Who HIPAA Covers: Covered Entities, Business Associates and Protected Health Information

Rule versions described: the HIPAA Administrative Simplification regulations at 45 CFR Parts 160, 162 and 164, including the definitions in 45 CFR 160.103 as amended through 91 FR 14404 (March 24, 2026) and the de-identification standard at 45 CFR 164.514 as amended by the 2013 Omnibus Rule; current eCFR and Cornell LII text read October 28, 2026. The proposed Security Rule update (90 FR 898, January 6, 2025) is a proposal only and is not in force. Rules change: check the regulator's current text before relying on any point.

Most people use "HIPAA" as a word for medical privacy in general. A receptionist will say "HIPAA" to decline a phone request, an employer will say it to avoid a question, and a fitness company may put "HIPAA compliant" on its website even though the law does not reach it at all. The law is narrower and more mechanical than that. Whether HIPAA applies to a piece of information depends almost entirely on who holds it and in what role. The same blood pressure reading is protected health information in a cardiologist's chart, an employment record in a personnel file, an education record in a school nurse's office and unregulated consumer data in a phone app the patient downloaded on her own.

This lesson is about that first question: who is covered. Every later lesson in this module depends on the answer. If an organization is not a covered entity or a business associate, the Privacy Rule (lesson 2), the Security Rule (lesson 3), the risk analysis requirement (lesson 4) and the Breach Notification Rule (lesson 5) do not apply to it. If it is, they all do. The overview of HIPAA for patients and the public is in Privacy and Data Security Laws, lesson 3: Health Privacy: HIPAA and Beyond; this lesson does not repeat it and goes further into the definitions, the edge cases and real examples. If you are new to security basics, start with Home Computer Security and Small Business Data Security. The compliance manager's view of HIPAA among other federal laws is in Federal Laws That Reach Your Business.

Why HIPAA exists, and why privacy rides on billing

The Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, was signed on August 21, 1996.¹ Its headline purpose was insurance portability: letting workers keep health coverage when they changed jobs. Privacy was almost an afterthought. Title II of the law contained a subtitle called "Administrative Simplification." Its goal was to cut the paperwork cost of American health care by making every health plan and provider use the same electronic formats for claims, eligibility checks, payments and other routine business. Sections 261 through 264 told the Secretary of Health and Human Services to adopt national standards for those electronic transactions, and, because Congress realized that moving the country's medical billing onto networks would put health information at new risk, also standards for the privacy and security of that information.¹

That origin explains the most surprising feature of HIPAA: it covers organizations because of how they bill, not because of what information they hold. The trigger for a provider is electronic billing. A clinic that never sends a claim, an eligibility check or another standard transaction electronically, and never has anyone send one on its behalf, is not a covered entity no matter how sensitive its records are. Congress gave HHS authority over the organizations that use the new electronic standards, and the privacy and security rules were built on that foundation.

HHS wrote the rules in stages. The first was the transactions and code sets rule, "Health Insurance Reform: Standards for Electronic Transactions," published August 17, 2000 at 65 FR 50312, which adopted the electronic formats.² The Privacy Rule followed on December 28, 2000 at 65 FR 82462, after a 1999 proposal that drew more than 52,000 comments, and HHS modified it on August 14, 2002 at 67 FR 53182. Covered entities had to comply with the Privacy Rule by April 14, 2003; small health plans, those with annual receipts of $5 million or less, had until April 14, 2004.¹ The Security Rule, "Health Insurance Reform: Security Standards," was published February 20, 2003 at 68 FR 8334, with compliance due April 20, 2005 (April 20, 2006 for small health plans).³⁴ The Enforcement Rule, setting out how HHS investigates and imposes civil money penalties, was published February 16, 2006 at 71 FR 8390.⁵

The second era began with the Health Information Technology for Economic and Clinical Health (HITECH) Act, Title XIII of the American Recovery and Reinvestment Act of 2009, Public Law 111-5, signed February 17, 2009. HITECH created the breach notification requirement, raised and tiered the penalties, gave state attorneys general the power to sue, clarified that employees and other individuals can be prosecuted for obtaining health information without authorization, and made business associates directly responsible for complying with the Security Rule and parts of the Privacy Rule.⁶ HHS issued the interim final breach notification rule on August 24, 2009 at 74 FR 42740.⁷ Then came the rule that defines today's version of "who is covered": the Omnibus Rule, published January 25, 2013 at 78 FR 5566, effective March 26, 2013, with compliance required by September 23, 2013. It finalized direct liability for business associates, extended it to subcontractors, replaced the breach "harm" standard with a "low probability of compromise" test, and finalized the tiered penalties.⁸

The rules have kept moving since. In 2024 HHS issued a new 42 CFR Part 2 rule for substance use disorder records and a reproductive health privacy rule that a federal court mostly vacated in June 2025 (both covered in lesson 2). On January 6, 2025, HHS proposed a major Security Rule overhaul at 90 FR 898. As of October 28, 2026, the Security Rule overhaul is still a proposal; HHS's own regulatory agenda now lists it as a long-term action with a projected final action date of July 2027.⁹ And on March 24, 2026, HHS adopted a standard for electronic health care claims attachments and electronic signatures (91 FR 14350), effective May 26, 2026 with compliance required by May 26, 2028, which also changed the wording of the "transaction" definition in 45 CFR 160.103 from "health claims attachments" to "health care claims attachments."¹⁰ That small amendment is a reminder that the definitions in this lesson are living text.

