HIPAA: What It Is and How Purplecop Helps

What is HIPAA?

HIPAA is Public Law 104-191, approved on August 21, 1996. Its Administrative Simplification subtitle states a purpose of "encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information" (section 261).

The requirements most people mean by "HIPAA" sit in 45 CFR Parts 160 and 164, in three groups:

• Privacy Rule (Part 164, Subpart E): when protected health information (PHI) may be used and disclosed, and individuals' rights over it.
• Security Rule (Subpart C): safeguards for electronic PHI (ePHI).
• Breach Notification Rule (Subpart D): who must be told after a breach of unsecured PHI, and when.

Who has to comply with HIPAA?

The Rules apply to "covered entities": health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with a covered transaction (45 CFR 160.102(a)). Where provided, they also apply to business associates (160.102(b)): in outline, people who create, receive, maintain or transmit PHI on a covered entity's behalf, or provide services such as legal, accounting or consulting that involve PHI. Subcontractors that handle PHI are included (160.103).

Three limits matter:

• Who holds the data decides. Health information held by an organization that is neither a covered entity nor a business associate is outside these Rules.
• Some records are not PHI, including education records covered by the Family Educational Rights and Privacy Act and employment records held by a covered entity as employer (160.103).
• Stricter state privacy law stays. A State law on health information privacy that is more stringent than the Privacy Rule is not preempted (160.203(b)).

What does the Privacy Rule require?

A covered entity or business associate may not use or disclose PHI except as the Privacy Rule permits or requires (164.502(a)). Permitted uses include disclosure to the individual, for treatment, payment or health care operations, and under a valid authorization. Main duties, most of which fall on covered entities rather than business associates:

• Minimum necessary: make reasonable efforts to limit PHI to the minimum necessary, with exceptions such as disclosures for treatment (164.502(b)).
• Notice: individuals have a right to adequate notice of privacy practices (164.520).
• Access: individuals may inspect and obtain a copy of PHI in a designated record set. The entity must act within 30 days, with one extension of up to 30 days (164.524).
• Business associate contracts: a written contract or other arrangement setting permitted uses and requiring safeguards (164.502(e), 164.504(e)).
• Administration: a privacy official, workforce training, and policies and documentation kept six years (164.530).

What does the Security Rule require?

The Security Rule covers ePHI. Covered entities and business associates must ensure its confidentiality, integrity and availability, protect against reasonably anticipated threats, and ensure workforce compliance (164.306(a)). They may choose measures that fit their size, infrastructure, costs and risks (164.306(b)).

Standards carry "required" and "addressable" implementation specifications (164.306(d)). Addressable is not optional: the entity must assess each one and, if it is not reasonable and appropriate, document why and implement an equivalent alternative where reasonable.

• Administrative (164.308): required risk analysis and risk management, a sanction policy, activity review, a security official, training, incident response, contingency planning and periodic evaluation.
• Physical (164.310): facility access, workstation use and security, device and media controls.
• Technical (164.312): access control with unique user identification, audit controls, integrity, authentication and transmission security. Encryption is addressable.
• Documentation (164.316): written policies and records kept six years.

What must happen after a breach of PHI?

The Breach Notification Rule covers "unsecured" PHI, meaning PHI not rendered unusable, unreadable or indecipherable to unauthorized persons by a method the Secretary specifies (164.402). An impermissible use or disclosure is presumed to be a breach unless the entity shows a low probability of compromise after assessing at least four factors (164.402).

Deadlines (a law-enforcement delay under 164.412 can postpone notification):

• Individuals: without unreasonable delay and no later than 60 calendar days after discovery (164.404(b)).
• HHS: for 500 or more individuals, at the same time as individual notice; for fewer, within 60 days after the end of the calendar year (164.408).
• Media: for more than 500 residents of one State or jurisdiction, within the same 60-day limit (164.406).
• Business associate to covered entity: without unreasonable delay and no later than 60 calendar days after discovery (164.410).

What happens if an organization breaks HIPAA?

Anyone who believes an entity is not complying may file a complaint with the Secretary, generally within 180 days (160.306), and the Secretary may run compliance reviews (160.308). Where an investigation or compliance review indicates non-compliance, the Secretary may try to resolve the matter by informal means, such as a corrective action plan (160.312). If it is not resolved, the Secretary can impose a civil money penalty (160.402), subject to affirmative defenses (160.410).

Penalties are tiered by culpability: did not know, reasonable cause, willful neglect corrected within 30 days, and willful neglect not corrected (160.404(b)(2)). Dollar amounts are adjusted for inflation each year and published at 45 CFR Part 102 (160.404(a)); this page does not quote them.

Is there a HIPAA certification?

No. In 45 CFR Parts 160 and 164 the obligations are legal requirements enforced through complaints, compliance reviews and civil money penalties. The text sets up no certification or accreditation scheme, so "HIPAA compliant" is a vendor's own claim, not a status issued under the Rules.

Certification or attestation against another framework, such as ISO/IEC 27001 or SOC 2, comes from independent bodies, not HHS. The Rules do not say either satisfies HIPAA.

Does Purplecop help with HIPAA?

Purplecop Security's GRC & Compliance Advisory service lists HIPAA under "Framework adoption", alongside ISO/IEC 27001, SOC 2, NIST CSF 2.0, PCI DSS, DPDPA and GDPR. Its page also describes a "Gap assessment against your target framework, with a prioritised remediation plan".

This is advisory support. It does not make an organization compliant with HIPAA, and the Rules provide no HIPAA certification for Purplecop or anyone else to issue. Responsibility rests with the covered entity or business associate. HHS enforces the Rules, and State attorneys general can also bring civil actions (42 U.S.C. 1320d-5(d)). For other privacy laws, see the GDPR and DPDP Act pages.

What is protected health information (PHI)?

PHI is individually identifiable health information transmitted or maintained in any form or medium, with exclusions such as employment records held by a covered entity as employer (45 CFR 160.103).

Who is a business associate?

A person who creates, receives, maintains or transmits PHI for a covered entity, or provides services such as legal, accounting or consulting that involve PHI. Subcontractors handling PHI are included. A written contract or other arrangement is required (164.504(e), 164.308(b)).

Are "addressable" Security Rule requirements optional?

No. The entity must assess each one and, if it is not reasonable and appropriate, document why and implement an equivalent alternative where reasonable (164.306(d)(3)).

How soon must a HIPAA breach be reported?

Individuals must be notified without unreasonable delay and within 60 calendar days of discovery at the latest, except where a law-enforcement delay applies (164.404, 164.412). HHS and media notice depend on the number of people affected (164.406, 164.408).

Is there an official HIPAA certification?

No. The regulations create no certification scheme. Compliance is a legal obligation assessed by HHS through complaints and compliance reviews (160.306, 160.308).

Can Purplecop make my organization HIPAA compliant?

No. Compliance is the legal responsibility of the covered entity or business associate. Purplecop Security's GRC & Compliance Advisory service lists HIPAA in its framework adoption work.