The Health Insurance Portability and Accountability Act (HIPAA) is the regulatory backbone of US health IT. It defines protected health information (PHI), who counts as a covered entity or business associate, and the obligations each carries.

Three rules matter most: the Privacy Rule (permitted uses and disclosures, minimum necessary, patient rights), the Security Rule (administrative, physical and technical safeguards for electronic PHI), and the Breach Notification Rule (when and how to report a breach).

Business associate agreements (BAAs) extend these obligations to vendors and cloud providers — a frequent exam theme as systems move off-premises.

Key distinction: The Privacy Rule covers PHI in any form; the Security Rule covers only electronic PHI (ePHI). Confusing the two is a classic trap.

🔒 Privacy Rule🛡️ Security Rule📢 Breach Rule

🖥️ CPHIMS Exam Prep