What HIPAA actually is, in plain English.
A federal obligation you must be able to prove on demand, not a certificate you earn. No badge, no auditor, no public registry, just the rule, your duty under it, and the regulator who enforces it.
The statute, in full
HIPAA is a federal statute, the Health Insurance Portability and Accountability Act of 1996, whose privacy and security provisions were materially expanded by the HITECH Act of 2009 and codified by HHS as regulations at 45 CFR Parts 160, 162, and 164. There is no certifying body. There is no auditor who issues a HIPAA certificate. There is no logo. There is the rule, your obligation under it, and the regulator who enforces it, after a breach, a complaint, an access dispute, a media report, or a compliance review.
The framework is four rules: the Privacy Rule (§164.500-534) governs uses and disclosures of protected health information; the Security Rule (§164.302-318) sets administrative, physical, and technical safeguards for electronic PHI; the Breach Notification Rule (§164.400-414) imposes the 60-day clock when unsecured PHI is breached; and the Enforcement Rule (§160.300-552) sets civil money penalties tiered by culpability. The statute reaches two classes of organization. Covered Entities are health plans, health-care clearinghouses, and most providers; Business Associates are anyone who creates, receives, maintains, or transmits PHI on a CE’s behalf. HITECH made BAs and their subcontractors directly liable; the BAA is the contractual chain that flows obligations down.
Enforcement is by HHS OCR, with state attorneys general empowered under HITECH to bring parallel actions, and a small number of criminal referrals to DOJ each year. OCR opens a matter in several ways: a breach report you file, a patient complaint, a right-of-access complaint, a media report, or a compliance review it starts on its own. What unites all of them is one demand: prove you met the rule. Under §164.414 the burden of proof sits with you, not the regulator. Everything else, the binders, the annual training certificates, the policies in SharePoint, is preparation for the day someone asks you to prove it.
A policy exists.
A privacy or security policy sits in SharePoint. It states intent, and on its own, it proves nothing about whether the program actually runs.
Does this apply to you?
A three-question filter we run on every healthcare intake call. The right answer to even one of these means HIPAA reaches your contract, BAA chain, breach clock, and all.
HIPAA scope check
The four rules, and the three categories of safeguard.
Privacy and Security are non-negotiable, and every CE and BA must comply. Breach Notification is what you execute the day something goes wrong. Enforcement is what OCR does afterward. Expand each rule to see the citations and the artifacts you must be able to produce when the burden of proof is tested.
Privacy · §164.500 Privacy Rule Required · uses & disclosures
Governs every use, disclosure, and request for PHI, whether oral, paper, or electronic. Built around permitted purposes (treatment, payment, operations) and the minimum-necessary rule. Operationalized through Notice of Privacy Practices, authorizations, individual rights, and the Privacy Officer role.
Security-A · §164.308 Administrative Safeguards Required · 9 standards
Nine standards under §164.308. This is where most programs fail. Risk analysis, risk management, sanctions, workforce clearance, training, incident procedures, contingency planning, evaluation, and BA contracts. Several specs here are addressable (§164.306(d)), not optional, but satisfied either by implementing the safeguard or by documenting why it isn’t reasonable and adopting a reasonable equivalent.
Security-P · §164.310 Physical Safeguards Required · 4 standards
Four standards under §164.310. Often dismissed by cloud-native shops: “AWS handles it.” Wrong. Your workforce’s physical access to ePHI, on laptops, paper, and screens in coffee shops, is yours, regardless of where the data sits.
Security-T · §164.312 Technical Safeguards Required · 5 standards
Five standards under §164.312. Encryption is an addressable specification (§164.306(d)), and if you don’t encrypt PHI at rest or in transit, you must document why and implement a reasonable equivalent. OCR has repeatedly cited unencrypted ePHI in recent settlements; in our view, for modern cloud workloads a defensible non-encryption alternative is very hard to construct.
Breach · §164.400 Breach Notification 60-day clock · §164.404-410
When unsecured PHI is acquired, accessed, used, or disclosed in a manner not permitted, and you cannot demonstrate low probability of compromise via a documented four-factor risk assessment, you have a breach. The clock is 60 days from discovery, not from the incident. See the full clock.
Covered Entity vs Business Associate, both are directly liable.
Pre-HITECH, BAs answered to the CE. Post-HITECH, BAs answer directly to OCR, with the same penalty schedule, same breach clock, same right of investigation. The distinction matters for which obligations attach. The penalties don’t care.
Covered Entity
Health plans, healthcare clearinghouses, and most providers transmitting any HHS-defined transaction electronically. Bears the full weight of Privacy + Security + Breach + Enforcement; owns the patient relationship and the Notice of Privacy Practices.
