A guide to HIPAA

2. Who HIPAA covers

• Covered entities: health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with a transaction HIPAA covers, such as a claim (45 CFR § 160.103).
• Business associates: a person or company, other than a member of the covered entity's workforce, that creates, receives, maintains or transmits PHI on a covered entity's behalf, or provides it certain services that involve PHI (§ 160.103).
• Subcontractors: a subcontractor that handles PHI for a business associate is a business associate too, so the obligations flow down the chain.

A covered entity needs a business associate agreement with each of its business associates, and a business associate needs one with each subcontractor that handles PHI for it (§§ 164.502(e) and 164.504(e)). Backsplice's own business associate agreement is the one an organization signs with us.

3. The Privacy Rule

The Privacy Rule sets when PHI may be used and disclosed, whether it is spoken, on paper or electronic.

Minimum necessary. When using or disclosing PHI, or asking another organization for it, limit it to the minimum necessary for the purpose (§ 164.502(b)). The rule lists exceptions, among them disclosures to a health care provider for treatment, disclosures to the individual, and uses under the individual's authorization.

What a covered entity keeps in place, among other things (§§ 164.520 to 164.530):

• A notice of privacy practices
• A designated privacy official, and a contact for complaints
• Privacy training for its workforce, and sanctions for workforce members who break its policies
• A way to handle complaints
• A process for individuals' requests: access to their PHI, amendment, an accounting of disclosures, restrictions and confidential communications
• Written policies and procedures, safeguards for PHI in any form, and documentation kept for six years

A business associate may use and disclose PHI only as its business associate agreement permits or the law requires (§ 164.502(a)(3)), so most of its Privacy Rule obligations reach it through that agreement.

4. The Security Rule

The Security Rule applies to ePHI, and to covered entities and business associates alike (§ 164.302). It groups its requirements into administrative, physical and technical safeguards, and two further sets of requirements:

• Administrative (§ 164.308): the security management process, including the risk analysis, a security official, workforce security and training, contingency planning and evaluation.
• Physical (§ 164.310): facility access, workstation use and security, and device and media controls.
• Technical (§ 164.312): access control, audit controls, integrity, authentication and transmission security.
• Organizational requirements, and policies and documentation (§§ 164.314 and 164.316), including keeping the documentation for six years from its creation or the date it was last in effect, whichever is later.

Many standards come with implementation specifications, each either required or addressable (§ 164.306(d)); a standard with none must be met as written. Addressable does not mean optional: you assess whether the specification is reasonable and appropriate for you; if it is, you implement it, and if it is not, you document why and implement an equivalent measure where that is reasonable and appropriate.

5. The Breach Notification Rule

A breach is an acquisition, access, use or disclosure of PHI that the Privacy Rule does not permit and that compromises its security or privacy. Apart from three narrow exclusions (an unintentional, good-faith use by a workforce member; an inadvertent disclosure between people authorized to see the PHI; and a recipient who could not reasonably have retained it), it is presumed to be a breach unless the covered entity or business associate shows, by a documented risk assessment of at least four factors, a low probability that the PHI has been compromised (§ 164.402). Notification is owed for unsecured PHI, meaning PHI not rendered unusable, unreadable or indecipherable to unauthorized people under HHS guidance, such as by encryption.

Who the covered entity tells, and by when (its business associate tells it):

• Affected individuals: without unreasonable delay and no later than 60 calendar days after the breach is discovered, by first-class mail, or by email if the individual has agreed to it (§ 164.404).
• Prominent media outlets: for a breach involving more than 500 residents of a State or jurisdiction, on the same timeline (§ 164.406).
• HHS: for a breach involving 500 or more individuals, at the same time as the individuals; for fewer than 500, in a log submitted no later than 60 days after the end of the calendar year in which the breaches were discovered (§ 164.408).
• The covered entity, by its business associate: without unreasonable delay and no later than 60 calendar days after discovery (§ 164.410). A business associate agreement often sets a shorter time.

