HIPAA compliance means following three federal rules, Privacy, Security and Breach Notification, if you're a US covered entity (a health plan, a healthcare clearinghouse, or a provider that bills electronically) or a business associate handling health data for one. If you're neither, HIPAA doesn't apply to you at all. If you are, the rule people miss is the breach clock: affected patients must be told within 60 days of discovering a breach.
A lot of small businesses assume HIPAA covers any health information. It doesn't. The Department of Health and Human Services (HHS) is clear that an organization that doesn't meet the definition of a covered entity or business associate doesn't have to comply with the HIPAA Rules. So the first job is working out which side of that line you're on.
Who has to comply
| Type | Examples HHS gives | The catch |
|---|---|---|
| Health care provider | Doctors, clinics, psychologists, dentists, chiropractors, nursing homes, pharmacies | Only if they transmit information electronically in a transaction HHS has a standard for, such as billing a health plan |
| Health plan | Health insurers, HMOs, company health plans, Medicare, Medicaid, military and veterans programs | Covered regardless of size |
| Health care clearinghouse | Entities that convert nonstandard health data into a standard format, or back | Usually billing services and similar |
| Business associate | A vendor that performs functions or services for a covered entity involving health data, such as IT, billing or cloud storage | Needs a written business associate agreement and is directly liable for parts of the rules |
That business associate row is where most marketing, software and admin businesses land. If a clinic hands you patient data to run its appointment reminders, store its files or process its claims, you're likely a business associate. HHS says the covered entity must have a written contract with you spelling out what you've been engaged to do and requiring you to protect the data.
The three rules in plain English
1. The Privacy Rule
This governs how protected health information can be used and shared. Its central idea is 'minimum necessary': a covered entity must make reasonable efforts to use, disclose and request only the minimum amount of health information needed for the purpose. It also gives patients rights, including the right to see and get a copy of their records. A covered entity only has to disclose information in two situations: to the individual when they ask for it, and to HHS for an investigation.
2. The Security Rule
This covers electronic health information (ePHI) and sets out three groups of safeguards. It's deliberately flexible: HHS notes regulated entities range from the smallest provider to a large cloud service provider, so the rule lets you weigh your size, complexity and capabilities.
| Safeguard group | What it includes |
|---|---|
| Administrative | A risk analysis, a named security official, workforce access rules, training, incident procedures, a contingency plan with backups, periodic evaluation, business associate agreements |
| Physical | Limits on facility access, workstation rules, controls on devices and media, wiping data before reuse |
| Technical | Access control, audit controls, integrity checks, authentication, transmission security |
One detail trips people up. Some parts of the Security Rule are marked 'addressable'. HHS says that doesn't mean optional. It means you decide whether the measure is reasonable and appropriate for you; if so, you must adopt it, and if not, you adopt an alternative that achieves the same purpose and document why.
3. The Breach Notification Rule
If unsecured protected health information is breached, you have to tell people. An impermissible use or disclosure is presumed to be a breach unless a risk assessment shows a low probability that the information was compromised.
The breach deadlines
| Who you tell | When | Trigger |
|---|---|---|
| Affected individuals | Without unreasonable delay, no later than 60 days after discovery | Every breach of unsecured health information |
| Prominent local media | Same 60-day limit | More than 500 residents of a state or jurisdiction affected |
| HHS (the Secretary) | Within 60 days | 500 or more individuals affected |
| HHS (the Secretary) | Within 60 days after the end of the calendar year | Fewer than 500 individuals affected (an annual log) |
| The covered entity (if you're the business associate) | No later than 60 days from discovery | A breach at or by the business associate |
Here's the sourced insight most guides skip: encryption changes everything. Breach notification only applies to unsecured information, and HHS guidance names encryption and destruction as the methods that make data unusable to unauthorized people. Entities that secure data that way are relieved from providing notifications if it's breached. A stolen encrypted laptop is a bad day; a stolen unencrypted one is a reportable breach.
If your contact details are out of date for 10 or more people, you must post a substitute notice on your website home page for at least 90 days, or use major print or broadcast media, and run a toll-free number for at least 90 days.
Penalties
HHS's Office for Civil Rights (OCR) can impose civil penalties. As of October 2026, the HHS Privacy Rule summary shows per-violation amounts of $127 to $63,973 and a calendar-year cap of $25,000 to $1,919,173 for violations of an identical requirement, figures HHS may adjust each year for inflation. Criminal penalties, prosecuted by the Department of Justice, reach $50,000 and one year in prison for knowingly obtaining or disclosing health information, $100,000 and five years under false pretenses, and $250,000 and ten years where the intent is commercial advantage or malicious harm.
There's a useful safety valve: no civil penalty is imposed if the failure wasn't due to willful neglect and was corrected within 30 days of when you knew, or should have known, about it. Fixing problems fast is the cheapest compliance strategy there is.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Practices that adopt new software need to keep patient data safe, and our guide to AI tools for dentists sets out AI tools for dental teams.
A practical HIPAA compliance checklist
- Confirm whether you're a covered entity, a business associate or neither. Neither means you can stop here.
- Map where health information lives: email, cloud drives, CRMs, laptops, paper files.
- Run and document a risk analysis, then fix the biggest risks first.
- Name a privacy official and a security official (one person can do both in a small practice).
- Sign business associate agreements with every vendor that touches health data.
- Encrypt devices and email that carry health information.
- Train every staff member who handles the data, and record that you did.
- Write a breach response plan with the 60-day deadlines built in.
If you're choosing tools, our guides to email encryption software and medical scheduling software are a good place to start, and Vanta vs Drata compares two compliance platforms.
The verdict
HIPAA isn't a badge you buy once. Compliance is a set of habits you can prove, mostly through documentation: the risk analysis, the policies, the training records and the signed agreements. If you're a small business serving clinics, the business associate agreement is your biggest exposure, and encryption is your best protection. Get those two right, write things down, and you've covered most of what goes wrong in real life.
Prescribing systems handle patient data, and our round-up of e-prescribing software covers tools clinicians use to send prescriptions.
Frequently asked questions
Who needs to be HIPAA compliant?
Covered entities (health plans, healthcare clearinghouses and providers that transmit health information electronically in standard transactions) and their business associates. Other organizations don't have to comply with the HIPAA Rules.
How long do you have to report a HIPAA breach?
Affected individuals must be notified without unreasonable delay and no later than 60 days after the breach is discovered. Breaches affecting 500 or more people must also be reported to HHS within 60 days.
Does encryption help with HIPAA?
Yes. Breach notification applies only to unsecured health information, and HHS names encryption and destruction as the methods that make data unusable, so lost data that's encrypted to that standard doesn't trigger notification.
What does addressable mean in the HIPAA Security Rule?
It doesn't mean optional. You assess whether the measure is reasonable and appropriate for you; if so, you adopt it, and if not, you adopt an alternative that achieves the same purpose and document why.
