Law / regulation
USA
HIPAA
Health Insurance Portability and Accountability Act of 1996
HIPAA is the US law that protects health information. Its rules apply to covered entities (health plans, healthcare clearinghouses and most healthcare providers) and to business associates, the vendors that create, receive, maintain or transmit protected health information for them. SaaS, cloud and IT providers serving US healthcare are usually business associates and must sign a business associate agreement, implement the Security Rule, and report breaches. HHS proposed a major Security Rule update in January 2025; the final rule is now targeted for July 2027.
Mandatory: Mandatory for covered entities and their business associates
Quick facts
- What it covers
- Uses and disclosures of protected health information (PHI), security of electronic PHI, individuals' rights, and breach notification.
- Who needs it
- Healthcare SaaS, telehealth, health IT vendors (business associates)
- Why it matters
- Any IT or SaaS company handling patient data for US healthcare organisations is directly liable under HIPAA as a business associate, and healthcare buyers won't sign without a BAA.
- Key requirements
- Sign business associate agreements (BAAs) with covered entities and subcontractors
- Conduct and document a security risk analysis
- Administrative, physical and technical safeguards for ePHI
- Use and disclose PHI only as permitted, under the minimum necessary standard
- Notify breaches of unsecured PHI within the required time limits
- Policies, training, and six-year retention of documentation
- Where it applies
- USA
- Category
- Healthcare IT