HIPAA compliance means following the federal rules that protect patients’ health information: the Privacy Rule, the Security Rule, and the Breach Notification Rule. It applies to covered entities (healthcare providers, health plans, and clearinghouses) and to their business associates, such as IT, billing, and cloud vendors that handle protected health information (PHI). Compliance requires administrative, physical, and technical safeguards, documented policies, workforce training, and an up-to-date risk analysis.
This guide explains what HIPAA compliance is, what counts as PHI, the three core rules, who must comply, how to become compliant, current penalty amounts, and the latest regulatory updates for 2026.
What Is HIPAA Compliance?
HIPAA, the Health Insurance Portability and Accountability Act of 1996, is a federal law that sets national standards for how health information can be used, disclosed, and protected. The U.S. Department of Health and Human Services (HHS) issues the regulations, and the HHS Office for Civil Rights (OCR) enforces them.
HIPAA compliance is more than a checklist. It is an ongoing program and a culture of protecting patient information. Organizations that build it into daily operations protect patient privacy and avoid legal, financial, and reputational consequences.
Note that there is no official government “HIPAA certification.” Third-party assessments and training certificates can help demonstrate diligence, but compliance is measured by your safeguards, documentation, and ongoing risk management.
History of HIPAA Regulations
HIPAA was passed by Congress and signed into law by President Bill Clinton in 1996. It had three main objectives:
- Modernize how healthcare information is managed and exchanged electronically.
- Protect individually identifiable health information in healthcare and health insurance.
- Address insurance coverage continuity during job changes and coverage of pre-existing conditions.
HHS then issued the Privacy Rule (compliance required from 2003), the Security Rule (2005), and, after the HITECH Act of 2009, the Breach Notification Rule and the 2013 Omnibus Rule, which extended direct liability to business associates.
What Is Protected Health Information Compliance (PHI Compliance)?
Understanding what counts as protected health information is essential to HIPAA compliance. According to HHS, PHI is individually identifiable health information held or transmitted by a covered entity or its business associate, in any form: electronic, paper, or oral. PHI includes medical records, billing details, treatment plans, lab results, insurance claims, and any information about a person’s physical or mental health, care, or payment for care that can identify them. Electronic PHI is called ePHI.
Key Elements of PHI Compliance
PHI compliance rests on three elements.
Patient Privacy
Unauthorized access to health records can harm patients financially, emotionally, and even physically. Limiting access to the minimum necessary information protects them.
Data Security
Health records are prime targets for identity theft, fraud, and extortion. Strong safeguards prevent unauthorized access and limit the damage of incidents. The scale is significant: HIPAA Journal’s analysis of OCR data found a record 289 million individuals affected by large healthcare breaches in 2024, driven by the Change Healthcare ransomware attack, and at least 61.5 million in 2025.
Federal Compliance
Failing to meet HIPAA requirements can result in civil money penalties of more than $2.1 million per violation category per year, corrective action plans, state attorney general actions, and, for knowing misuse of PHI, criminal charges.
PHI Compliance Identifiers
Under the HIPAA Privacy Rule’s Safe Harbor method, health information is de-identified only when all 18 identifiers are removed:
- Names
- Geographic subdivisions smaller than a state (street address, city, county, ZIP code, with limited exceptions)
- All elements of dates (except year) related to an individual, such as birth, admission, discharge, or death dates
- Telephone numbers
- Fax numbers
- Email addresses
- Social Security numbers
- Medical record numbers
- Health plan beneficiary numbers
- Account numbers
- Certificate or license numbers
- Vehicle identifiers and serial numbers, including license plates
- Device identifiers and serial numbers
- Web URLs
- IP addresses
- Biometric identifiers, including finger and voice prints
- Full-face photographs and comparable images
- Any other unique identifying number, characteristic, or code
HIPAA Mandated Security Standards: The Three Core Rules
HIPAA compliance centers on three rules.
HIPAA Privacy Rule
The Privacy Rule sets standards for when PHI may be used or disclosed, and gives individuals rights over their information, including the right to access their records and request corrections. Disclosures generally require patient authorization unless they are for treatment, payment, or healthcare operations, or fall under one of 12 national priority purposes, such as:
- Reporting victims of abuse, neglect, or domestic violence
- Judicial and administrative proceedings
- Cadaveric organ, eye, or tissue donation
- Workers’ compensation
- Public health activities and serious threats to health or safety
HIPAA Security Rule
The Security Rule requires covered entities and business associates to protect ePHI with administrative, physical, and technical safeguards that are reasonable and appropriate for their size and risk. Its core requirements are to:
- Ensure the confidentiality, integrity, and availability of ePHI
- Identify and protect against reasonably anticipated threats, through a documented risk analysis and risk management plan
- Protect against impermissible uses and disclosures
- Ensure workforce compliance through training and sanctions
HIPAA Breach Notification Rule
The Breach Notification Rule requires covered entities to notify affected individuals, HHS, and in some cases the media after a breach of unsecured PHI, no later than 60 days after discovery. Business associates must notify the covered entity. Breaches affecting 500 or more people are posted on the OCR breach portal. Under the HITECH Act, the Federal Trade Commission enforces similar rules for vendors of personal health records and health apps not covered by HIPAA.
