HIPAA Compliance Guide: Privacy, Security and Breach Notification Rules

Who HIPAA applies to

Covered entities (HHS):

• Health care providers, such as doctors, clinics, psychologists, dentists, nursing homes and pharmacies, but only if they transmit health information electronically in connection with a transaction for which HHS has adopted a standard
• Health plans, such as insurers, HMOs, company health plans, Medicare, Medicaid and military and veterans programs
• Health care clearinghouses

Business associates are vendors that create, receive, maintain or transmit PHI on a covered entity's behalf. Typical examples are cloud hosting, billing, analytics, IT support and SaaS platforms. A covered entity needs a written business associate agreement (BAA) with each one. Since HITECH, business associates are also "directly liable for compliance with certain provisions of the HIPAA Rules" (HHS). If you're neither a covered entity nor a business associate, HIPAA doesn't apply to you, though state health-privacy laws or the FTC may.

Key requirements

Security Rule (45 CFR Part 164, Subpart C)

The Security Rule is designed to be "flexible, scalable, and technology neutral". Every regulated entity must meet each standard, but implementation specifications are either:

• Required, meaning you must implement them, or
• Addressable, which does not mean optional. You implement the specification if it's reasonable and appropriate. If it isn't, you document why and adopt an equivalent alternative.

The safeguards fall into three groups:

• Administrative: risk analysis and risk management, a designated security official, workforce security and training, information access management, incident procedures, contingency planning and periodic evaluation.
• Physical: facility access controls, workstation use and security, and device and media controls.
• Technical: access control, audit controls, integrity, person or entity authentication, and transmission security.

Risk analysis is the foundation. HHS requires "an accurate and thorough assessment of the potential risks and vulnerabilities" to ePHI, because it shapes every other safeguard. OCR's risk analysis guidance draws on NIST SP 800-30 and SP 800-66. ONC and OCR also provide a free Security Risk Assessment Tool for smaller practices.

Privacy Rule (45 CFR Part 164, Subpart E)

The Privacy Rule covers:

• permitted uses and disclosures, with authorization required for most others
• the minimum necessary standard
• the Notice of Privacy Practices
• individuals' rights to access, amend and get an accounting of disclosures
• administrative requirements such as a privacy official, training, complaints and sanctions

Breach Notification Rule (45 CFR 164.400–414)

The Breach Notification Rule applies when unsecured PHI is breached:

The proposed Security Rule update (not final)

On 27 December 2024 OCR issued a Notice of Proposed Rulemaking, published at 90 FR 898 on 6 January 2025. It would:

• remove the required/addressable distinction
• require a technology asset inventory and network map
• require encryption at rest and in transit, and multi-factor authentication (with limited exceptions)
• require vulnerability scanning every six months and penetration testing every 12 months
• require 72-hour restoration procedures
• require an annual compliance audit

HHS states that "the current Security Rule remains in effect" while rulemaking continues. In the federal regulatory agenda the final rule has since been reclassified as a long-term action with a July 2027 target (HIPAA Simple summary). Treat the NPRM as a direction of travel and a good-practice benchmark, not as law.

Penalties

Civil money penalties are set in 45 CFR 160.404 and adjusted for inflation. HHS published the 2025 adjustment on 28 January 2026. It then announced no adjustment for 2026, so these amounts still apply:

The cap applies per identical provision per calendar year (45 CFR 160.404). OCR also resolves many cases through resolution agreements and corrective action plans. Criminal liability exists separately for knowing misuse of PHI.

Mapping to related frameworks

• NIST: OCR's guidance builds on NIST SP 800-30 (risk assessment) and SP 800-66 (implementing the Security Rule). NIST CSF 2.0 is a natural way to organize the program.
• SOC 2 and HITRUST-style reports: these give business associates a way to show their safeguards to covered entities. They don't replace HIPAA obligations or BAAs.
• ISO/IEC 27001: an ISMS risk assessment can meet the Security Rule risk analysis if it covers all ePHI.
• GDPR and state privacy laws: these are separate regimes. Many state laws exempt PHI that HIPAA already governs, but don't assume that without checking.

Readiness checklist

1. Decide your status: covered entity, business associate, hybrid entity or none.
2. Map where ePHI is created, received, stored and transmitted, including SaaS and backups.
3. Run and document an enterprise-wide risk analysis, and repeat it when your environment changes.
4. Maintain a risk management plan with owners and dates.
5. Appoint a security official and a privacy official.
6. Write policies for each Security Rule standard, and document your decisions on addressable specifications.
7. Implement access control, unique IDs, audit logging, encryption, MFA and backups. Most of these are also proposed requirements under the NPRM.
8. Sign BAAs with every vendor that handles PHI, and review their safeguards.
9. Train the workforce and apply sanctions consistently.
10. Test the incident response and breach-assessment process against the 60-day clock.
11. Keep Security Rule documentation for six years from creation or last effective date (45 CFR 164.316).

Common pitfalls

• No risk analysis, or one that's out of date. This is the most common finding OCR cites.
• Treating "addressable" as optional without recording an alternative.
• Missing BAAs with cloud, email, analytics or AI vendors.
• Assuming a breach only counts once confirmed. The 60-day clock starts at discovery.
• Handling encryption inconsistently across laptops, backups and exports.
• Building to the NPRM and neglecting the current rule. The current rule is what OCR enforces.

How AssureCore helps

AssureCore puts HIPAA safeguards, BAAs, evidence and risks in one place. It includes a Controls Register, a Risk Register, Policy Management with AI-assisted writing and gap analysis, Evidence Management with expiry alerts, and Audit Reports. Cross-framework Mapping reuses your HIPAA work for SOC 2, ISO 27001 and NIST CSF. It supports your compliance program but isn't legal advice.

Frequently asked questions

Official references

• HHS – Covered entities and business associates
• HHS – Summary of the HIPAA Security Rule
• HHS – Summary of the HIPAA Privacy Rule
• HHS – Breach Notification Rule
• HHS – Guidance on risk analysis
• ONC/HealthIT.gov – Security Risk Assessment Tool
• HHS – Security Rule NPRM fact sheet
• Federal Register – Annual civil monetary penalties inflation adjustment (2026-01688)
• Federal Register – No adjustment to HHS CMP amounts for 2026 (2026-21524)
• eCFR – 45 CFR 160.404
• 45 CFR 164.316 (LII)
• HIPAA Simple – Security Rule pushed to July 2027

Related frameworks

• GDPR guide
• UK GDPR guide
• CCPA guide
• LGPD guide