The rules in one paragraph each

Readers of this module will hear the names constantly, so here is the minimum. The Privacy Rule (45 CFR Part 164, Subpart E) says when a covered entity or business associate may use or disclose PHI and gives individuals rights over it, such as the right of access. The Security Rule (Subpart C) requires administrative, physical and technical safeguards for electronic PHI, starting with a risk analysis. The Breach Notification Rule (Subpart D) requires notice to individuals, HHS and sometimes the media after a breach of unsecured PHI. The Enforcement Rule (45 CFR Part 160, Subparts C to E) sets out investigations, penalties and hearings. The transactions, code sets and identifier rules (45 CFR Part 162) set the electronic billing formats, and they are enforced not by OCR but by the National Standards Group at the Centers for Medicare and Medicaid Services (CMS).¹¹ All of them use the same definitions, which live in 45 CFR 160.103 and 164.103.¹²

The three kinds of covered entity

The regulation defines a covered entity in one short sentence with three parts. A covered entity is "(1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter."¹² The rest of this section explains those three lines. CMS publishes a set of decision charts that walk through the same questions, and HHS links to a question and answer decision tool on the CMS site.¹³¹⁴

Health plans

A health plan is "an individual or group plan that provides, or pays the cost of, medical care." The definition then lists what is included: group health plans, health insurance issuers, HMOs, Medicare Parts A and B, Medicaid, Medicare Part D prescription drug plans, issuers of Medicare supplemental (Medigap) policies, issuers of long-term care policies (excluding nursing home fixed indemnity policies), multiple employer welfare arrangements, the health care programs for the uniformed services and for veterans, the Indian Health Service program, the Federal Employees Health Benefits Program, state Children's Health Insurance Programs, Medicare Advantage, high-risk pools, and any other individual or group plan that provides or pays the cost of medical care.¹² In plain terms: the insurer on your card, the government program that pays your bills, and the employer plan you are enrolled in.

Two details catch people. First, a "group health plan" is the employee benefit plan itself (an ERISA welfare plan, insured or self-insured), not the employer. It counts as a HIPAA health plan if it has 50 or more participants, or if it is administered by an entity other than the employer that established it.¹² A small employer that runs its own self-administered plan for fewer than 50 participants falls outside the definition. Most employer plans, though, use an insurer or a third-party administrator, which brings them in. OCR treats these plans as fully regulated covered entities: on June 18, 2026, the Spencer Gifts LLC Flexible Benefits and Welfare Benefit Plans paid $450,000 to settle a ransomware investigation affecting about 10,023 people, and on April 23, 2026 the Star Group L.P. Health Benefits Plan paid $245,000.¹⁵¹⁶ The plan is the covered entity even though its staff are company employees.

Second, some insurance that pays money when you are sick or hurt is not a health plan at all. The definition excludes "excepted benefits" as listed in section 2791(c)(1) of the Public Health Service Act: coverage only for accident or disability income insurance, supplements to liability insurance, liability insurance including auto liability, workers' compensation or similar insurance, automobile medical payment insurance, credit-only insurance, coverage for on-site medical clinics, and other similar coverage where medical benefits are secondary or incidental.¹⁷ Life insurance is not medical coverage and is not on the health plan list either. So a workers' compensation carrier, an auto insurer's medical payments unit, a disability income insurer and a life insurer are generally not HIPAA health plans, even though each may hold detailed medical records about you. They get those records lawfully, often through an authorization you sign or through the Privacy Rule's permission for disclosures required by workers' compensation laws, and once the records are in their hands HIPAA no longer follows them. State insurance privacy laws and, for some uses, the Fair Credit Reporting Act apply instead.

The definition also excludes certain government programs whose principal purpose is not paying for health care, or whose principal activity is directly providing care or making grants to fund it.¹² A state program that gives grants to community clinics is not itself a health plan, though the clinics it funds will often be covered providers.

Health care clearinghouses

A clearinghouse is a public or private entity, "including a billing service, repricing company, community health management information system or community health information system, and 'value-added' networks and switches," that converts health information it receives in a nonstandard format into a standard transaction, or converts a standard transaction it receives into a nonstandard format for the receiving entity.¹² CMS's chart adds the key condition: the conversion must be done for another legal entity.¹³ A hospital billing office that formats its own claims is not a clearinghouse; a company that takes claims from hundreds of clinics in whatever form they arrive and turns them into standard X12 transactions for payers is one.

Clearinghouses are the least visible covered entities and among the most important. They sit between thousands of providers and hundreds of payers, so a single clearinghouse can hold data on a large share of the country. The largest health data breach ever reported to OCR, the February 2024 ransomware attack on Change Healthcare, hit a clearinghouse. OCR's own FAQ says about 192.7 million people were affected as of July 31, 2025, and OCR's report to Congress for calendar year 2024 describes the year's largest breach, about 192 million people, as ransomware that compromised the servers of a health care clearinghouse.¹⁸¹⁹ Clearinghouses have a special status in the Privacy Rule. When a clearinghouse creates or receives PHI as a business associate of another covered entity, which is the usual case, most of the Privacy Rule's individual rights obligations rest with the covered entity it serves. Its duties to protect and limit use of the data remain.²⁰

Health care providers and the "standard transaction" trigger

A health care provider is a provider of services or of medical or health services as defined in the Medicare statute, plus "any other person or organization who furnishes, bills, or is paid for health care in the normal course of business."¹² Health care itself is defined broadly: "care, services, or supplies related to the health of an individual," including preventive, diagnostic, therapeutic, rehabilitative, maintenance and palliative care, counseling, assessments, and the sale or dispensing of prescription drugs or devices.¹² Doctors, nurse practitioners, hospitals, clinics, psychologists, counselors, dentists, chiropractors, physical therapists, nursing homes, home health agencies, ambulance services, laboratories, imaging centers and pharmacies all qualify. HHS's covered entities page lists most of these by name.¹⁴

Being a provider is not enough. The provider is covered only if it "transmits any health information in electronic form in connection with a transaction" for which HHS has adopted a standard.¹² "Transaction" means "the transmission of information between two parties to carry out financial or administrative activities related to health care," and the regulation lists the types: claims or equivalent encounter information; payment and remittance advice; coordination of benefits; claim status; enrollment and disenrollment in a health plan; eligibility for a health plan; premium payments; referral certification and authorization; first report of injury; health care claims attachments; electronic funds transfers with remittance advice; and other transactions the Secretary prescribes.¹² HHS has adopted standards for most of these in 45 CFR Part 162. CMS's chart lists the core eight that matter to most offices: claims or encounter information, eligibility, referral certification and authorization, claim status, enrollment and disenrollment, payment and remittance advice, premium payment, and coordination of benefits.¹³ No standard has been adopted for first report of injury, and the claims attachment standard adopted in March 2026 does not require compliance until May 26, 2028.¹⁰

Four practical rules follow from that text.

