What Is HIPAA Compliance? Rules, Violations and Penalties

HIPAA compliance means following the US Health Insurance Portability and Accountability Act and the rules issued under it to protect health information. It governs how organisations in and around healthcare handle protected health information, and it is enforced by the US Department of Health and Human Services. This article is general information, not legal advice.

The rules that define HIPAA

HIPAA is not a single checklist but a set of rules. Three of them do most of the day-to-day work:

• The Privacy Rule. It sets national standards for how protected health information (PHI) may be used and disclosed, and gives individuals rights over their own records — including the right to access and request corrections. Uses and disclosures outside a permitted purpose generally require the patient's authorization.
• The Security Rule. It applies specifically to electronic PHI and requires administrative, physical and technical safeguards — things like risk analysis, access controls, audit logging, encryption where appropriate, and workforce training. Many of its requirements are "addressable," meaning you implement them or document why an equivalent measure is reasonable.
• The Breach Notification Rule. When unsecured PHI is breached, it requires notifying affected individuals, the Department of Health and Human Services, and in larger breaches the media, within defined timeframes. PHI that was properly encrypted may fall under a safe-harbor and not trigger notification.

Who must comply

HIPAA reaches two groups. Covered entities are health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically in connection with certain transactions such as claims. Business associates are the vendors and partners that create, receive, maintain or transmit PHI on a covered entity's behalf — billing companies, cloud hosts, analytics providers, managed service providers and many software vendors. A business associate agreement (BAA) is the contract that binds a business associate to the applicable HIPAA obligations, and the duty flows down to subcontractors as well. If your organisation handles PHI for a healthcare client, you are almost certainly a business associate whether or not you have called yourself one.

What counts as a violation

A HIPAA violation is any failure to meet the applicable rules. In practice violations cluster around a few themes: impermissible uses or disclosures of PHI; missing or inadequate Security Rule safeguards, very often a missing or stale risk analysis; the absence of a business associate agreement with a vendor that touches PHI; failure to give patients timely access to their records; and late or missing breach notifications. Violations surface through patient complaints, self-reported breaches, and regulator-initiated investigations and audits. The common root cause is rarely malice — it is usually that no one mapped where PHI lives and flows, so a control or an agreement was simply never put in place.

The four penalty tiers

Civil monetary penalties under HIPAA are structured into four tiers based on culpability, and regulators weigh the specific facts of each case:

1. Tier 1 — lack of knowledge. The entity did not know, and by exercising reasonable diligence would not have known, that it violated the rule.
2. Tier 2 — reasonable cause. The violation was due to a reasonable cause and not to willful neglect.
3. Tier 3 — willful neglect, corrected. The violation was due to willful neglect but was corrected within the required period.
4. Tier 4 — willful neglect, not corrected. The violation was due to willful neglect and was not corrected in time.

Penalty amounts rise across the tiers, and both per-violation and annual limits are set by regulation and adjusted periodically, so you should always check the current official figures rather than rely on any specific number. Beyond civil penalties, knowingly obtaining or disclosing PHI improperly can carry criminal liability. Regulators frequently resolve cases through corrective action plans that require fixing the underlying program, not just paying a sum.

There is no official "HIPAA certification"

This trips up a lot of buyers and vendors. The government does not certify anyone as "HIPAA compliant," and there is no accredited body that issues an official HIPAA certificate. What does exist is independent assessment: a qualified firm can evaluate your controls against HIPAA requirements and issue a report, and training providers can certify that an individual completed a course. Those are reasonable evidence, but a product marketed as "HIPAA certified" is using marketing language, not describing a legal status. Treat such claims the way you would treat any vendor assertion — verify it. A structured vendor risk scorecard and the questions in our vendor security assessment checklist help you separate real safeguards and a signed BAA from a badge on a landing page.

How compliance is actually achieved

Real HIPAA compliance is an ongoing program rather than a one-time event. The core moves are: know where PHI lives and flows; perform and maintain a risk analysis; implement the administrative, physical and technical safeguards the Security Rule calls for; sign business associate agreements with every vendor that touches PHI; train your workforce; and have a tested breach-response process so notification happens on time. Because much of the Security Rule overlaps with general information-security practice, mapping your controls to a framework such as the NIST Cybersecurity Framework gives you a coherent structure, and a threat-modeling exercise helps you see where PHI is most exposed before an auditor or an attacker does.

Frequently asked questions

What is HIPAA compliance? Meeting the requirements of HIPAA and its rules — principally the Privacy, Security and Breach Notification Rules — when handling protected health information. It applies to covered entities and their business associates and is enforced by the Department of Health and Human Services. General information, not legal advice.

What counts as a violation? Any failure to meet the applicable rules: impermissible disclosures, missing safeguards or risk analysis, a missing business associate agreement, denied patient access, or a late breach notification.

What are the penalty tiers? Four tiers by culpability — lack of knowledge, reasonable cause, willful neglect corrected, and willful neglect not corrected — with amounts set by regulation and adjusted over time. Check the current official figures.

How do I get HIPAA certified? You cannot officially; there is no government HIPAA certification. Third-party assessments and training certificates exist, but a "HIPAA certified" product claim is marketing. Compliance is an ongoing program.

Does it apply to software and cloud vendors? Yes, if they handle PHI on a covered entity's behalf — they are business associates and need a BAA. "HIPAA compliant software" supports a compliant deployment; configuration and operation do the rest.