Obligations · Privacy → penalty exposure
- Privacy RuleFull: NPP, individual rights, accounting
- Security RuleFull: admin / physical / technical safeguards
- Breach: to whomIndividual, HHS, media (≥500)
- Breach clock startsOn discovery by anyone in the workforce
- BAA chainIssues BAAs to every BA
- OCR investigation triggerSelf-report, complaint, media
- Civil-penalty exposureUp to $2.13M per violation type / yr
Business Associate
Anyone who creates, receives, maintains, or transmits PHI on behalf of a CE, such as SaaS, hosting, analytics, billing, transcription, and AI vendors. Directly liable under HITECH. Subcontractors are themselves BAs and must sign downstream BAAs.
Obligations · Privacy → penalty exposure
- Privacy RuleLimited: only as required by BAA + minimum necessary
- Security RuleFull: same standards as a CE
- Breach: to whomThe CE, without unreasonable delay (§164.410)
- Breach clock startsOn discovery; CE’s 60-day clock starts when CE learns
- BAA chainSigns CE’s BAA and issues BAAs to subcontractors
- OCR investigation triggerCE’s breach report, the BA’s own report, complaint
- Civil-penalty exposureSame penalty tiers; scoped to BA-applicable provisions
The clock starts.
A helpdesk ticket arrives, a patient saw someone else’s record. No legal review. No confirmation. No decision that it’s a breach. Under §164.404(b), the 60-day clock is already running.
The 60-day breach-notification clock: minute by minute.
The breach clock is the most visible moment the burden of proof comes due, though a complaint or access request can demand the same evidence with no clock at all. From discovery to filed notice: the clock starts when any member of your workforce first knows or should reasonably have known. Not when legal confirms. Not when the forensics report lands. Discovery.
Senior partner from day one. Evidence-led from week one.
Partner-led from intake through any OCR response. Evidence-led from week one. The proof assembled before the request arrives, not reconstructed under a 60-day clock.
Methodology detail
Most HIPAA programs we inherit were sold by a portal vendor, with a policy template library, a training LMS, a BAA generator, and a green dashboard. They are not wrong; they are insufficient. None of them survive an OCR Data Request Letter. We are not a portal. Every Nexurion HIPAA engagement is led by a senior practitioner. The person on the engagement letter is the person re-doing your §164.308(a)(1)(ii)(A) risk analysis, sitting in your monthly Privacy Officer meeting, and on the call when an engineer reports something that might be a breach. Read our methodology.
Evidence-led methodology means we operate as if the burden of proof could be called tomorrow, by a breach, a complaint, or an access request. Risk analysis is dated, scoped to all ePHI, and re-run on material change, not annually as a calendar event. Safeguards documented in the analysis are demonstrated in the live environment within 90 days. The incident-response runbook is rehearsed at a tabletop with engineering, legal, comms, and the named Privacy Officer on the line, before the actual incident. We hand OCR (or a buyer’s assessor) a read-only audit-room with every artifact pre-mapped to the rule citation it satisfies. More on operational controls »
The goal is not a passed inspection. HIPAA has no inspection. The goal is a program that is boring on the day OCR opens the file, because every claim in it is already backed by dated, retrievable evidence. See engagement outcomes.
We are not a CPA firm. We are not your lawyer. We are the senior practitioner between them.
HIPAA breaches are also legal events. We work alongside your healthcare-privacy counsel under privilege when warranted, in support of the lawyers who lead breach responses, not in their place. The CE’s Privacy Officer is yours; the runbook the workforce executes the morning after is ours. OCR & enforcement reality »
Six places HIPAA programs go sideways.
After a few dozen of these, the failure modes are remarkably consistent. Almost none are technical. Read another way, each is a way the proof goes missing, goes stale, or can’t be produced the moment it’s asked for.
A questionnaire is not a risk analysis.
Training without enforcement.
Sub-BAs nobody owns.
Choosing not to encrypt, without the memo.
Patient asked. Nobody answered.
The helpdesk sat on it.
There is no auditor. There is the regulator.
HIPAA has no certifying body and no annual external audit. What it has is the HHS Office for Civil Rights, the regulator that opens a matter when you self-report a breach, when a patient files a complaint (including a right-of-access complaint), when the press reports an incident, or on its own initiative through a compliance review. The periodic HIPAA Audit Program has been dormant since the 2016–17 Phase 2 cycle, though OCR has signaled intent to resume it. Each of these is the same thing wearing a different hat, a demand that you prove the program. Plan for all of them, not just the breach.
How OCR enforces — settlements, penalties, our role
OCR resolves most matters via Resolution Agreement and Corrective Action Plan, a settlement that includes a money payment and 1-3 years of mandated program work, monitored. Recent settlements have repeatedly cited failure to conduct an accurate and thorough risk analysis, failure to implement appropriate safeguards, and impermissible disclosures, the same three deficiencies, year after year. The HHS “Wall of Shame” publishes every breach affecting 500 or more individuals; your filing is posted there once OCR processes it.