1. One electronic transaction is enough. The word in the regulation is "any." A practice that bills one insurer electronically and takes cash from everyone else is a covered entity for all its patients.
2. A billing service counts. CMS's chart says a provider that "uses another entity (such as a clearinghouse) to conduct covered transactions in electronic form on its behalf" is "considered to be conducting the transaction in electronic form."¹³ A clinic cannot stay outside HIPAA by handing its claims to an outside biller who files them electronically.
3. Once covered, everything is covered. Coverage attaches to the provider, not to the transaction. After the trigger, the Privacy Rule applies to all of the provider's PHI in any form, including paper charts and spoken conversations, and the Security Rule applies to all of its electronic PHI.
4. Email alone does not trigger coverage. HHS's Privacy Rule summary notes that sending email does not make a provider covered; the transmission must be in connection with a standard transaction.¹ A cash-only counselor who emails appointment reminders is not covered by that alone.

In practice, almost every provider that takes insurance is covered, because insurers, Medicare and Medicaid require or strongly push electronic claims. The providers who are genuinely outside HIPAA are a narrow group: cash-only practices that never verify coverage or file claims electronically, some direct primary care and concierge practices, some cash-only cosmetic or wellness businesses, and providers whose only billing is paper. Even those may be swept in later if they start billing one plan electronically, and many choose to follow HIPAA anyway because their contracts or state law expect it.

Covered entities at a glance

Small does not mean exempt

HIPAA has almost no size exemption for providers. A solo physical therapist with one employee is held to the same Privacy Rule and the same Security Rule standards as a 600-bed hospital, although the Security Rule lets a small entity choose safeguards that fit its "size, complexity, and capabilities" (see lesson 3). The only size-based rule for health plans is the later compliance dates for small health plans, which expired in 2004 and 2006, and the definitional carve-out for self-administered group plans with fewer than 50 participants. OCR's enforcement record shows small entities are not ignored: recent Security Rule settlements with small practices and vendors have been as low as $10,000, but each came with a two-year (sometimes three-year) corrective action plan monitored by OCR.²¹

Hybrid entities, affiliated covered entities and organized health care arrangements

Real organizations rarely fit one box. A university runs a student health center, a sports medicine clinic and a law school. A county runs a public health clinic, a jail and a road department. A health system owns six hospitals through six separate corporations. HIPAA has three tools for these structures, and they are among the most misunderstood parts of the rule.

Hybrid entities

A hybrid entity is "a single legal entity: (1) That is a covered entity; (2) Whose business activities include both covered and non-covered functions; and (3) That designates health care components" as the rule requires.²² If an entity takes that step, most of the Privacy and Security Rules apply only to its designated health care components, not to the whole organization.²³ A county that designates its clinic as a health care component does not have to run its road department under HIPAA.

The designation comes with conditions in 45 CFR 164.105(a):

• The designation must include any component that would meet the definition of a covered entity or business associate if it were a separate legal entity. The entity may not leave its billing office or IT department out if that office handles the clinic's PHI.²³
• The health care component may not disclose PHI to other parts of the organization in ways the Privacy Rule would prohibit between separate companies, and must protect electronic PHI from the rest of the organization as if they were separate entities. In compliance shorthand this is the "firewall."²³
• Staff who work for both sides may not use PHI they learned in the health care component for their other job.²³
• The legal entity as a whole stays responsible for compliance, for policies and procedures, and for business associate arrangements. The designation must be documented and kept for six years from when it was created or last in effect, whichever is later.²³

Idaho has a public example. Idaho State University states on its HIPAA page that it "is designated as a Hybrid Entity," that several of its clinics have been designated as health care components, and that more clinics may be designated if they begin performing HIPAA covered transactions.²⁴ The 2019 federal joint guidance on FERPA and HIPAA describes the same choice for colleges: a postsecondary institution that is a covered entity may elect hybrid status so the Privacy Rule applies only to its designated health care component.²⁵ Hybrid status is optional. An entity that does not designate components is treated as a covered entity in its entirety, which means every department's handling of PHI is regulated.

Affiliated covered entities

Going the other direction, legally separate covered entities "under common ownership or control" may designate themselves as a single affiliated covered entity (ACE) under 45 CFR 164.105(b).²³ A health system that owns several hospital corporations and a physician group can then issue one Notice of Privacy Practices, run one compliance program and share PHI internally as one entity. The designation must be documented and kept for six years, and if the ACE combines the functions of a health plan with those of a provider or clearinghouse, it must keep the plan's PHI separate as the rule requires.²³ An ACE is a convenience for compliance, not a loophole: every member stays liable for the rule.

Organized health care arrangements

An organized health care arrangement (OHCA) is a looser grouping of separate covered entities that work together closely enough to share information for joint operations without business associate agreements between them. The definition in 45 CFR 160.103 has five forms: (1) a clinically integrated care setting where patients typically receive care from more than one provider, such as a hospital and the independent physicians on its medical staff; (2) an organized system of care in which covered entities hold themselves out to the public as a joint arrangement and share utilization review, quality assessment or financial risk; (3) a group health plan and its insurer or HMO, for PHI about the plan's participants; (4) several group health plans maintained by the same sponsor; and (5) those group health plans together with their insurers or HMOs.¹² HHS's business associate FAQs confirm that covered entities in an OHCA, including a hospital and its privileged physicians, do not need business associate contracts with each other for the OHCA's joint activities.²⁶ The business associate definition itself carves out a covered entity "participating in an organized health care arrangement" performing functions for that arrangement.¹²

Business associates: the vendors HIPAA follows

Covered entities do not do everything themselves. They hire billing companies, IT providers, cloud services, electronic health record vendors, transcription services, collection agencies, consultants, auditors and shredding companies. If HIPAA stopped at the covered entity, health information would lose its protection the moment it left the building. The business associate rules close that gap.

