The Authoritative HIPAA Compliance Directory

Establishes national standards for the protection of individually identifiable health information (PHI). Governs permissible uses and disclosures, patient rights of access to records under 45 CFR § 164.524, Notice of Privacy Practices (NPP) requirements under § 164.520, and the minimum necessary standard under § 164.502(b). Applies to covered entities: health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically. Effective April 14, 2003; HITECH amendments effective February 17, 2010.

Establishes national standards for protecting electronic PHI (ePHI) at rest and in transit. Requires covered entities and business associates to implement administrative safeguards (§ 164.308), physical safeguards (§ 164.310), and technical safeguards (§ 164.312). Includes required specifications — such as access controls (§ 164.312(a)) and audit controls (§ 164.312(b)) — and addressable specifications that organizations must implement or document rationale for alternative measures. Mandatory risk analysis under § 164.308(a)(1)(ii)(A). Effective April 21, 2005.

Requires covered entities to notify affected individuals (§ 164.404), HHS (§ 164.408), and in breaches affecting 500+ residents of a state, prominent media outlets (§ 164.406), following a breach of unsecured PHI. All notifications must occur without unreasonable delay and within 60 days of discovery of the breach. Business associates must notify covered entities within 60 days of breach discovery under § 164.410. Added by HITECH Act (Pub. L. 111-5); effective September 23, 2009. Interim final rule published August 24, 2009.