All regulations / US Health
HIPAA
Know the rule before it knows you.
Protected health information in the US: covered entities, business associates and everyone they contract.
What it is
HIPAA governs protected health information held by health plans, providers and clearinghouses, and by their business associates, including software vendors. It requires administrative, physical and technical safeguards, business associate agreements, and breach notification. A proposed update to the Security Rule would mandate controls such as MFA and encryption.
This applies to you if
- You provide software, hosting, analytics or AI to US healthcare organisations
- You handle US patient data as a vendor
- You run a digital health product used by covered entities
What it asks of you
- Business associate agreement before any access to PHI
- Risk analysis, access controls, audit logs, encryption, training
- Breach notification without unreasonable delay and within 60 days
What it costs to ignore
Tiered civil penalties per violation with annual caps, criminal penalties for knowing misuse.
Key dates
Rules in force since 2003 (Privacy) and 2005 (Security); Security Rule overhaul proposed in 2025.
How we help
Not sure which apply to you? Send us three lines about what you sell and to whom, and we will tell you which rules matter and which do not.
Have a regulatory question?
Send a short description of your situation. We reply within one working day, usually with a view on scope and a fixed fee where possible.