HIPAA, explained — and what it means for your practice
HIPAA is a U.S. federal law whose rules protect identifiable health information held by health plans, health care clearinghouses, health care providers that conduct covered electronic transactions, and their business associates, and give individuals rights over their health records. Here is who it applies to, what its rules require and how to put them in place, in plain English, with a source for every fact.
Free and independent: no vendor pays us.
What is HIPAA?
HIPAA — the Health Insurance Portability and Accountability Act of 1996 — is a U.S. federal law. Its rules, issued by HHS, protect identifiable health information held by health plans, health care clearinghouses, health care providers that conduct standard electronic transactions, and their business associates. They give patients rights over their records, require safeguards for electronic health data, require notice after a breach, and set standards for electronic health care transactions. HIPAA does not cover every business or every piece of health information.
| Full name | Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191) |
|---|---|
| Main rules | Privacy Rule, Security Rule, Breach Notification Rule (45 CFR Parts 160 and 164) |
| Who it applies to | Covered entities and their business associates |
| What it protects | Protected health information (PHI), including electronic PHI |
| Enforced by | HHS Office for Civil Rights (OCR); criminal cases by the Department of Justice |
| Usually outside HIPAA | Many consumer health apps, employers acting as employers, life and disability insurers |
HIPAA in three questions
Who does HIPAA apply to?
Health plans, health care clearinghouses and health care providers that conduct standard electronic transactions, such as insurance claims — the covered entities — and the business associates that create, receive, keep or send their patients' information. A therapist who bills insurance electronically is covered; a fitness app that a consumer downloads usually is not. Who must comply · Check in up to six questions
What do its rules require?
The Privacy Rule sets when health information may be used and shared, and patients' rights to see and correct it. The Security Rule requires administrative, physical and technical safeguards for electronic health information, starting with a risk analysis. The Breach Notification Rule sets who must be told after a breach, and how fast.
What does putting it in place involve?
A documented risk analysis, written policies and procedures, staff training, a business associate agreement with each of your business associates (vendors that create, receive, keep or send patient information for you), a process for patients' requests, and a plan for incidents and breaches. The checklist · Routes to compliance
For practices: three ways to do the work
Compared honestly — including ours, and when it's the wrong choice.
- FreeDo it yourself →Start from your EHR's forms, free HHS tools and our checklist. $0 — but it takes the most time and effort.
- Our productOur compliance kits →Word and Excel templates, a step-by-step guide and a filled-in example for therapy, medical and dental practices — $299 one time. Start with what you already have.
- Software · servicesHands-on help →Compliance software, a consultant or an attorney — when you want someone else to run the work or answer legal questions.
For staff: training by role
The training HIPAA asks every practice to give — try a full episode free.
How we verify
The rules behind every table on this site.
Primary sources only
Every claim links to the vendor's own BAA, trust center or pricing page — or to the regulation itself.
Dated and re-checked
Each fact shows when it was verified. Anything older than 90 days is flagged on the page.
No commissions, no partners
No vendor pays us for listings, rankings or referrals. Tables are alphabetical and every product is judged on the same criteria.
No "HIPAA compliant" labels
Tools are never compliant on their own. We say whether a BAA exists, on what terms, and what you still have to do.
Start from your situation
What HIPAA means for your type of organization.
- ScenarioHIPAA for dental practices →What a dental office needs in place under HIPAA: when it applies, the notice and records-request rules, online reviews, and the vendors that need a business associate agreement.
- ScenarioHIPAA for employer group health plans →How HIPAA applies to the health plans employers sponsor: when the plan is a covered entity, fully insured vs self-insured duties, what HR may see as plan sponsor, TPAs and wellness programs.
- ScenarioHIPAA for health app startups →Whether HIPAA applies to your health app or digital health startup, what applies instead if it doesn't, and the early choices — cloud, email, AI APIs — that are hard to change later.
- ScenarioHIPAA for healthcare AI companies →When HIPAA applies to an AI company in healthcare, the BAA chain through model and cloud providers, using PHI to train or improve models, and what applies when HIPAA doesn't.
- ScenarioHIPAA for IT providers and MSPs →What HIPAA means for IT support companies and MSPs with healthcare clients: why you are a business associate, the BAA chain through your tool stack, securing your own access, and ransomware response.
- ScenarioHIPAA for medical billing and coding companies →What HIPAA requires of billing and coding companies: when you are a business associate and when you become a clearinghouse, BAAs with clients and subcontractors, remote and offshore staff, and breach reporting.
- ScenarioHIPAA for physical therapists and chiropractors →What PT and chiropractic practices need in place under HIPAA — with the two issues they meet most often: open treatment areas and patient photos or testimonials in marketing.
- ScenarioHIPAA for SaaS companies that are business associates →What changes when your software holds PHI for healthcare customers: the duties you carry directly, the BAAs you sign and need from your own vendors, breach reporting, and where SOC 2 fits.
- ScenarioHIPAA for small medical practices →What a doctor's office or small clinic needs in place under HIPAA — the core documents, the vendors that need a BAA, patient record requests, family members, and the gaps OCR finds most often.
- ScenarioHIPAA for therapists and psychologists in private practice →What a solo or small therapy or psychology practice actually needs in place: whether HIPAA applies to you, the safeguards that matter most, and the tools you'll need a BAA for.
Compare tools and services
Who signs a BAA, on which plan, and what's left for you to configure.
- ToolAI medical scribes →AI scribes that turn visits into clinical notes — whether they sign a BAA, what happens to the recordings, and what clinicians need to check before using them with patients.
