The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a U.S. federal law that sets national standards governing the privacy and security of protected health information (PHI). Its rules define when PHI may be used or disclosed, establish safeguards for electronic protected health information (ePHI), give individuals rights over their health information and require notification after certain breaches of unsecured PHI.
HIPAA applies to health plans, healthcare clearinghouses, healthcare providers and other covered entities that conduct certain transactions electronically. Parts of the HIPAA rules also apply directly to business associates that create, receive, maintain or transmit PHI on behalf of covered entities.
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights administers and enforces the HIPAA Privacy, Security and Breach Notification Rules.
PHI is individually identifiable health information held or transmitted by a covered entity or its business associate in any form: electronic, paper or oral. Examples include medical records, diagnoses, treatment information, billing information and identifiers that connect health information to an individual.
HIPAA includes three primary rules: the Privacy Rule, the Security Rule and the Breach Notification Rule. Together they govern how regulated entities use and disclose PHI, protect ePHI and respond when PHI is exposed.
The Privacy Rule protects individuals' medical records and other PHI. It limits how covered entities and business associates use and disclose PHI without authorization. It also gives individuals rights over their information, including the right to inspect and obtain copies of records and request corrections.
The Security Rule protects ePHI. It requires covered entities and business associates to implement reasonable and appropriate safeguards that preserve the confidentiality, integrity and availability of ePHI.
The Security Rule organizes its requirements into three safeguard categories:
Administrative safeguards address risk management, workforce security, access policies, training and incident response.
Physical safeguards protect facilities, workstations, devices and media.
Technical safeguards address access control, authentication, audit controls, integrity and transmission security.
The Security Rule is flexible and does not prescribe one technology or security architecture. Organizations select controls based on factors such as their size, capabilities, technical infrastructure, costs and risks to ePHI. They must document their decisions and review safeguards as their technology and risks change.
In January 2025, HHS proposed changes to the Security Rule that would make several safeguards mandatory rather than “addressable,” including multi-factor authentication, encryption, annual risk analysis and regular security testing. HHS has not yet finalized the rule; the regulatory agenda currently targets 2027. The existing Security Rule remains in effect while rulemaking proceeds.
The Breach Notification Rule requires notification after a breach of unsecured PHI. Impermissible use or disclosure is presumed to be a breach unless the covered entity or business associate demonstrates through a documented risk assessment that there is a low probability the PHI was compromised. Covered entities must notify affected individuals and HHS. Individual notices must be provided without unreasonable delay and no later than 60 days after discovery.
The minimum necessary standard is one of the Privacy Rule’s core protections. It requires covered entities and business associates to make reasonable efforts to limit PHI uses, disclosures and requests to the minimum needed for the intended purpose.
The minimum necessary standard is closely aligned with, but not identical to the identity security principle of least privilege. The minimum necessary standard governs how much PHI should be used, disclosed or requested. Least privilege limits the systems, data and actions available to an identity. Together, they help organizations translate privacy requirements into enforceable access policies.
For example, clinicians may need access to complete records for treatment while billing personnel may need only the data required to submit and reconcile claims. IT administrators may need to maintain a database without viewing the patient information stored inside it. Identity security capabilities like role-based access controls, granular permissions, just-in-time access and policy-based controls can narrow access by job function, purpose, resource and task.
Finalized in 2013, The HIPAA Omnibus Rule, implemented the HITECH Act and updated the HIPAA Privacy, Security, Enforcement and Breach Notification Rules. It also established four civil penalty tiers based on culpability, with amounts adjusted annually for inflation. As of January 28, 2026, penalties for willful neglect not corrected within 30 days can reach $2,190,294 per violation.
Identity security controls help regulated entities implement and demonstrate Privacy Rule and Security Rule requirements. They can limit access to PHI, enforce authorization policies, monitor activity, and record who accessed sensitive systems and what they did.
A risk-based identity security program can include the following practices:
Apply least privilege. Limit each identity to the resources and actions needed for its role.
Reduce standing privilege. Use just-in-time access for elevated tasks.
Monitor privileged sessions and activity. Record access events and review commands, queries and administrative activity.
Revoke access when roles change. Connect access controls to workforce lifecycle processes.
Maintain audit evidence. Retain the access records, approvals and administrative activity for reviews and investigations.
These controls are part of a broader HIPAA program. They do not replace risk analysis, policies, training, physical safeguards, incident response, business associate management or legal review.
No. Regulated entities must continue to evaluate risks, review security measures and update policies and controls as their environments change. New systems, cloud services, workforce changes, third-party relationships and emerging threats can all affect risk to ePHI. Ongoing access reviews, monitoring, risk analysis, training and documentation help keep safeguards aligned with current operations.
More resources:
Whitepaper
Delinea identity security compliance whitepaper
Solution