The definition in 45 CFR 160.103

A business associate is a person who, on behalf of a covered entity (or an organized health care arrangement), other than as a member of its workforce, does one of two things:¹²

1. Handles PHI for a regulated function or activity. It "creates, receives, maintains, or transmits" PHI for a function or activity regulated by HIPAA, such as claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities, billing, benefit management, practice management and repricing.
2. Provides certain services involving PHI. It provides "legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services" to or for the covered entity, where the service involves disclosure of PHI.

The definition expressly includes health information organizations, e-prescribing gateways and other people who provide data transmission services and need routine access to PHI; a person who offers a personal health record to individuals on behalf of a covered entity; and subcontractors. It also says that a covered entity may be a business associate of another covered entity.¹² HHS's business associate guidance gives the everyday version: claims processing, data analysis, billing and practice management, plus legal, actuarial, accounting and accreditation services, and it names health information exchanges, cloud providers, IT and EHR vendors, third-party administrators, patient safety organizations and pharmacy benefit managers among typical business associates.²⁷

Four words in that definition do most of the work. "Maintains" was added by the Omnibus Rule to make clear that storage counts: the preamble says an entity that maintains PHI on behalf of a covered entity is a business associate even if it does not actually view the information, and that document storage companies are business associates regardless of whether they look at what they hold.⁸ "On behalf of" means the vendor works for the covered entity; a hospital sending a chart to a specialist for treatment is not making the specialist its business associate. "Other than in the capacity of a member of the workforce" means employees, volunteers and trainees under the covered entity's direct control are workforce, not business associates.¹² And "person" in HIPAA means a natural person, trust, estate, partnership, corporation, association or other entity, public or private, so a state agency or a one-person consultancy can be a business associate.

What the definition leaves out

The rule lists four exclusions: a health care provider receiving PHI for treatment of the individual; a plan sponsor receiving PHI from its group health plan when the plan document requirements of 45 CFR 164.504(f) are met; a government agency determining eligibility for or enrollment in a government health plan, to the extent authorized by law; and a covered entity participating in an OHCA performing functions for that arrangement.¹² HHS guidance and FAQs add practical cases that are not business associate relationships:

• People whose work does not involve PHI and whose contact with it is incidental at most, such as janitors and electricians, as long as reasonable safeguards are in place.²⁷
• A provider billing a health plan, or a plan paying the claim, because each acts on its own behalf.²⁷
• Banks and other financial institutions processing payment card transactions, checks and electronic funds transfers for health care payments, which HHS treats as ordinary banking services.²⁷
• Researchers receiving PHI under the research provisions, a reinsurer selling coverage to a health plan, and a software vendor that has no access to the covered entity's PHI.²⁶
• Conduits, discussed below.

Subcontractors: the chain does not stop

A subcontractor is "a person to whom a business associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of such business associate."¹² Because the business associate definition includes subcontractors that create, receive, maintain or transmit PHI on behalf of the business associate, every link in the chain is itself a business associate. A clinic hires a billing company (business associate). The billing company uses a cloud platform to host its software (subcontractor, also a business associate). The cloud platform hires a data center operator with access to the storage (another subcontractor, another business associate). Each must have a written agreement with the party above it: the covered entity with its business associate, and each business associate with its subcontractor. The covered entity does not need a contract with the subcontractors; the business associate does.⁸ The required contract terms are in 45 CFR 164.504(e) and 164.314(a) and are the subject of lesson 6.²⁸

Direct liability since 2013

Before HITECH, a business associate's only HIPAA obligation was its contract. If it broke the contract, the covered entity could sue it or end the relationship, but the government could not penalize the vendor directly. HITECH changed that, and the Omnibus Rule implemented it: from September 23, 2013, business associates and subcontractors are directly liable for civil money penalties.⁸ OCR's fact sheet "Direct Liability of Business Associates," published May 24, 2019 and last reviewed July 16, 2021, lists exactly what OCR can enforce directly against a business associate:²⁹

1. Failure to provide the Secretary with records and compliance reports, cooperate with complaint investigations and compliance reviews, and permit access by the Secretary to information, including PHI, pertinent to determining compliance.
2. Retaliating against anyone for filing a HIPAA complaint, participating in an investigation or other enforcement process, or opposing an act or practice that is unlawful under the HIPAA Rules.
3. Failure to comply with the requirements of the Security Rule.
4. Failure to provide breach notification to a covered entity or another business associate.
5. Impermissible uses and disclosures of PHI.
6. Failure to disclose a copy of electronic PHI to the covered entity, or to the individual or the individual's designee, as the business associate agreement specifies, to satisfy an individual's request for an electronic copy.
7. Failure to make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose.
8. Failure, in certain circumstances, to provide an accounting of disclosures.
9. Failure to enter into business associate agreements with subcontractors that create or receive PHI on its behalf, and failure to comply with the implementation specifications for such agreements.
10. Failure to take reasonable steps to address a material breach or violation of a subcontractor's business associate agreement.

The fact sheet also states the limit: OCR may take enforcement action against business associates only for those requirements. For example, OCR lacks authority to enforce the "reasonable, cost-based fee" limit on copies directly against a business associate; that duty stays with the covered entity.²⁹ Everything else a business associate promises in its contract, such as a faster breach reporting deadline, is enforceable by the covered entity under contract law, not by OCR.