Civil monetary penalties are tiered by culpability under §160.404 and inflation-adjusted annually, from no knowledge through willful neglect / corrected to willful neglect / not corrected, with the top tier’s annual cap approaching $2.13M per identical violation (2024 figures); the lower tiers are capped far below that. Criminal referrals to DOJ are rare but real for knowing wrongful disclosure. State attorneys general hold parallel HITECH authority and have used it in cases of their own.
Our role begins when an OCR Data Request Letter arrives, after a breach, a complaint, or a review, we reconstruct the program from your live evidence in days, not weeks, and sit with your privacy counsel through the response. The work is judged on whether the evidence holds, not on a promise about the outcome.
HIPAA against the rest of the stack.
HIPAA is the regulatory floor; almost every healthcare engagement also runs a framework on top: for assurance, for procurement, for AI governance. Where they overlap; where they don’t.
HIPAA against the rest of the stack.
HIPAA is the regulatory floor.
| Framework | Overlap with HIPAA | What you still need to do |
|---|---|---|
| HITRUST CSF | Very high: HITRUST was built around HIPAA Security; r2 is the de-facto attestation many payers ask for in lieu of HIPAA proof. | HITRUST assessment program (e1 / i1 / r2), authorized assessor, MyCSF licensing. |
| SOC 2 Type 2 | Substantial: CC6 / CC7 cover most of the Security Rule’s technical safeguards. | HIPAA-specific obligations: BAAs, breach-notification procedures, minimum-necessary rule, OCR-defensible risk analysis. |
| ISO 27001 : 2022 | High: Annex A controls map cleanly to administrative + technical safeguards. | HIPAA-specific: BAA chain, breach clock, individual rights, accounting of disclosures, NPP. |
| NIST SP 800-66 r2 | Security Rule only: NIST’s implementation guide for the HIPAA Security Rule. The federal “how to” reference for that one rule. | Privacy Rule, Breach Notification, and individual rights, 800-66 doesn’t cover them. |
| GDPR | Limited: largely orthogonal frameworks; some breach-notification overlap. | Lawful basis, DPIAs, controller / processor split, cross-border transfers, DSARs. HIPAA does not address these. |
| U.S. state privacy (CCPA, etc.) | PHI is often exempt, but the exemption is narrow and varies by statute. | Non-PHI consumer data is in scope of state laws; map carefully where the same record straddles both. |
| ISO 42001 (AI) | Minimal: orthogonal. AI risk applies on top of HIPAA. | AIMS, AI impact assessment, model lifecycle, BA-style coverage of AI vendors. See governance » |
The first material Security-Rule update in twenty years.
On December 27, 2024, HHS published a Notice of Proposed Rulemaking that, if finalized, would overhaul the HIPAA Security Rule for the first time since 2003. The comment period closed in March 2025. A final rule would then follow the standard rulemaking pipeline, but timing is uncertain and the proposal could change materially, or stall, before it is finalized. The NPRM proposed a general compliance window of roughly 180 days after the rule takes effect. None of the items below is in force today; treat them as direction of travel, and begin preparing now.
- The “addressable” distinction would go away. Encryption, MFA, vulnerability management, anti-malware, network segmentation: all proposed as required, with documented exceptions narrow and time-bound. If finalized, the defensible-memo era ends.
- Asset inventory + network map. Annual technology asset inventory and a current network map of ePHI flow, updated on material change. Most programs do not have this and have not for decades.
- Risk analysis specifications. The proposed rule is prescriptive about what “accurate and thorough” means: threat catalog, vulnerability catalog, predisposing conditions, likelihood, impact, risk level, and a written assessment.
- BA verification. Proposed annual written verification from BAs that the technical safeguards required by the rule are deployed. Your BAA template will need rewriting; your sub-BA inventory needs to support attestation.
- Compliance audit + penetration testing. Proposed annual compliance audit; pen-testing every 12 months. Vulnerability scanning every 6 months.
- 72-hour restoration objective. Critical relevant electronic information systems and data would be required to be restored within 72 hours of a loss (as proposed). Most contingency plans do not commit to this.
Read our deeper take in Field Notes Vol. III: “What the 2024 HIPAA Security Rule NPRM means if you’re a BA today.”
HIPAA is rarely the only framework.
A short list of what we typically scope alongside it: in order of how often the question comes up.
Frequently asked.
Are we HIPAA certified after readiness? +
When does the 60-day clock actually start? +
Is every security incident a breach? +
We’re a BA, do we need our own breach-notification process? +
What does HIPAA readiness cost? +
Does SOC 2 satisfy HIPAA? +
Does HITRUST r2 satisfy HIPAA? +
Does the 2024 NPRM change what we should do today? +
Field notes on HIPAA.
Pieces from Nexurion Field Notes directly relevant to the statute.