# What is HIPAA?

Also called Health Insurance Portability and Accountability Act.

HIPAA is a United States federal law whose privacy, security and breach notification rules govern how protected health information is used and disclosed. It applies to covered entities such as health plans and most healthcare providers, and to business associates that handle protected health information on their behalf under a written agreement.

The Privacy Rule sets limits on use and disclosure of protected health information and grants individuals rights including access to their records. The Security Rule requires administrative, physical and technical safeguards for electronic protected health information. The Breach Notification Rule requires notification to affected individuals and regulators within defined timeframes when unsecured protected health information is compromised.

The business associate relationship is what most technology vendors encounter. A vendor that creates, receives, maintains or transmits protected health information for a covered entity is generally a business associate and must execute a business associate agreement, which passes down specific obligations and permits enforcement directly against the vendor. Subcontractors handling the same data are typically covered further down the chain.

For AI deployments the practical questions are whether protected health information enters prompts, whether it is retained by any component, who can view it, and whether every party in the path is willing and able to sign the necessary agreements. Model providers differ in whether they support such arrangements and under which product configurations, which needs to be verified for the specific channel in use.

HIPAA does not certify products. There is no government issued compliance badge, and claims that a tool is inherently compliant misdescribe how the law works: compliance is a property of an organization's overall practices and agreements, not of a piece of software. Independent assessments exist in the market but they are not the same as regulatory approval, and specific obligations should be assessed with qualified counsel.

## Key points

- Covers privacy, security and breach notification for health information
- Applies to covered entities and their business associates
- Vendors handling protected health information need a written agreement
- Verify that every component in the path can be covered
- There is no official certification; compliance is organizational

## In practice

A clinic wants an assistant to draft visit summaries. Before any patient data is used, they map where text would travel, confirm which vendors in that path will execute business associate agreements, restrict staff access to the summaries, enable the shortest workable retention, and record the assessment. Where a component cannot be covered by an agreement, patient identifiers are removed before the data reaches it.

## Related terms

- [GDPR](/en/glossary/gdpr)
- [CCPA](/en/glossary/ccpa)
- [Data Processing Agreement](/en/glossary/data-processing-agreement)
- [PII Detection](/en/glossary/pii-detection)
- [SOC 2](/en/glossary/soc-2)

[Back to the AI Glossary](/en/glossary)