Do I Need to Be HIPAA Compliant?
Two types of organizations must comply: covered entities and business associates.
Covered Entities
- Healthcare providers that conduct standard electronic transactions, such as doctors, clinics, hospitals, dentists, pharmacies, psychologists, and nursing homes
- Health plans, including HMOs, PPOs, Medicare and Medicaid programs, and employer-sponsored group health plans
- Healthcare clearinghouses that convert nonstandard health information into standard formats
Business Associates
Business associates are organizations that create, receive, maintain, or transmit PHI on behalf of a covered entity, such as:
- Billing and coding companies
- EHR and cloud hosting vendors
- IT and managed service providers
- Consultants, auditors, and law firms
Business associates are directly liable for Security Rule compliance and must sign a business associate agreement (BAA). In 2025, 35.8% of large healthcare breaches occurred at business associates, according to HIPAA Journal, which is why vendor oversight matters.
How Do I Become HIPAA Compliant?
The HHS Office of Inspector General (OIG) defines seven elements of an effective compliance program. A HIPAA program should meet these elements and address all Privacy, Security, and Breach Notification requirements.
Follow the 7 Key Elements of HIPAA Compliance
- Implement written policies, procedures, and standards of conduct.
- Designate a compliance officer (and privacy and security officers) and a compliance committee.
- Conduct effective training and education.
- Develop effective lines of communication, including anonymous reporting.
- Conduct internal monitoring and auditing.
- Enforce standards through well-publicized disciplinary guidelines.
- Respond promptly to detected problems and take corrective action.
During an OCR investigation, auditors evaluate how well your program meets these elements. In 2025, risk analysis failures were cited in 76% of OCR’s HIPAA enforcement actions, according to HIPAA Journal, so start there.
Ensure Your Safeguards and Policies Follow HIPAA Guidelines
A complete program combines physical and technical safeguards with clearly defined policies.
Physical Safeguards
- Facility access control: limit access to areas containing PHI with access control cards, video surveillance, and visitor management. See our healthcare security systems.
- Workstation use and security: position screens away from public view, use privacy filters, and lock unattended devices.
- Device and media controls: track devices holding PHI and wipe or destroy media before disposal or reuse.
Technical Safeguards
- Encryption: encrypt ePHI in transit (TLS) and at rest on servers, laptops, and mobile devices.
- Unique user authentication: give every user unique credentials and use multi-factor authentication.
- Audit controls: log and review access to systems containing ePHI to detect incidents and enforce policy.
- Integrity and transmission security: protect ePHI from improper alteration and interception.
Policies and Procedures
- Risk analysis and risk management: assess physical and technical vulnerabilities at least annually and after major changes, and document how risks are reduced.
- Training programs: train all workforce members on HIPAA and security awareness, with documented refreshers.
- Breach notification policy: define how incidents are investigated and how notifications are made within required timelines.
- Contingency planning: maintain backups, disaster recovery, and emergency operations plans for ePHI systems.
HIPAA Compliance Requirements Checklist
- Administrative safeguards: policies, privacy and security officers, training, and risk management
- Physical safeguards: controlled facility access, workstation security, and secure device disposal
- Technical safeguards: access controls, encryption, audit logs, and monitoring
- Breach notification: procedures to notify individuals, HHS, and media
- Business associate agreements: signed BAAs with every vendor that handles PHI
- Privacy Rule compliance: notice of privacy practices, authorizations, and patient access
- Security Rule compliance: documented, risk-based safeguards for ePHI
HIPAA Compliance Violations
Violations can bring major fines, corrective action plans, reputational damage, and legal action.
