New to HIPAA? Read these four pages first.

The Health Insurance Portability and Accountability Act became law in 1996 (Public Law 104-191). Its original goals were to let people keep health coverage when they change or lose a job, and to make health care administration more efficient. The privacy and security standards arrived as a consequence of that second goal.

The statute has five titles. Title I protects coverage portability and renewability. Title II — Administrative Simplification — is the source of the privacy, security, transaction, identifier, and enforcement regulations that most people mean when they say HIPAA. Titles III, IV, and V cover tax provisions, group health plan rules, and revenue offsets.

The 2009 HITECH Act strengthened Title II: it added the breach notification rule, made business associates directly liable, and raised penalties for wilful neglect. When a policy cites "HIPAA," it is almost always pointing at Title II as amended by HITECH.

A covered entity is a health plan, a health care clearinghouse, or a health care provider who transmits health information electronically in connection with a standard transaction — claims, eligibility checks, remittance advice, and the like. A provider who bills only on paper is generally outside the rules; the moment claims leave electronically, they are inside them.

A business associate is a person or company that performs functions or services for a covered entity involving PHI: claims processing, billing, data analysis, legal, actuarial, accounting, consulting, IT and cloud hosting, records destruction. Since HITECH, business associates carry direct duties under the Security Rule and the Breach Notification Rule, must sign a business associate agreement with the entity, and pass those duties on to their own subcontractors.

A hybrid entity performs both covered and non-covered functions — a university that runs a teaching hospital, or a company health plan sitting inside a larger business. Under § 164.105(a) it designates a health care component, and only that component is treated as the covered entity. The designation only holds if it is written down and the component is actually separated in practice.

Protected health information is individually identifiable health information held or transmitted by a covered entity or business associate, in any form — paper, spoken, or digital. Health information means information about a person's physical or mental health, the care they received, or payment for that care. Individually identifiable means it names the person or could reasonably be used to identify them.

HIPAA does not require a name. A date of birth combined with a ZIP code, a rare diagnosis in a small town, or a medical record number on a spreadsheet can all be PHI. The Privacy Rule's safe harbor lists 18 categories of identifiers, and data is de-identified only when all of them are removed and there is no actual knowledge that what remains could identify someone.

ePHI is PHI created, received, maintained, or transmitted electronically: EHR data, email, text messages, portal messages, backups, imaging, billing files, and the cloud services that hold them. The Security Rule applies only to ePHI, which is why the same record can be covered by the Privacy Rule on paper and by both the Privacy and Security Rules on a laptop.

This is the ten-minute version: what each rule is for, and the obligations that come up most often in real organizations. Every point below links to the full explanation elsewhere on the site.