The Security Rule item is the heavy one. It means a two-person IT company that supports a dental office must do its own risk analysis, train its own staff, control its own access and keep its own documentation, exactly as the dental office must. OCR's enforcement against vendors shows what that looks like:

• On June 30, 2016, Catholic Health Care Services of the Archdiocese of Philadelphia, which provided management and IT services to six nursing homes, agreed to pay $650,000 after a stolen employee iPhone, not encrypted or password protected, exposed residents' PHI. Law firm commentary at the time described it as the first OCR enforcement action against a business associate since the Omnibus Rule.³⁰
• On May 23, 2019, Medical Informatics Engineering, an Indiana electronic medical record vendor, paid OCR $100,000.³¹ Six days later, on May 29, 2019, 16 state attorneys general led by Indiana announced a $900,000 settlement with the company over the 2015 hack of its WebChart application, which affected more than 3.9 million people; the Tennessee attorney general called it the first multistate lawsuit involving a HIPAA-related data breach.³²
• On March 21, 2025, Health Fitness Corporation, an Illinois company providing wellness programs to employer clients, paid $227,816 after a server misconfiguration made ePHI discoverable on the internet; OCR found no accurate and thorough risk analysis until January 2024.³³
• On May 30, 2025, Comstar, LLC, a Massachusetts company that bills for nonprofit and municipal ambulance services and was a business associate of more than 70 covered entities, paid $75,000 after a 2022 ransomware attack affecting about 585,621 people.³⁴ In January 2026 the Massachusetts and Connecticut attorneys general reached separate settlements with Comstar totaling $515,000, according to a law firm summary.³⁵
• On April 23, 2026, Consociate Health, a third-party administrator acting as a business associate, paid $225,000 to resolve a ransomware investigation affecting about 136,539 people.¹⁶

The breach numbers explain why OCR cares. In OCR's report to Congress for calendar year 2024, breaches involving a business associate were 106 of 663 large breach reports (16 percent), but they affected about 206,921,071 of the 242,908,056 people in those reports (85 percent).¹⁹ Vendors are fewer in number than covered entities, but they hold data for many covered entities at once.

The conduit exception

Some companies carry PHI without being business associates: the Postal Service, UPS and FedEx, private couriers, and the telephone company. The Omnibus preamble calls the conduit exception "a narrow one" intended to exclude only entities providing mere courier services, and explains that a conduit transports information but does not access it other than on a random or infrequent basis.⁸ OCR's cloud FAQ, first published October 6, 2016 and last reviewed September 22, 2026, states the boundary in two sentences: "the conduit exception is limited to transmission-only services for PHI," including temporary storage incident to that transmission, and "any access to PHI by a conduit is only transient in nature."³⁶

Storage ends the exception. A cloud service that maintains ePHI "for the purpose of storing it will qualify as a business associate, and not a conduit," and that is true "even if the CSP cannot view the ePHI because it is encrypted and the CSP does not have the decryption key." A service that both transmits and stores is a business associate.³⁶ OCR's 2016 cloud computing guidance says the same: "Lacking an encryption key does not exempt a CSP from business associate status."³⁷ Applied to common vendors:

• An internet service provider that carries a clinic's traffic is generally a conduit.
• An email or secure messaging service that stores messages in mailboxes is maintaining PHI and is a business associate, which is why major email and collaboration vendors offer business associate agreements.
• An electronic fax service that keeps copies of faxes on its servers is generally a business associate; a plain phone line carrying a paper fax is not. The definition of electronic media itself says paper faxes and voice calls are not electronic transmissions if the information did not exist in electronic form immediately before the transmission.¹²
• A courier that carries sealed specimen boxes is a conduit; a records storage company that keeps boxes of charts in a warehouse is a business associate.

What protected health information is

Covered entities and business associates are the "who." Protected health information is the "what." The definitions are nested like boxes, and it helps to open them one at a time.

Box 1: health information

Health information is "any information, including genetic information, whether oral or recorded in any form or medium," that is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse, and that relates to the past, present or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present or future payment for health care.¹² Notice two things. The definition is not limited to diagnoses: an appointment time, a bill, a pharmacy pickup and the fact that someone is a patient at all are health information. And it includes oral information, so a conversation at the front desk can involve PHI.

Box 2: individually identifiable

Individually identifiable health information is the subset of health information, including demographic information collected from an individual, that is created or received by a provider, plan, employer or clearinghouse, relates to health, care or payment, and either "identifies the individual" or provides "a reasonable basis to believe the information can be used to identify the individual."¹² The second half of that test is what makes HIPAA broad. A record does not need a name to be identifiable. A medical record number, an exact date of birth with a small-town ZIP code, a photograph, or an IP address tied to a patient portal login can each be enough.

The "reasonable basis" test was at the center of the fight over website tracking tools. OCR's bulletin on online tracking technologies, first issued in December 2022 and revised in March 2024, said that tracking code on a covered entity's website or app could disclose PHI to technology vendors. On June 20, 2024, in American Hospital Association v. Becerra, a federal court in Texas vacated the bulletin to the extent it said HIPAA obligations arise when technology connects an individual's IP address with a visit to an unauthenticated public web page about specific health conditions or providers; HHS dropped its appeal in August 2024.³⁸ Tracking on authenticated pages, such as patient portals, was not part of that ruling, and the issue still drives breach reports: Blue Shield of California reported about 4.7 million people affected by website tracking tools in 2025, according to HIPAA Journal's count.³⁹ Lesson 6 covers tracking vendors in detail.

Box 3: protected health information

Protected health information is individually identifiable health information that is transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium, with four exclusions. The HIPAA Rules regulate it in the hands of covered entities and business associates, which is why the third test in the graphic below is about who holds the information. PHI does not include:¹²

1. Education records covered by the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. 1232g.
2. Records described at 20 U.S.C. 1232g(a)(4)(B)(iv), the "treatment records" of students who are 18 or older or attend a postsecondary institution, made by physicians, psychiatrists, psychologists or other recognized professionals and used only for treatment.
3. Employment records held by a covered entity in its role as employer.
4. Information regarding a person who has been deceased for more than 50 years.

Electronic protected health information (ePHI) is the part of PHI that is transmitted by or maintained in electronic media.¹² Electronic media covers storage (hard drives, removable media such as tapes, disks, optical discs and memory cards) and transmission (the internet, extranets and intranets, leased and dial-up lines, private networks, and the physical movement of removable storage). The Privacy Rule protects all PHI. The Security Rule protects only ePHI. A paper chart is PHI but not ePHI; once it is scanned into the electronic health record, the scan is ePHI.

