RulesHIPAA General provisions
Requirements explained
- Business associate →§ 160.103Who counts as a HIPAA business associate, common examples including SaaS and cloud vendors, subcontractors, and what business associates must do.
- Covered entity →§ 160.103What makes an organization a HIPAA covered entity, the three types, how the provider test works, and what covered entities must do.
- HIPAA documentation retention →§ 164.316(b)(2)What HIPAA requires you to keep and for how long — six years for compliance documentation — and why medical record retention is a state-law question.
- HIPAA training requirements →§ 164.530(b)Who must be trained under HIPAA, on what, how often, and how to document it — and what the rule does not actually require.
- PHI and ePHI →§ 160.103What counts as protected health information under HIPAA, how ePHI differs, what is excluded, and practical examples for small practices and health tech companies.