HIPAA became law in 1996, and many healthcare organizations still aren't sure what it requires. They know it's about "protecting patient data"; the specifics get lost in compliance anxiety. Here's a clear breakdown.
The Three Rules That Matter
The Privacy Rule
National standards for protecting medical records and personal health information:
- Patients can request copies of their records, corrections, and an accounting of disclosures.
- There are hard limits on who can see health records and when.
- Providers, health plans, and clearinghouses must protect health information.
It covers PHI in every form: paper, electronic, and spoken. Yes, including the hallway conversation about a patient.
The Security Rule
The Privacy Rule's technical sibling, covering electronic PHI (ePHI). It requires three kinds of safeguards:
Administrative: risk assessments, workforce training, contingency plans, and a designated security officer.
Physical: facility access controls, workstation security, and device and media handling.
Technical: access controls with unique user IDs, audit logs of who accessed what and when, integrity controls, and encryption. The rule doesn't name specific technologies; AES-256 at rest and TLS in transit are the common choices. Whatever you choose must be documented and reviewed.
The Enforcement Rule
How violations are investigated and penalized. Civil penalties are tiered by culpability, from "didn't know" to "willful neglect, not corrected," and are adjusted for inflation each year. Per-violation amounts run from about a hundred dollars to tens of thousands, with annual caps above $2 million per violation category. Criminal charges are possible. A breach also costs patient trust, which is harder to recover.
What Compliance Looks Like Day to Day
Risk assessments are ongoing. Know where ePHI lives, how it moves, and what could go wrong, and revisit it regularly.
Access is role-based. Not everyone needs access to everything.
Training is continuous. Annual training is the minimum. New tools and workflows need their own briefing.
Every vendor touching PHI signs a BAA. Your form platform, cloud storage, email service, and any third party handling ePHI. No exceptions.
Have a breach plan before a breach. Documented steps to identify, contain, and report, including notifying affected individuals within 60 days.
Digital Makes It Harder, and Easier
Digital intake, telemedicine, and portals mean more systems and more failure points. But tools built correctly make compliance easier: encryption is automatic, audit logs are complete without manual effort, and access controls are enforced by the system instead of memory.
Choose tools with HIPAA built in (US hosting, encryption at rest and in transit, audit logs, a BAA) rather than retrofitting compliance onto platforms that weren't built for it.
The Bottom Line
The organizations that handle HIPAA best aren't the ones with the biggest budgets. They understand the requirements and build them into their workflows. When choosing software, verify the security specs, get the BAA, check where data is hosted, and look at the audit logs.
Related: patient intake software | intake form templates | HIPAA compliance
Collect patient information on HIPAA-ready forms.
- Forms, consents, and signatures before the visit
- Your paper forms converted by AI
- BAA included