The Health Insurance Portability and Accountability Act (HIPAA) is a United States legislation that provides data privacy and security provisions for safeguarding medical information. It was enacted in 1996 with two main purposes: to provide continuous health insurance coverage for workers who lose or change their job, and to reduce the administrative burdens and cost of healthcare by standardizing the electronic transmission of administrative and financial transactions. Other goals of HIPAA include combating abuse, fraud, and waste in health insurance and healthcare delivery.

HIPAA compliance refers to the process of ensuring that your organization follows the rules set out by HIPAA. These rules are designed to protect the privacy and security of health information. This can include anything from patient records to payment details. Non-compliance can result in heavy fines and penalties, making it crucial for any organization that deals with protected health information (PHI) to ensure they are compliant.

Understanding HIPAA

The HIPAA law is divided into two main sections: Title I and Title II. Title I of HIPAA protects health insurance coverage for individuals who lose or change jobs. It also prohibits group health plans from denying coverage to individuals with specific diseases and pre-existing conditions, and from setting lifetime coverage limits. Title II of HIPAA, known as the Administrative Simplification (AS) provisions, requires the establishment of national standards for electronic health care transactions and national identifiers for providers, health insurance plans, and employers.

The AS provisions also address the security and privacy of health data. The standards are meant to improve the efficiency and effectiveness of the nation’s health care system by encouraging the widespread use of electronic data interchange in the U.S. health care system.

The Privacy Rule

The Privacy Rule, a key part of HIPAA, sets national standards for when protected health information (PHI) may be used and disclosed. It gives patients rights over their health information and sets rules and limits on who can look at and receive a patient’s health information. The Privacy Rule applies to all forms of individuals’ protected health information, whether electronic, written, or oral.

Under the Privacy Rule, covered entities (which include health plans, healthcare clearinghouses, and certain healthcare providers) must put in place safeguards to protect patient information. They must reasonably limit uses and disclosures to the minimum necessary to accomplish their intended purpose. They must have contracts in place with their contractors and others ensuring that they use and disclose patient information properly and safeguard it appropriately. Covered entities must also have procedures in place to limit who can view and access patient information as well as implement training programs for employees about how to protect patient information.

The Security Rule

The Security Rule, another part of HIPAA, sets standards for patient data security. It specifies a series of administrative, physical, and technical safeguards for covered entities to use to assure the confidentiality, integrity, and availability of electronic protected health information (ePHI). These rules apply to health plans, healthcare clearinghouses, and to any healthcare provider who transmits health information in electronic form.

Under the Security Rule, covered entities must implement technical policies and procedures that allow only authorized persons to access electronic protected health information (ePHI). They must also implement hardware, software, and/or procedural mechanisms to record and examine access and other activity in information systems that contain or use ePHI. In addition, they must put in place measures to protect against any reasonably anticipated threats or hazards to the security or integrity of ePHI.

HIPAA Compliance Requirements

HIPAA compliance involves fulfilling the requirements of HIPAA and its accompanying regulations, the Privacy Rule, the Security Rule, and the Breach Notification Rule. These rules require covered entities to implement several safeguards to protect PHI, including administrative, physical, and technical safeguards. In addition, covered entities are required to have a compliance officer and train their employees on HIPAA compliance.

Administrative safeguards involve the selection, development, implementation, and maintenance of security measures to protect PHI and manage the conduct of the covered entity’s workforce in relation to the protection of that information. Physical safeguards involve physical measures, policies, and procedures to protect a covered entity’s electronic information systems and related buildings and equipment from natural and environmental hazards, and unauthorized intrusion. Technical safeguards involve the technology and the policy and procedures for its use that protect PHI and control access to it.

Notice of Privacy Practices

As part of HIPAA compliance, covered entities are required to provide a Notice of Privacy Practices (NPP). The NPP must describe the ways in which the covered entity may use and disclose PHI. It must also state the covered entity’s duties to protect privacy, provide a notice of privacy practices, and abide by the terms of the current notice. The NPP must also describe individuals’ rights, including the right to complain to HHS and to the covered entity if they believe their privacy rights have been violated.

