Glossary, regulation and privacy
What is HIPAA?
HIPAA, the Health Insurance Portability and Accountability Act of 1996, is the US federal law whose rules protect the privacy and security of patients' health information. Its Privacy Rule governs how protected health information is used and disclosed, and its Security Rule sets the safeguards for electronic health information.
Updated . Defined by the wai team for clinics, groups and health systems.
Also called Health Insurance Portability and Accountability Act.
Why HIPAA matters to a clinic
HIPAA applies to covered entities, which include most US medical practices, and to the business associates that handle patient data for them.1 The Security Rule requires technical safeguards such as access control, audit controls and transmission security.2
There is no HIPAA certification for software. A vendor can sign a business associate agreement and run the safeguards the rule describes, and the practice's compliance still depends on its own policies, training and use of the system.
Questions
Is there a HIPAA certification?
No. HHS does not certify software or vendors. Readiness depends on the role each party plays, the signed agreements and the operating controls. See security.
Does HIPAA apply to a UK clinic?
Not to its UK patients. HIPAA applies to US covered entities and their business associates. UK clinics work under UK GDPR and the Data Protection Act 2018.
Sources
See wai on your own clinic.
A 15 minute video call on your own diary, notes and inbox. Prices for clinics, groups and hospitals are on the pricing page.