Types of HIPAA Compliance Violations
- Unauthorized access or disclosure: accessing or sharing PHI without authorization, including snooping by employees
- Breach notification failure: missing required notification deadlines
- Lack of safeguards: missing risk analysis, encryption, or access controls
- Right of access failures: not giving patients timely access to their records
- Poor training: inadequate workforce training leading to mistakes
Types of HIPAA Penalties
The Office for Civil Rights (OCR) enforces HIPAA using four tiers of civil money penalties based on culpability. Amounts are adjusted for inflation each year. For penalties assessed on or after January 28, 2026:
| Tier | Culpability | Per violation | Calendar-year cap (identical provision) |
|---|---|---|---|
| 1 | Did not know (and with reasonable diligence would not have known) | $145 to $73,011 | $2,190,294 |
| 2 | Reasonable cause, not willful neglect | $1,461 to $73,011 | $2,190,294 |
| 3 | Willful neglect, corrected within 30 days | $14,602 to $73,011 | $2,190,294 |
| 4 | Willful neglect, not corrected within 30 days | $73,011 to $2,190,294 | $2,190,294 |
Under a 2019 notice of enforcement discretion, HHS applies lower annual caps for tiers 1 through 3 ($25,000, $100,000, and $250,000 before inflation adjustments). Criminal penalties for knowingly obtaining or disclosing PHI are enforced by the Department of Justice.
Recent HIPAA Compliance Updates
HHS continues to update HIPAA requirements and enforcement priorities. Here is what covered entities and business associates should track in 2026.
Proposed HIPAA Security Rule Overhaul
In January 2025, OCR proposed the first major update to the Security Rule since 2013, including mandatory multi-factor authentication, encryption, network segmentation, asset inventories, and annual compliance audits. As of October 2026 the rule has not been finalized; the HHS 2026 regulatory agenda moved the final action to a long-term target of July 2027, per the EHR Association. The current Security Rule remains fully enforceable, and the proposed controls are already security best practice.
Risk Analysis Enforcement Initiative
OCR’s risk analysis initiative drove most 2025 enforcement actions, and OCR has said it will continue in 2026, expanding to risk management. Expect investigators to ask for a current, organization-wide risk analysis and evidence that identified risks were addressed.
Information Blocking Rule: Improving Data Sharing in Healthcare
Since April 5, 2021, the 21st Century Cures Act information blocking rules have required providers, health IT developers, and health information networks to avoid practices that interfere with access, exchange, or use of electronic health information. HHS has since finalized disincentives for providers found to engage in information blocking.
OCR’s Right of Access Initiative
OCR continues to penalize providers that fail to give patients timely access to their records or overcharge for copies. Respond to requests within 30 days and charge only reasonable, cost-based fees.
Ransomware and Cybersecurity Guidance
Hacking and IT incidents remain the leading cause of large healthcare breaches. HHS guidance stresses regular risk assessments, workforce training, offline backups, and tested incident response plans. HHS also publishes voluntary Healthcare and Public Health Cybersecurity Performance Goals.
Telehealth After the Public Health Emergency
OCR’s COVID-19 telehealth enforcement discretion ended with the public health emergency in May 2023, followed by a transition period that ended August 9, 2023. Providers must now use telehealth platforms that comply with HIPAA and sign a BAA with the vendor.
Related reading: what CMMC is for defense contractors, and our overview of regulatory compliance across industries.
Looking for a HIPAA Service Provider?
BTI Communications Group has been in business for 40 years and works with covered entities and business associates of every size. We help healthcare organizations implement the technical and physical safeguards HIPAA requires, from risk assessments, encryption, MFA, backups, and monitoring to access control and video surveillance. Explore our healthcare technology services and sign a BAA with a partner that understands compliance.
This article is for general information and is not legal advice. Consult qualified counsel for your specific obligations.
Frequently Asked Questions
Who needs to be HIPAA compliant?
Covered entities (healthcare providers that conduct electronic transactions, health plans, and healthcare clearinghouses) and their business associates, such as IT, billing, and cloud vendors that create, receive, maintain, or transmit PHI.
What does HIPAA not cover?
HIPAA covers PHI held by covered entities and business associates. It generally does not cover employment records held by an employer, student records covered by FERPA, or health data in consumer apps not offered on behalf of a covered entity, although the FTC and state laws may apply.
What are the HIPAA penalties in 2026?
For penalties assessed on or after January 28, 2026, civil money penalties range from $145 to $73,011 per violation for lower tiers, up to $2,190,294 per violation for uncorrected willful neglect, with a calendar-year cap of $2,190,294 per identical provision.
Is there an official HIPAA certification?
No. HHS does not certify organizations as HIPAA compliant. Third-party assessments and training certificates can show diligence, but compliance depends on your safeguards, documentation, and risk management.
Get a free IT and cyber risk assessment
See where your network, backups, and security controls stand today. BTI delivers an itemized findings report with prioritized fixes and fixed-cost options. Call 800-435-7284 or request your assessment online.
