HIPAA (Health Insurance Portability and Accountability Act) is a U.S. federal law enacted in 1996 designed to protect sensitive patient health information from being disclosed without the patient's consent or knowledge.

• Privacy Rule: Dictates how Protected Health Information (PHI) can be used and disclosed by covered entities. It gives patients rights over their health data, including the right to inspect and obtain a copy of their health records.

• Security Rule: Sets standards for safeguarding electronic Protected Health Information (ePHI). It mandates administrative, physical, and technical safeguards (e.g., data encryption, access controls).

• Breach Notification Rule: Requires covered entities to notify patients, the Department of Health and Human Services (HHS), and in some cases the media, when unsecured PHI is compromised.

• Omnibus Rule & Enforcement Rule: Establishes financial penalties for non-compliance and extends HIPAA obligations directly to business associates (vendors, cloud providers, contractors).

‍

• Covered Entities: Healthcare providers (doctors, hospitals, clinics), health plans (insurance companies), and healthcare clearinghouses

• Business Associates: Third-party entities that process, store, or transmit PHI on behalf of a covered entity (e.g., medical billing companies, IT services, cloud hosts)

‍