Leaving HIPAA: de-identification

Health information that does not identify an individual, and for which there is no reasonable basis to believe it can, is not individually identifiable and therefore not PHI. The Privacy Rule "does not restrict the use or disclosure of de-identified health information," in the words of HHS's de-identification guidance released in November 2012.⁴⁰ 45 CFR 164.514(b) allows only two ways to get there.⁴¹

Expert determination (164.514(b)(1)). A person "with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable" applies those methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual, and documents the methods and results.⁴¹ The rule does not require a particular degree or certification, and HHS's guidance notes it does not require an expiration date, though experts often limit a determination to a period or a recipient because re-identification risk changes as more public data appears.⁴⁰ Expert determination is how researchers and analytics firms keep useful details, such as full dates or small geographic areas, that safe harbor would strip out.

Safe harbor (164.514(b)(2)). The covered entity removes 18 kinds of identifiers of the individual and of the individual's relatives, employers and household members, and has no actual knowledge that the remaining information could be used, alone or in combination, to identify the individual.⁴¹ HHS describes "actual knowledge" as clear and direct knowledge that the remaining information could identify someone; a covered entity that knows the data set is re-identifiable cannot hide behind the checklist.⁴⁰ The 18 identifiers are:

Two details matter for Idaho. HHS's guidance lists 17 three-digit ZIP areas that had 20,000 or fewer people in the 2000 Census and must be reported as 000; none of them is an Idaho prefix (Idaho ZIP codes begin with 832 through 838), but the guidance warns that the list should be checked against current Census data, and several neighboring Wyoming prefixes (821, 823, 830 and 831) are on it.⁴⁰ And the year of an event may stay in a safe harbor data set, so "2009" is acceptable where "January 1, 2009" is not.⁴⁰

A covered entity may assign a code so it can re-identify the data later, as long as the code is not derived from information about the individual (a scrambled Social Security number does not qualify) and the entity does not use or disclose the code for other purposes or reveal how it works.⁴¹

The middle ground: limited data sets

Between full PHI and de-identified data sits the limited data set in 45 CFR 164.514(e). It is still PHI, but with 16 direct identifiers removed: names; postal address information other than town or city, state and ZIP code; telephone and fax numbers; email addresses; Social Security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate and license numbers; vehicle identifiers; device identifiers; URLs; IP addresses; biometric identifiers; and full-face photographs and comparable images.⁴¹ Dates and five-digit ZIP codes may stay, which is why limited data sets are popular for research and public health. A covered entity may use or disclose a limited data set only for research, public health or health care operations, and only under a data use agreement in which the recipient promises not to use or disclose the data beyond the agreement, to use appropriate safeguards, to report unauthorized uses, to bind its agents to the same terms, and not to identify the information or contact the individuals.⁴¹

What HIPAA does not cover

The flip side of "HIPAA follows the organization" is that a great deal of health information is held by organizations HIPAA never reaches, or in roles it excludes. Knowing these gaps is as important as knowing the rule, because people routinely assume protection that does not exist, and organizations routinely claim HIPAA as a reason to refuse requests it does not govern. The overview of health data outside HIPAA, including state health data laws such as Washington's My Health My Data Act and genetic privacy, is in module 69, lesson 3. This section lists the gaps and points to the law that applies instead.

Employers acting as employers

HHS says plainly: "In most cases, the Privacy Rule does not apply to the actions of an employer."⁴² An employer can ask an employee for a doctor's note or other health information it needs for sick leave, workers' compensation, wellness programs or health insurance. What the Privacy Rule controls is the provider: a provider "cannot give your employer the information without your authorization" unless another law requires it.⁴² Once the note is in the personnel file, it is an employment record. Even a hospital, which is a covered entity, holds its own employees' sick notes, drug test results and fitness for duty forms as employment records excluded from PHI, as long as it holds them in its role as employer.¹² The hospital's medical record of that same nurse, created when she was treated in its emergency department, is PHI. Other laws fill part of the gap: the Americans with Disabilities Act and the Genetic Information Nondiscrimination Act require employers to keep medical information confidential and separate from general personnel files.

The exception inside the exception is the group health plan. The plan is a covered entity, and the employer as plan sponsor may receive PHI from the plan only for plan administration and only after amending the plan documents to restrict its use, under 45 CFR 164.504(f).²⁸ The proposed Security Rule update would add a requirement that group health plan documents require plan sponsors to comply with the Security Rule's safeguards; that proposal is not final.⁹

Schools, school nurses and FERPA

Health records kept by an elementary or secondary school, including a school nurse's records, are generally education records under FERPA, not PHI. The Department of Education and HHS joint guidance, first issued in November 2008 and updated in December 2019, says such records "would generally constitute education records subject to FERPA."²⁵ That is true even when the school is a HIPAA covered entity because it bills Medicaid electronically for services such as speech therapy: the school must use the HIPAA transaction standards for the billing, but the Privacy Rule does not apply to the student records, and FERPA's parental consent rules govern the disclosure to Medicaid.²⁵ If an outside provider, such as a hospital, places a nurse in a school but does not act on the school's behalf, its records are not education records; they are PHI if that provider is a covered entity.²⁵ At a university clinic, records about enrolled students are generally education or treatment records under FERPA, while records about nonstudent patients, such as faculty, staff and their families, are "subject to the HIPAA Rules."²⁵

Records of people who died long ago

Information about a person who has been dead for more than 50 years is not PHI.¹² A historical society that receives a box of 1960s hospital ledgers, or a genealogist researching a great-grandparent's sanatorium stay, is outside HIPAA for those records. Records of people who died more recently remain PHI for 50 years after death, and the deceased person's personal representative (usually the executor or administrator of the estate) exercises the individual's rights.

Life, disability, auto and workers' compensation insurers

As explained above, these carriers are generally not health plans because their coverage is an excepted benefit or is not medical coverage.¹⁷ They are regulated by state insurance law, and an insurer's use of medical information obtained from consumer reporting agencies falls under the Fair Credit Reporting Act.

