Who HIPAA applies to, what the Privacy, Security and Breach Notification Rules require, how workforce training and business associate agreements fit in and the everyday habits that keep a clinic, agency or practice compliant.
The Health Insurance Portability and Accountability Act (HIPAA) and its rules apply to two groups. Covered entities are health plans, healthcare clearinghouses and healthcare providers that conduct certain transactions, such as billing insurance, electronically. That includes most clinics, dental practices, pharmacies, home health agencies and therapists. Business associates are people and companies that create, receive, maintain or transmit protected health information on behalf of a covered entity, such as billing companies, IT providers and cloud services.
To record clock-ins, breaks and overtime automatically, see EZTime time and attendance software.
HIPAA does not cover every piece of health information everywhere. An ordinary employer’s records about an employee’s sick leave or a doctor’s note in a personnel file are generally employment records, not protected health information under HIPAA, although other laws, such as the ADA and FMLA, require them to be kept confidential and separate from the general personnel file.
Protected health information (PHI) is individually identifiable health information held or transmitted by a covered entity or business associate, in any form: paper, electronic or spoken. It includes information about a person’s health, care or payment for care that identifies them or could reasonably be used to identify them. Names, addresses, dates related to the person, phone numbers, email addresses, medical record numbers and photographs are common identifiers.
Electronic PHI (ePHI) is PHI created, received, maintained or transmitted electronically. It is the focus of the Security Rule.
| Rule | What it requires |
|---|---|
| Privacy Rule | Limits uses and disclosures of PHI, requires the minimum necessary use, gives patients rights to access and amend their records and requires a Notice of Privacy Practices |
| Security Rule | Requires administrative, physical and technical safeguards for ePHI, based on a documented risk analysis |
| Breach Notification Rule | Requires notifying affected individuals, HHS and in some cases the media after a breach of unsecured PHI |
The Department of Health and Human Services’ Office for Civil Rights (OCR) enforces these rules.
The Security Rule is flexible: a small practice and a large hospital can meet it in different ways, as long as the choices are based on a documented assessment of risks. Our small business cybersecurity checklist covers many basic technical controls.
A breach is generally an impermissible use or disclosure that compromises the security or privacy of PHI, unless a risk assessment shows a low probability that the information was compromised. When a breach of unsecured PHI occurs:
Many states have their own data breach laws as well, with different timelines.
Three HHS statements clear up the most common confusion:
So a dental office is a covered entity, but the dental office’s role as an employer is different from its role as a provider. A staff member’s sick note in a personnel file is an employment record, while the same person’s dental chart is protected health information. Keep the two in separate systems.
HIPAA civil penalties are set in tiers based on the level of culpability, from violations the entity did not know about to willful neglect that was not corrected. Amounts are adjusted for inflation each year and can add up per violation and per year. OCR often resolves cases through corrective action plans and settlements. Knowingly obtaining or disclosing PHI in violation of HIPAA can also lead to criminal penalties, enforced by the Department of Justice. State attorneys general can bring civil actions too.
Most enforcement cases involve basic failures: no risk analysis, lost unencrypted devices, delayed patient access to records, or employees looking at records they had no reason to see.
HIPAA requires covered entities to train all workforce members on their policies and procedures, and the Security Rule calls for security awareness training. Workforce includes employees, volunteers and trainees. Train at hiring, when policies change and periodically after that, and keep records of who was trained and when. Our toolbox talks guide shows how short, regular sessions keep topics fresh, and the training attendance sheet template helps document them.
Everyday habits matter as much as policies:
All core HIPAA steps checked.
Before a vendor creates, receives, maintains or transmits PHI for you, HIPAA requires a written business associate agreement (BAA) that sets out how the vendor will protect the information. Keep a list of every vendor that touches PHI and confirm each has a signed BAA. Vendors that never handle PHI, for example a scheduling or time clock tool used only for staff shifts and hours, generally do not need one, which is a good reason to keep patient information out of workforce tools.
Healthcare employers use many tools that are not clinical systems: scheduling, time tracking, internal announcements and HR forms. Keep patient information out of them. Shift notes, chat messages and task descriptions should refer to rooms, routes or internal codes rather than patient names or conditions. EZTime is built for workforce management, scheduling, time tracking and team communication, not for storing patient records, so set clear rules on what staff may write in it. See EZTime for healthcare and home care agencies.
Covered entities, meaning health plans, healthcare clearinghouses and healthcare providers that conduct certain transactions electronically, and their business associates that handle protected health information on their behalf.
Generally no. Health information an employer holds in its role as employer, such as sick notes or leave records, is an employment record rather than PHI under HIPAA. Other laws still require it to be kept confidential and stored separately.
HIPAA requires training for new workforce members within a reasonable time after joining and when policies change materially. Most organizations also train at least annually as good practice and to support security awareness.
A written contract required before a vendor handles PHI on behalf of a covered entity. It sets out permitted uses of the information, safeguards and breach reporting obligations.
Affected individuals must be notified without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people must also be reported to HHS within that time, and smaller ones within 60 days after the end of the calendar year.
Usually not directly. HHS says employers and group health plan sponsors are not HIPAA covered entities, so the Privacy Rule does not directly regulate an employer that is not a covered entity. Other laws, such as the ADA and FMLA, still require employee medical information to be kept confidential.
HHS can impose civil money penalties in tiers based on how culpable the organization was, from violations it did not know about to willful neglect left uncorrected. The amounts are adjusted for inflation each year. Serious cases can also bring criminal penalties.
EZTime is built for staff scheduling, time tracking and team communication. Use it for your workforce and keep patient information in your clinical systems.