HIPAA Privacy, Security, and Breach Notification Rules (45 CFR Parts 160, 164)

Record ID: biomedical-reg-006 (Biomedical · regulation · license) Issuing body / enforcer: U.S. Department of Health and Human Services, Office for Civil Rights (HHS/OCR) Jurisdiction: United States

1. What it is

HIPAA's administrative requirements (the "Administrative Simplification" provisions) comprise three interlocking rules that govern protected health information (PHI):

Privacy Rule — who may use or disclose PHI and for what purposes (treatment, payment, health care operations, and defined exceptions; patient authorization otherwise).
Security Rule — how electronic PHI (ePHI) must be safeguarded: administrative, physical, and technical safeguards, anchored by a risk assessment obligation.
Breach Notification Rule — what happens when unsecured PHI is compromised: notifications to affected individuals, to HHS, and (for large breaches) to prominent media, on fixed timelines.

Since the HITECH Act and the 2013 Omnibus Rule, business associates (vendors handling PHI on a covered entity's behalf — cloud hosts, EHR vendors, analytics firms, and device companies offering connected services) are directly liable under HIPAA, and OCR enforces against them directly. This is the provision that pulls biomedical engineers and their vendors into HIPAA's orbit.

2. Scope and who it applies to

Covered entities: Health plans, health care clearinghouses, and health care providers that transmit health information electronically.
Business associates: Any person or entity creating, receiving, maintaining, or transmitting PHI on behalf of a covered entity — including subcontractors of business associates (the chain extends downward).
What counts as PHI/ePHI: Individually identifiable health information in any form (Privacy Rule); the electronic subset (Security Rule). De-identified data per the Privacy Rule's two methods (expert determination or safe harbor) falls outside HIPAA.
Triggers for engineers: Building or operating anything that stores, processes, or transmits ePHI — connected medical devices with cloud backends, remote-monitoring platforms, clinical data pipelines, mobile health apps offered through providers. Business Associate Agreements (BAAs) must be in place with every vendor touching ePHI (cloud providers, analytics subcontractors, customer-support tooling).
Out of scope: Devices sold direct-to-consumer for personal use where no covered entity or business associate relationship exists (e.g., a consumer wellness wearable with no provider integration) — though state privacy laws and FTC health-breach-notification rules may still apply. Flag: The consumer/covered-entity boundary is fact-specific; "we're not HIPAA-covered" is a legal conclusion, not an engineering assumption.

3. Key requirements and compliance obligations

Security Rule — the engineer's checklist (45 CFR Part 164, Subpart C):

Administrative safeguards: A current, documented risk assessment (the foundational requirement — OCR cites its absence in most enforcement actions), risk management plan, workforce security and training, information access management, contingency/disaster-recovery plans, and regular review of records.
Technical safeguards: Access controls (unique user IDs, emergency access procedures, automatic logoff, encryption), audit controls (hardware/software mechanisms recording access to ePHI), integrity controls, person/entity authentication, transmission security (integrity controls and encryption for ePHI in transit).
Physical safeguards: Facility access controls, workstation use/security policies, device and media controls (disposal, re-use, media movement).
Encryption note: Encryption is "addressable," not "required" — but "addressable" does not mean optional; it means implement it, or document why an equivalent alternative is reasonable and appropriate. In practice, unencrypted ePHI is treated as unsecured PHI for breach-notification purposes, so the safe engineering default is encrypt at rest and in transit.

Privacy Rule essentials: Minimum-necessary standard for uses/disclosures, patient rights (access, amendment, accounting of disclosures), Notice of Privacy Practices, and authorization requirements for non-routine uses (notably marketing and sale of PHI).

Breach Notification Rule: Presumption that any impermissible use/disclosure of unsecured PHI is a breach unless a documented four-factor risk assessment demonstrates low probability of compromise. Notifications: individuals without unreasonable delay and within 60 days; HHS via the OCR portal (immediate for breaches affecting 500+ individuals, annual log for smaller); prominent media notice in the affected state/jurisdiction for 500+ breaches.

4. Penalties and consequences of non-compliance

OCR enforcement: Tiered civil money penalties based on culpability — from no-knowledge violations through reasonable cause to willful neglect (corrected vs. not corrected), with annual calendar-year caps per violation category. Dollar amounts are inflation-adjusted annually — verify current figures at hhs.gov before citing; do not rely on memorized numbers.
Resolution agreements: OCR's standard settlement vehicle — multi-million-dollar payments plus multi-year corrective action plans with independent monitoring (these are public and reputationally damaging).
Criminal penalties: Knowingly obtaining or disclosing PHI carries criminal liability (fines and imprisonment), escalating for false pretenses or intent to sell/use for commercial advantage.
State attorneys general can bring HIPAA civil actions on behalf of residents — a second enforcement front beyond OCR.
Practical note: OCR investigations are frequently triggered by breach reports themselves — the breach notification you file becomes the audit you undergo, which is why the risk assessment and documentation posture must predate any incident.

5. Version and live changes — status

The rules live at 45 CFR Parts 160 and 164; the HITECH/2013 Omnibus framework is the current baseline.
Watch items (flag — verify before advising): HHS has had long-pending Security Rule modernization rulemaking (proposed updates addressing current cybersecurity practice were in motion); check the current Federal Register status before asserting the "latest" requirements in formal compliance work. Proposed changes to the Privacy Rule (care coordination provisions) have also cycled through rulemaking.
Penalty amounts: always pull the current inflation-adjusted figures — they change yearly.

From the catalogue (record_type=certification, importance=license/flagship, Biomedical):

RAC-Devices (RAPS) — tangential to HIPAA (regulatory-affairs focus is FDA/EU device regulation), but connected-device regulatory strategy increasingly touches data-privacy obligations.
CCE — clinical engineers routinely handle ePHI-adjacent systems in hospital technology management.
PE — not HIPAA-tested.
Gap note: No catalogue certification in Biomedical is a dedicated health-data-privacy credential; practitioners typically look to health-information (e.g., CHPS-type) or security credentials outside this catalogue's scope.

7. Honest flags

Rule structure and enforcement mechanics are catalogue-verified (HHS OCR official summary). Penalty dollar figures are deliberately omitted — they are inflation-adjusted annually.
The Security Rule modernization status was not re-verified in this pass (September 2026); confirm at hhs.gov/federalregister before formal advice.
The consumer-device boundary ("generally out of scope") is a simplification — state laws and the FTC's Health Breach Notification Rule can still apply to non-covered entities handling health data.

Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.

HIPAA Privacy, Security, and Breach Notification Rules (45 CFR Parts 160, 164)