Consumer apps, wearables and direct-to-consumer services

The largest gap is the consumer market. OCR's health app scenarios, published in February 2016, still state the test well. When a consumer downloads an app on her own and enters her blood glucose and blood pressure readings, the developer is not a business associate. When she downloads her records from her doctor's portal into an app of her choosing, the developer is not a business associate. When a doctor merely recommends an app, or the app connects to an EHR at the consumer's direction, the developer is still not a business associate. But when a provider contracts with a developer for a patient management app and directs patients to use it, or a health plan offers an app with claims data to its members, the developer is a business associate for that app.⁴³ The questions the scenarios tell developers to ask are the right ones for anyone: Who chose the app, the consumer or a covered entity? Who pays the developer? Does a covered entity direct how the developer handles the data?⁴³

Consumer health data outside HIPAA is not lawless. The FTC Health Breach Notification Rule, 16 CFR Part 318, as amended by a final rule published May 30, 2024 (89 FR 47028) and effective July 29, 2024, covers vendors of personal health records and related entities, including many health apps, and treats an unauthorized disclosure, not only a hack, as a breach.⁴⁴ Section 5 of the FTC Act reaches unfair or deceptive practices, and state consumer privacy and health data laws apply in some states. The FTC's Mobile Health Apps Interactive Tool, built with OCR, the HHS Office of the National Coordinator for Health IT and the FDA and updated in December 2022, walks a developer through which laws apply.⁴⁵ The details of the FTC rule are in lesson 5 and in module 69, lesson 3; they are not repeated here.

The same logic applies to gyms, fitness studios, smart scales, sleep trackers, period trackers, direct-to-consumer genetic testing companies and many cash-pay telehealth and wellness services. Whether any one of them is covered depends on its facts: a telehealth company whose clinicians bill insurance electronically is a covered provider, while a supplement subscription service that never bills a health plan is not. A wellness vendor hired by an employer's group health plan, like Health Fitness Corporation above, is a business associate of the plan; a gym that sells memberships directly to the public is not covered at all.

Other common gaps

• Most employers, landlords, banks and retailers outside their health plan roles. A bank processing a patient's card payment to a clinic is not a business associate.²⁷
• Law enforcement, courts and child welfare agencies that receive PHI from a covered entity under a Privacy Rule permission. Once disclosed lawfully, the information is governed by the recipient's own laws, such as public records exemptions and criminal justice confidentiality rules.
• Researchers who are not part of a covered entity, after receiving data under the research provisions, unless a data use agreement or other contract binds them.
• Individuals, including patients who post their own diagnoses online and family members who share a relative's condition. HIPAA regulates organizations in defined roles, not private conversation.

The Idaho breach statute protects a short list of identifiers: a first name or initial and last name combined with a Social Security number, driver's license or Idaho identification card number, or a financial account or card number with the code needed to use it. Medical information is not on the list.⁴⁶ An Idaho fitness app that leaks users' heart rate data with their names may therefore owe no notice under Idaho law and none under HIPAA, though the FTC rule may apply. The Idaho statute is covered in module 69, lesson 10.

Is this organization covered, a business associate, or neither?

Put the pieces together and every organization can be sorted with a handful of questions. The chart below is a simplification for training; real cases sometimes need a closer reading of the definitions, and organizations with several roles (a health system that also runs an employee health plan, or a clearinghouse that is also a business associate) must run the questions once for each role.

Worked examples

The examples below are composites built to show how the definitions apply. Names of real organizations appear only where a cited public record describes them. Each answer gives the reasoning, because the reasoning, not the label, is what a compliance officer, an auditor or a reporter will need.

A rural Idaho clinic

A three-provider family practice in a small Idaho town sees patients with Blue Cross, Medicare, Idaho Medicaid and cash. Its practice management system checks eligibility electronically each morning and sends claims through a clearinghouse. Answer: covered entity (health care provider). The eligibility checks and claims are standard transactions sent electronically, directly and through the clearinghouse. Coverage applies to every patient, including the cash patients, and to paper intake forms, the appointment book and phone messages. The clearinghouse is a covered entity in its own right and a business associate of the clinic. The clinic's EHR vendor, its IT support company, its cloud backup service and its shredding company are business associates. The local hospital that receives referrals for treatment is not a business associate; it is another covered entity receiving PHI for treatment. Lesson 9 walks this clinic through its compliance program.

An independent medical billing company

A Boise billing company codes and submits claims for 40 physician practices and works denials with payers. It receives the practices' superbills and notes through a web portal and converts them into standard claim transactions. Answer: business associate of each practice, and very likely a health care clearinghouse too. Billing on behalf of a covered entity is a listed business associate function, and converting nonstandard data into standard transactions for another entity is the clearinghouse definition, which names billing services. As a clearinghouse acting as a business associate, it follows the Privacy Rule provisions in 45 CFR 164.500(b)(1) and its contracts, and the Security Rule in full.²⁰ Its own vendors (its hosting provider, its offshore coding subcontractor if any) are subcontractors. The Comstar case above, involving an ambulance billing company that served more than 70 covered entities, shows the scale of exposure.³⁴

A cloud backup provider

A clinic's IT company sets up nightly encrypted backups of the EHR server to a commercial cloud storage service. The clinic holds the encryption key; the storage company cannot read the files. Answer: business associate (of the IT company as a subcontractor, or of the clinic if the clinic contracts directly). OCR's cloud guidance is explicit that a cloud service provider that stores ePHI is a business associate even when it stores only encrypted data and lacks the key.³⁷ The encryption still matters a great deal: it reduces the risk, it can make a lost or stolen copy "secured" PHI under the breach rule, and it limits what the storage company must do in practice. But it does not change the legal status, and the clinic needs a business associate agreement in the chain.