If a law enforcement official states that notice would impede a criminal investigation or damage national security, notice is delayed for the period the official's written statement sets, or for no more than 30 days on an oral statement unless a written one follows (§ 164.412). State breach laws can add their own requirements.

6. The risk analysis

The Security Rule requires an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of the ePHI an organization holds (§ 164.308(a)(1)(ii)(A)). In practice it should be:

• Complete. It covers all the ePHI you create, receive, maintain or transmit, in every system and location, the AI tools that handle it included.
• Grounded in threats and vulnerabilities. It names real threats and weaknesses, and the likelihood and impact of each.
• Written down. In enough detail that someone else can follow your reasoning.
• Kept current. The rule asks you to review and modify your security measures as needed (§ 164.306(e)), and to evaluate them and update their documentation when environmental or operational changes affect ePHI (§§ 164.308(a)(8), 164.316(b)(2)(iii)). It sets no fixed interval; many organizations revisit the analysis every year and whenever their systems or operations change.

The risks it finds feed risk management: the measures that bring each risk down to a reasonable and appropriate level (§ 164.308(a)(1)(ii)(B)).

7. Penalties and enforcement

The HHS Office for Civil Rights (OCR) enforces the HIPAA rules, through complaints, compliance reviews and investigations. It may impose civil money penalties in four tiers, set by how culpable the organization was (§ 160.404):

• Did not know, and with reasonable diligence would not have known.
• Reasonable cause, not willful neglect.
• Willful neglect, corrected within 30 days of when the organization knew or should have known.
• Willful neglect, not corrected within those 30 days.

Each tier has a minimum per violation, the first three a maximum per violation, and each a cap per calendar year for identical violations. The amounts are adjusted for inflation every year and published at 45 CFR Part 102, so read them there rather than from a guide. State attorneys general can also bring civil actions under HIPAA (42 U.S.C. § 1320d-5(d)), and knowingly obtaining or disclosing individually identifiable health information in violation of it is a federal crime, prosecuted by the Department of Justice (42 U.S.C. § 1320d-6).

8. HIPAA and the AI you adopt

HIPAA does not regulate AI as such, but for a covered entity or business associate its rules apply to PHI in an AI tool exactly as anywhere else:

• An AI tool that handles ePHI is a system like any other. It belongs in your risk analysis, under the same safeguards.
• A vendor whose AI service handles PHI for you is generally a business associate. The agreement comes before the PHI does.
• Minimum necessary applies to what your workforce puts into an AI tool, unless one of the rule's exceptions does.
• AI governance is a second set of questions about the same systems: what each AI system is for, how risky it is and who approved it. Voluntary frameworks such as the NIST AI RMF, and AI laws that apply by their own terms, ask those questions; HIPAA does not.

That is why Backsplice keeps one register of systems: each system is entered once, marked as using AI, handling ePHI, or both, and the HIPAA system questions follow the one mark while the AI governance system questions follow the other.

9. Getting started in 30 days

Starting from nothing, a realistic first month looks like this:

• Week 1: find your ePHI: where it lives, who can reach it, and how it moves. In Backsplice that is the register of systems, the data flow map and the devices register.
• Week 2: run the HIPAA program assessment and write the security risk analysis against that inventory.
• Week 3: adopt the policies the Security Rule calls for (and, for a covered entity, the Privacy Rule), and name your security official (§ 164.308(a)(2)) and, for a covered entity, your privacy official (§ 164.530(a)). Backsplice offers HIPAA policy templates to start from.
• Week 4: train your workforce, sign a business associate agreement with every vendor that handles PHI for you, and plan the fixes for the risks the analysis found. Backsplice keeps the training records, the business associates and their agreements, and the remediation plan.

The Free plan includes 1 AI system and 1 system that handles ePHI, and a HIPAA assessment on it asks the HIPAA Security and Breach Notification Rules questions only; the Privacy Rule questions and the optional HIPAA packs come with a paid plan, and answers already given are kept. See pricing, or talk to us.