Resource
The plain-English
guide to HIPAA
guide to HIPAA
Everything a small practice actually needs to understand about HIPAA — without the legalese. Start at the top, or jump to what you need.
The basics
What is HIPAA, really?
HIPAA — the Health Insurance Portability and Accountability Act — is the U.S. law that sets the rules for protecting patients' health information. If your organization creates, receives, stores, or transmits protected health information (PHI), HIPAA almost certainly applies to you. At its heart, it asks one simple thing: take reasonable, documented steps to keep patient information private and secure.
Key terms in 30 seconds
PHI
Protected Health Information — any health data that can identify a patient.
Covered Entity
A provider, health plan, or clearinghouse that handles PHI directly.
Business Associate
A vendor that handles PHI on behalf of a covered entity.
BAA
The contract that binds a business associate to protect PHI.
The rules that matter
The Privacy Rule
Sets national standards for when and how PHI can be used and disclosed, and gives patients rights over their own information — including the right to access it.
The Security Rule
Requires administrative, physical, and technical safeguards to protect electronic PHI. This is where risk assessments, access controls, and encryption live.
The Breach Notification Rule
Defines what counts as a breach and the timeline — generally within 60 days — for notifying affected individuals, HHS, and sometimes the media.
The Omnibus Rule
Extended HIPAA obligations directly to business associates and strengthened enforcement and patient rights.
Guides & deep dives
All
Getting started
Risk
Vendors
Breaches
Training
HIPAA compliance checklist for small practices
The essential steps to get compliant, in order.
8 min
How to run a Security Risk Assessment
What an SRA is, why it’s required, and how to do one.
10 min
When do you need a BAA?
A simple decision guide for business associate agreements.
6 min
What to do in the first 24 hours of a breach
A calm, step-by-step incident response playbook.
7 min
Building a workforce training program
Role-based training that staff actually complete.
9 min
The HIPAA policies every practice needs
A tour of the required policies and what they cover.
12 min
The all-in-one HIPAA compliance platform for modern healthcare teams.
Industries
Compare
Resources