HIPAA stands for the Health Insurance Portability and Accountability Act of 1996. It is a U.S. federal law that addresses health insurance administration, health information privacy, and data security. The law was enacted on August 21, 1996, and later became the foundation for major federal rules governing protected health information.
| Key term | Plain-English meaning |
| HIPAA | A federal health law enacted in 1996 |
| Portability | Refers in part to the continuity and portability of health insurance coverage |
| Accountability | Supports standards and responsibilities for health information and health care administration |
| PHI | Protected health information linked to an identifiable person |
| Privacy Rule | Governs many uses and disclosures of protected health information |
| Security Rule | Sets safeguards for protected health information stored or transmitted electronically |
Short answer: The Health Insurance Portability and Accountability Act of 1996 is a federal law that led to national standards for health information privacy and security. It gives patients important rights over certain health records while requiring regulated health plans, providers, clearinghouses, and business associates to protect covered information.
What HIPAA Stands For and Why the Name Matters
The full name can be confusing because people often think the “P” stands for privacy. It doesn’t. The “P” stands for Portability. The law had broader goals than medical privacy alone. Congress also addressed health insurance and the administrative handling of health care information. The Act led to federal standards for electronic health transactions, privacy, and security.
That history explains why the word “privacy” doesn’t appear in the name. Privacy protections became one of the law’s most visible effects, but they are only part of the broader framework.
The correct spelling is also HIPAA, not HIPAA. The second “A” comes from “Accountability.” The common misspelling “HIPAA” often results from the mistaken assumption that the name contains the word “privacy” or “protection.”
What the HIPAA Privacy Rule Protects
The Privacy Rule sets national standards for medical records and other individually identifiable health information held by regulated organizations. It also limits certain uses and disclosures unless the law permits them or the individual authorizes them.
Protected health information, or PHI, can include details about a person’s health conditions, treatment, or payment for health care. Protection is not limited to information stored on a computer.
HIPAA stands for the Privacy Rule, which can cover information in electronic, written, and spoken forms when that information meets the definition of PHI and is held by a regulated organization.
For readers exploring other health topics, NewsJoury also publishes broader health coverage, including its guide to supporting children with autism through occupational therapy.
How the HIPAA Security Rule Is Different
The Security Rule focuses more narrowly on electronic protected health information, often called ePHI. It requires regulated entities to use reasonable administrative, physical, and technical safeguards. These safeguards are intended to protect the confidentiality, integrity, and availability of electronic health information.
This distinction matters. The Privacy Rule can protect PHI in several formats, while the Security Rule specifically addresses protected information that is maintained or transmitted electronically.
A paper medical chart, for example, can fall under privacy protections. The Security Rule, by contrast, applies to electronic protected health information.
Who Must Follow HIPAA?
The rules do not apply to every person or company that happens to know something about your health. The Privacy Rule applies to health plans, health care clearinghouses, and health care providers that conduct certain standard health care transactions electronically. These organizations are known as covered entities.
Certain contractors and service providers may also be regulated as business associates when they perform work for covered entities that involves protected information. Business associates must comply with the federal rules that apply to their activities. NewsJoury’s Law section provides additional plain-language coverage of legal concepts and everyday legal questions.
Who May Not Be Covered?
One of the biggest misconceptions is that this federal law automatically protects all medical or wellness information. Many organizations that hold health-related information are not required to follow the Privacy and Security Rules. Whether the rules apply depends on the type of organization holding the information and the reason it has that information.
Employers provide a useful example. In most situations, the Privacy Rule does not directly regulate an employer acting solely as an employer. Employment records are also not protected simply because they contain health-related information. An employer-sponsored group health plan can differ because the plan itself may qualify as a covered entity.
A 30-Second Scope Check
Imagine three situations. A hospital stores your diagnosis in its patient system. That information generally exists within a regulated health care relationship and may qualify as PHI.
Your employer keeps a doctor’s note in an employment file. The Privacy Rule generally does not protect the employment record itself.
A consumer company collects wellness data outside a covered-entity or business-associate relationship. That company may fall outside HIPAA’s federal rules, although other privacy laws may still apply.
The key question is not simply, “Is this health information?” You also need to ask who holds it and whether that organization is regulated under HIPAA.
What Rights Do Patients Have?
The Privacy Rule gives individuals several rights concerning covered health information. Patients generally have the right to inspect and obtain copies of health records maintained in designated record sets. They can also request amendments when medical or billing information is inaccurate or incomplete.
People can receive information explaining how their data may be used or shared. They may also request certain restrictions and exercise other privacy rights provided by the Rule.
These rights do not mean every request must be handled exactly as the patient asks. Federal rules contain procedures and exceptions so that specific disputes may require professional legal or compliance guidance.
Common HIPAA Myths
A privacy rule is not the same as a complete ban on sharing medical information. The federal framework allows certain uses and disclosures without individual authorization. Covered organizations must still follow the conditions established by the applicable rules.
Another misconception is that HIPAA covers every employer, fitness service, website, or company that collects health information. Organizations that do not meet the definition of a covered entity or business associate may fall outside HIPAA’s Privacy and Security Rules.
A breach can also trigger specific legal obligations. The Breach Notification Rule requires covered entities and business associates to provide notifications after certain breaches of unsecured protected health information.
The Key Point to Remember
The law is easier to understand once you separate its official name from its modern role in privacy. It began as a broader body of health insurance and administrative law and later became the basis for rules that govern how regulated organizations handle health information.
HIPAA stands for “if you have a specific privacy concern, first determine whether the organization involved is a covered entity or business associate.” That distinction helps clarify whether HIPAA is likely to apply.
Frequently Asked Questions
It means the Health Insurance Portability and Accountability Act of 1996. “Portability” provides the “P,” while “Accountability” supplies the final “A.” The acronym does not stand for “Health Information Privacy and Protection Act.”
No. HIPPA is a common misspelling. The correct acronym is HIPAA because the official name includes the words “Portability and Accountability Act.”
PHI means protected health information. It generally refers to individually identifiable health information protected by the Privacy Rule when it is held or transmitted by a regulated entity.
Usually not when they are dealing with ordinary employment records or acting solely as employers. Different rules can apply when an employer sponsors or administers a covered group health plan.
In most cases, yes. Individuals generally have broad rights to access PHI contained in designated record sets maintained by covered entities, subject to limited exceptions.