The NPP must be provided to every individual no later than the date of first service delivery and, except in an emergency treatment situation, the covered entity must make a good faith effort to obtain the individual’s written acknowledgment of receipt of the notice. If an acknowledgment cannot be obtained, the covered entity must document its efforts to obtain the acknowledgment and the reason why the acknowledgment was not obtained.

Business Associate Agreements

Another requirement for HIPAA compliance is the establishment of Business Associate Agreements (BAAs). A BAA is a contract between a HIPAA-covered entity and a HIPAA business associate (BA). The contract protects PHI in accordance with HIPAA guidelines. When a covered entity uses a contractor or other non-staff member to perform “business associate” services or activities, the Rule requires that the covered entity include certain protections for the information in a business associate agreement.

In the business associate agreement, a covered entity must impose specified written safeguards on the individually identifiable health information used or disclosed by its business associates. Moreover, a covered entity may not contractually authorize its business associate to make any use or disclosure of protected health information that would violate the Rule.

Enforcement and Penalties for Non-Compliance

The Office for Civil Rights (OCR) enforces the HIPAA Privacy Rule and the HIPAA Security Rule. The OCR investigates complaints filed with it, and conducts compliance reviews to determine if covered entities are in compliance. Moreover, it provides education and outreach to foster compliance with the rules’ requirements. The OCR also works with the Department of Justice to refer possible criminal violations of the rules.

Penalties for non-compliance with HIPAA can be severe. The penalties for noncompliance are based on the level of negligence and can range from $100 to $50,000 per violation (or per record), with a maximum penalty of $1.5 million per year for violations of an identical provision. Violations can also carry criminal charges that can result in jail time.


Individuals who believe that a covered entity has violated their (or someone else’s) health information privacy rights or committed another violation of the Privacy, Security, or Breach Notification Rules, may file a complaint with OCR. Complaints must be filed in writing, either on paper or electronically, and must name the entity that is believed to have violated the rights and describe the acts or omissions believed to be in violation of the applicable requirements.

OCR can investigate any complaint filed under this procedure. A retaliation complaint, however, may be filed regardless of when the retaliatory act occurred. The OCR can also initiate a compliance review to investigate a covered entity.


Penalties for non-compliance with HIPAA can be severe. The penalties for noncompliance are based on the level of negligence and can range from $100 to $50,000 per violation (or per record), with a maximum penalty of $1.5 million per year for violations of an identical provision. Violations can also carry criminal charges that can result in jail time.

There are four categories of violations that reflect increasing levels of culpability, and four corresponding tiers of penalty amounts, with a maximum penalty of $1.5 million per year for violations of an identical provision. In some cases, individuals who knowingly obtain or disclose individually identifiable health information in violation of the Privacy Rule may face a criminal penalty of up to $50,000 and up to one-year imprisonment. The criminal penalties increase to $100,000 and up to five years imprisonment if the wrongful conduct involves false pretenses, and to $250,000 and up to ten years imprisonment if the wrongful conduct involves the intent to sell, transfer, or use identifiable health information for commercial advantage, personal gain or malicious harm.


HIPAA compliance is a critical aspect of healthcare operations in the United States. With the increasing digitization of health records and the high value of health information for malicious actors, ensuring the privacy and security of patient information is more important than ever. By understanding and adhering to the requirements of HIPAA, healthcare organizations can better protect their patients and avoid the substantial penalties associated with non-compliance.

It is important to note that while this article provides a comprehensive overview of HIPAA compliance, it is not exhaustive. HIPAA is a complex piece of legislation with many nuances and specifics that are beyond the scope of this article. Therefore, it is recommended that healthcare organizations consult with legal and compliance experts to ensure they are fully compliant with all aspects of HIPAA.

With cybersecurity threats on the rise, organizations need to protect all areas of their business. This includes defending their websites and web applications from bots, spam, and abuse. In particular, web interactions such as logins, registrations, and online forms are increasingly under attack.

To secure web interactions in a user-friendly, fully accessible and privacy compliant way, Friendly Captcha offers a secure and invisible alternative to traditional captchas. It is used successfully by large corporations, governments and startups worldwide.

Want to protect your website? Learn more about Friendly Captcha »