Timeline

Both dates are shown where a rule was published and took effect in different years. Select any entry.

1996

HIPAA

Congress passed the Health Insurance Portability and Accountability Act in 1996. The statute itself set out very little about privacy or security — it directed HHS to write the detailed rules, which is where the requirements you follow today actually come from.

The Act has five titles. Only Title II matters for compliance, and within it only Subtitle F, Administrative Simplification. The Titles tab covers each one.

What this means

This is the 1996 statute. It told HHS to write the detailed rules. Almost nothing you do day to day is “in HIPAA the Act” — it is in the later regulations.

In practice

A board member asks “show me where HIPAA says we need encryption.” You open the Security Rule (2003), not Public Law 104-191. The Act is the parent; the rule is the instruction.

When you deal with it

Explaining why the workbench cites 45 CFR instead of the public law
Walking a new hire through the five titles
Someone who thinks HIPAA is only privacy

What it does not do

The statute does not itself list the Security Rule standards, breach clocks, or NPP content. Do not cite only “HIPAA 1996” in a policy.

Where to go

Pub. L. 104-191https://www.congress.gov/bill/104th-congress/house-bill/3103/text
HHS — HIPAA for professionalshttps://www.hhs.gov/hipaa/for-professionals/index.html