsible handling of health information.

The requirements in practice

Map which parts of the organization create, receive, maintain, or transmit identifiable health information, including work performed by outside service providers.

Identify the covered entity or business associate role for each activity. HIPAA status depends on the organization’s work and relationships, not simply on its industry label.

A workable process

Translate applicable rules into written policies, assigned owners, workforce training, and procedures staff can follow during normal work and when something goes wrong.

Keep dated evidence of decisions, training, risk analyses, agreements, and reviews so the organization can show how its program operates in practice.

Make safeguards part of the workflow

Make the process usable: give staff a clear owner, a simple escalation path, and a way to record the decision. Use a small sample of real workflows to find confusing steps before a privacy request or urgent incident arrives.

Translate applicable rules into written policies, assigned owners, workforce training, and procedures staff can follow during normal work and when something goes wrong.

Assign people and vendor responsibilities

Identify the covered entity or business associate role for each activity. HIPAA status depends on the organization’s work and relationships, not simply on its industry label.

Map which parts of the organization create, receive, maintain, or transmit identifiable health information, including work performed by outside service providers.

Keep useful evidence

Keep the evidence that supports the decision: keep dated evidence of decisions, training, risk analyses, agreements, and reviews so the organization can show how its program operates in practice. Make records understandable to the staff member who must act on them; a policy that exists only on paper cannot guide a real request or incident.

Assign an owner and a review date. Retain current versions and record material changes so the next reviewer can see what was decided, why it was reasonable for the situation, and what still needs attention.

Check exceptions before making a blanket rule

Treating HIPAA as a one-time certification, a software setting, or a rule that automatically covers every business connected to healthcare can leave important gaps. Determine which regulations apply to the specific organization and activity.

Apply the rule to the exact purpose and circumstances. State privacy laws, professional requirements, contracts, and other federal rules may add protections or obligations beyond the HIPAA baseline.

Review when the situation changes

Keep dated evidence of decisions, training, risk analyses, agreements, and reviews so the organization can show how its program operates in practice.

Make the process usable: give staff a clear owner, a simple escalation path, and a way to record the decision. Use a small sample of real workflows to find confusing steps before a privacy request or urgent incident arrives.

Common mistakes to avoid

Treating HIPAA as a one-time certification, a software setting, or a rule that automatically covers every business connected to healthcare can leave important gaps. Determine which regulations apply to the specific organization and activity.

Do not treat a checklist, vendor claim, signed agreement, training slide, or security product as a stand-alone compliance program. Confirm the actual rule, keep evidence of implementation, and revisit the assessment when the facts change.

25 things every business should know

• First determine whether your organization is a HIPAA covered entity, business associate, or neither; status depends on regulated roles and activities, not size or marketing label.
• PHI is individually identifiable health information held or transmitted by a covered entity or business associate, in conversations, paper records, images, messages, and electronic systems.
• The Security Rule applies to electronic PHI and requires safeguards that fit documented risks.
• The Privacy Rule permits many treatment, payment, and health care operations activities without a separate authorization; other uses may require a valid authorization or specific regulatory permission.
• The minimum necessary standard applies to many uses, disclosures, and requests, with defined exceptions.
• Individuals generally have a right to access PHI in a designated record set; requests generally must be acted on within 30 calendar days, subject to limited exceptions and a permitted extension with written notice.
• Covered entities generally must provide a notice of privacy practices explaining uses, disclosures, and individual rights.
• Amendment, restriction, confidential communication, and complaint procedures should have a clear owner.
• Individuals can request an accounting of certain disclosures, subject to defined exceptions and procedures.
• Verify a requester’s identity and authority before disclosing records.
• Family members do not automatically have unrestricted access to an adult patient’s information.
• Parents are generally personal representatives for minor children, subject to important legal exceptions.
• Covered entities and business associates need a documented, accurate, and thorough security risk analysis that covers ePHI across systems, locations, devices, backups, and vendors.
• Administrative, physical, and technical safeguards address different parts of security and work together.
• Addressable Security Rule specifications require an implementation decision and documentation, not automatic omission.
• Unique user identification, appropriate access, audit controls, and authentication support accountability.
• Workforce training must match applicable policies, job duties, and required updates.
• A vendor handling PHI on behalf of a regulated organization may be a business associate.
• Required business associate agreements need to be in place for the applicable relationship and service.
• A business associate agreement does not replace a risk analysis, safeguards, or vendor oversight.
• Encryption is an addressable Security Rule specification; assess and document the appropriate implementation.
• Security incidents need a reporting, investigation, and corrective-action process.
• Breach notification decisions depend on unsecured PHI, regulatory exceptions, and a documented assessment.
• Covered-entity notifications are generally due without unreasonable delay and no later than 60 calendar days after discovery; business associates have separate duties to notify the covered entity.
• State laws may add protections; regularly review policies, training, vendor access, risk decisions, and current requirements as workflows and technology change.

Frequently asked questions