The Health Insurance Portability and Accountability Act (HIPAA) is a U.S. federal law that governs how protected health information (PHI) is handled, stored, and protected.
HIPAA is often misunderstood as a healthcare-only regulation. In reality, it affects a wide range of organizations—many of which don’t consider themselves “healthcare companies” at all.
At its core, HIPAA exists to ensure that sensitive health information is confidential, available when needed, and protected from unauthorized access or disclosure. Achieving that depends heavily on IT systems, cybersecurity controls, and operational discipline.
HIPAA applies to two main groups:
Healthcare providers (clinics, hospitals, practices)
Health plans (insurers, HMOs)
Healthcare clearinghouses
Any organization that creates, receives, maintains, or transmits PHI on behalf of a covered entity, including:
MSPs and IT providers
Cloud and SaaS vendors
Billing and claims processors
EHR vendors
Data analytics providers
Managed security providers
Consultants and professional services firms
If you touch PHI in any way, HIPAA likely applies to you, even if healthcare is not your primary business.
HIPAA regulates Protected Health Information (PHI), including any health-related data that can identify an individual, such as:
Names, addresses, dates of birth
Medical records and diagnoses
Treatment and prescription data
Insurance and billing information
Patient portal credentials
Appointment and communication records
Any combination of data that identifies a patient
When PHI is stored or transmitted electronically, it becomes ePHI, which is where IT and cybersecurity controls are critical.
HIPAA compliance is built around several key rules:
Defines how PHI may be used and disclosed, and establishes patient rights.
Requires administrative, physical, and technical safeguards to protect ePHI.
Mandates notification to affected individuals, HHS, and sometimes the media after certain breaches.
Defines penalties and enforcement mechanisms.
From a practical standpoint, the Security Rule drives most IT and cybersecurity requirements.
HIPAA does not prescribe specific tools, but it does require reasonable and appropriate safeguards based on risk.
In practice, this means:
Risk assessments and risk management plans
Security policies and procedures
Workforce training
Incident response and breach handling processes
Vendor management and Business Associate Agreements (BAAs)
Unique user identification
Strong access controls and least privilege
Multi-factor authentication (MFA)
Encryption (at rest and in transit)
Audit logs and monitoring
Secure remote access
Device and media controls
Secure workstation and server access
Secure disposal of hardware and data
HIPAA compliance fails most often when technical safeguards are weak or undocumented.
Many organizations think HIPAA is about avoiding fines. In reality, HIPAA failures often lead to:
Data breaches
Ransomware incidents
Operational downtime
Reputational damage
Insurance claim denials
Loss of customer and partner trust
HIPAA enforcement increasingly focuses on whether organizations took reasonable steps to protect ePHI—not whether an attack was sophisticated.
HIPAA aligns closely with widely used frameworks such as:
NIST Cybersecurity Framework (CSF)
NIST SP 800-53
ISO 27001
SOC 2
HITRUST CSF
That means HIPAA compliance is largely built on the same cybersecurity fundamentals used across industries. The difference is the sensitivity of the data and the documentation required.
Here’s the truth most organizations don’t hear:
Most HIPAA requirements are basic cybersecurity best practices.
MFA is MFA. Encryption is encryption. Logging is logging.
HIPAA doesn’t demand cutting-edge technology—it demands discipline, consistency, and proof that reasonable safeguards are in place.
Our cyber risk and compliance assessments help organizations:
Identify PHI exposure and risk
Evaluate safeguards against HIPAA requirements
Close technical and documentation gaps
Prepare defensible evidence for audits and incidents
Reduce breach and enforcement risk
We focus on practical controls that actually protect your environment, not checkbox compliance.
Here is a practical, high-impact roadmap.
Document:
HIPAA explicitly requires a risk analysis. This includes:
At minimum:
HIPAA expects documented:
Ensure:
Employees should understand:
HIPAA compliance is not a one-time project—it’s an ongoing risk management process.
Understand where you stand, what’s missing, and how to move forward with confidence.
Talk to an Executive Advisor Today