- ToolAI tools and LLMs →Which AI assistants and model APIs sign a BAA — ChatGPT, Claude, Gemini, Copilot and healthcare-specific assistants — on which plans, and what you have to switch on before any patient information goes in.
- ToolCloud storage and file sharing →Cloud storage services that sign a BAA — on which plans, how you put the agreement in place, and what you must configure before storing patient files.
- ToolCRM and patient relationship management →CRMs that sign a BAA — on which editions, how you put the agreement in place, and which features you must switch on or keep away from patient information.
- ToolHIPAA compliance software →Platforms that help you run a HIPAA program — policies, risk analysis, staff training and vendor BAAs in one place — compared on what they actually include and whether they publish prices.
- ToolHIPAA email services →Email services that sign a BAA, compared on what actually protects patient messages — and what you still have to configure yourself.
- ToolHIPAA hosting and cloud platforms →Cloud platforms and managed hosts that sign a BAA — and the big difference between infrastructure you secure yourself and hosting where the provider runs the safeguards for you.
- ToolHIPAA risk assessment software →Tools for the security risk analysis HIPAA requires — from the free HHS SRA Tool to paid platforms with guidance, remediation tracking and expert help. What each covers and what it costs.
- ToolOnline fax →Online fax services that sign a BAA — on which plans, how you put the agreement in place, and where incoming faxes land so patient information stays protected.
- ToolOnline forms and patient intake →Online form builders that sign a BAA — on which plans, how you put the agreement in place, and what to set up so answers stay protected after a patient presses Submit.
- ToolOnline HIPAA training courses →Online HIPAA training for staff — what each course covers, how long it takes, what it costs, and whether owners get completion records that help document the workforce training HIPAA requires.
- ToolOnline scheduling →Online booking and scheduling tools that sign a BAA — on which plans, how you put the agreement in place, and what to keep out of reminders, intake questions and calendar sync.
- ToolPatient texting and messaging →Phone, text and messaging platforms for practices that sign a BAA — what's included in the price, how the agreement is put in place, and what to watch for when texting patients. A BAA is necessary for a vendor that handles PHI, but it does not by itself make texting patients secure or appropriate — that also depends on your own safeguards and policies.
- ToolPhone systems →Business phone services for practices that sign a BAA — on which plans, how you put the agreement in place, and what to set up for voicemail, recordings, texts and AI features.
- ToolPractice management and EHR →Practice management and EHR systems for therapy and small medical practices — how each puts its BAA in place, from which plan, and what that agreement covers.
- ToolTelehealth and video visits →Video platforms for therapy and medical visits that sign a BAA — on which plans, how you get the agreement, and what you still have to set up.
Something just happened?
What to do, in order, and who can help.
- HIPAA training for new employees — and the rest of onboarding →What HIPAA training a new employee needs, when, and how to document it — plus the access steps when someone joins your practice or company and when they leave.
- Medical records subpoena: what your practice should do →A subpoena for a patient's records has arrived. What HIPAA allows, what a court order changes, the written assurances to ask for, and the records that need more than HIPAA.
- You had a data breach →A misdirected email, a lost laptop, a hacked mailbox. What to do, in order, in the first days — and the deadlines that start running when you discover it.
- You received a letter from OCR →A complaint investigation or compliance review from the HHS Office for Civil Rights. What the letter means, what to send, and how these cases usually end.
- You're launching a health app →The HIPAA decisions to make before a health app or digital health product goes live — whether the rules apply, which vendors need a BAA, and what applies if HIPAA doesn't.
Recent updates
Changes that altered our data.
- OpenAI API: eligible organizations can now accept a BAA themselves →2026-10-05On October 5, 2026, OpenAI added an in-product flow in API Organization settings > General: admins of eligible organizations can accept the standard Business Associate Agreement and enable HIPAA compliance support without going through sales. OpenAI's current list of BAA-eligible ChatGPT services names ChatGPT for Healthcare, Enterprise with the Regulated Workspace, FedRAMP and ChatGPT for Clinicians.
- HHS releases Security Risk Assessment Tool version 3.7 →2026-09-18HHS (ASTP/ONC with OCR) released version 3.7 of its free Security Risk Assessment Tool for small and medium practices, as a Windows application and an Excel workbook. It adds a question on assessment scope across every location handling ePHI and one on remote access and telework.
- OpenAI's BAA now covers ChatGPT for Healthcare and for Clinicians →2026-07-09OpenAI's HIPAA implementation guide, posted July 9, 2026, lists ChatGPT for Healthcare, ChatGPT for Clinicians and Enterprise or Edu workspaces with the Regulated Workspace as BAA-eligible. Consumer plans (Free, Plus, Pro) and ChatGPT Business are not. API use with PHI requires a Modified Retention setting for each organization and project.
- OCR launches civil enforcement of 42 CFR Part 2 →2026-02-13On February 13, 2026, ahead of the February 16, 2026 compliance date of the 2024 Part 2 final rule, HHS's Office for Civil Rights announced its civil enforcement program for the confidentiality of substance use disorder patient records. Part 2 breaches now follow HIPAA's breach notification requirements.
- Google's HIPAA list includes the Gemini app and Gemini in Workspace →2025-08-31Google's list of Workspace services covered by its HIPAA BAA, last updated August 31, 2025 and checked on October 14, 2026, covers the Gemini app (excluding Gemini in Chrome), the Gemini Mac app and Gemini in Workspace for customers who have accepted Google's HIPAA BAA.