A document shredding company

A mobile shredding truck comes monthly to collect locked bins of paper from a dental office and shreds them on site. Answer: business associate, in most arrangements. The company receives and maintains PHI (the paper in its bins and truck) on behalf of the covered entity while performing a service for it. The Omnibus preamble's reasoning on storage applies: an entity that maintains PHI on a covered entity's behalf is a business associate even if it does not read it.⁸ HHS's breach guidance also says paper must be shredded or destroyed so it cannot be read or reconstructed, and that redaction is not destruction, so the contract should state the destruction method.⁴⁷ A janitor who empties ordinary trash cans, by contrast, has only incidental contact and is not a business associate if reasonable safeguards keep PHI out of the trash.²⁷

An IT managed service provider

A two-person managed service provider (MSP) in Idaho Falls supports 25 small businesses, three of which are a chiropractor, a counseling practice and a pharmacy. It has remote administrative access to their networks and servers. Answer: business associate of the three health care clients. An IT provider with routine access to systems containing ePHI creates, receives, maintains or transmits PHI on the covered entity's behalf, and HHS's guidance names IT vendors among typical business associates.²⁷ Being a business associate makes the MSP directly liable for the Security Rule: its own risk analysis, access controls, security awareness training, incident procedures and documentation.²⁹ Its remote monitoring and management platform vendor and its backup vendor are subcontractors. OCR's January 2025 settlement with Virtual Private Network Solutions, a Virginia business associate that provides data hosting and cloud services to covered entities, announced as OCR's ninth ransomware enforcement action, shows OCR is willing to bring cases against technology vendors directly.⁴⁸ The MSP's other 22 clients are not affected by HIPAA, but if the MSP runs one shared management platform for all of them, the HIPAA safeguards must cover that platform.

A fitness app

A Meridian startup sells a running and heart rate app directly to consumers through the app stores. Separately, a regional health plan wants to license a version for its members that would pull in their claims data and reward step goals. Answer: not covered for the consumer app; business associate for the health plan version. This is the last scenario in OCR's 2016 app guidance almost exactly: the developer is a business associate for the plan-offered app and not for the direct-to-consumer one, and it must keep the two data sets separate.⁴³ The consumer app is subject to the FTC Health Breach Notification Rule and the FTC Act.⁴⁴

A school nurse

A school district nurse keeps immunization records, medication logs and notes on students' asthma plans. The district bills Idaho Medicaid electronically for some special education health services. Answer: the records are FERPA education records, not PHI; the district is a covered entity only for its electronic billing transactions. The 2019 joint guidance addresses this case directly.²⁵ The district must follow the HIPAA transaction standards when it bills, and FERPA, not the Privacy Rule, governs the records and requires parental consent (unless a FERPA exception applies) before disclosing billing information to Medicaid. If a hospital stationed its own nurse practitioner in the school to run a clinic for the hospital, not for the district, that nurse's records would be the hospital's PHI.

A state Medicaid agency

The Idaho Department of Health and Welfare's Division of Medicaid pays for care for Idaho Medicaid members and contracts with companies that process claims, run managed care programs and coordinate services. Answer: the Medicaid program is a health plan and therefore a covered entity; its contractors that handle member PHI are business associates. Medicaid is named in the health plan definition.¹² Because the Department also runs programs that are not health plans or providers (child support, food assistance and licensing, for example), it is the kind of large agency for which hybrid entity designation is designed; the Department's public privacy page describes its federally required notice of privacy practices and names a privacy officer, but does not state publicly whether it has designated itself a hybrid entity.⁴⁹ Idaho rules for the Department's records, at IDAPA 16.05.01, add state requirements; one section notes that confidentiality of health information is "defined in part by" HIPAA and sets a 28-day timeline for the Privacy Officer to recommend a resolution of a written complaint.⁵⁰ The 2023 incident in which an unauthorized person accessed a Medicaid provider's payment account in the claims system run by a contractor, exposing data on 2,501 members, is a reminder that the plan's business associates are part of its risk.⁵¹ The business associate definition also has a specific exclusion for a government agency determining eligibility for or enrollment in a government health plan, to the extent authorized by law, so the Social Security Administration sharing disability determinations with Medicaid does not create a business associate relationship.¹² For how Idaho Medicaid works, including managed care and the 2027 work requirements, see the Idaho Medicaid module.

Medicaid also intersects with 42 CFR Part 2. On September 29, 2026, OCR issued FAQs on when state Medicaid agencies may use Part 2 substance use disorder records to verify exclusions from the Medicaid community engagement (work) requirement.⁵² Lesson 2 explains Part 2.

A pharmacy benefit manager

A national pharmacy benefit manager (PBM) administers the prescription drug benefit for an Idaho employer's group health plan: it processes pharmacy claims, maintains the formulary, runs prior authorization and pays network pharmacies. It also owns a mail-order pharmacy. Answer: business associate of the group health plan for its benefit management functions, and a covered health care provider for its mail-order pharmacy. HHS's business associate guidance names pharmacy benefit managers among typical business associates.²⁷ A mail-order pharmacy dispenses prescription drugs and bills plans electronically, which makes it a covered provider. Many PBMs also perform clearinghouse-like conversions. This is a good example of one corporate family holding several HIPAA roles at once, each with its own rules: the plan's contract governs the PBM's use of member data, while the pharmacy's own Notice of Privacy Practices governs its dispensing records.

Who enforces HIPAA

HHS Office for Civil Rights

OCR enforces the Privacy, Security and Breach Notification Rules against covered entities and business associates. It opens investigations from complaints, breach reports, media coverage and referrals, and resolves most cases with technical assistance or voluntary corrective action. Serious cases end in a resolution agreement with a payment and a corrective action plan, or in a civil money penalty. In calendar year 2024, OCR received 30,256 new complaints, resolved 28,228, initiated 730 compliance reviews (665 of them from breach reports) and closed 22 cases with resolution agreements or civil money penalties totaling $9,944,612; it also reported that it "did not initiate any audits in 2024 due to a lack of financial resources."⁵³ Anyone may file a complaint through the OCR Complaint Portal.⁵⁴ Since February 16, 2026, OCR also takes complaints under 42 CFR Part 2, after HHS delegated Part 2 enforcement to the OCR Director in August 2025.⁵⁵

The current penalty amounts, which HHS left at their 2025 levels after cancelling the 2026 inflation adjustment on October 21, 2026, range from $145 to $73,011 per violation for the lowest tier and up to $2,190,294 for the highest tier and as a calendar-year cap for identical violations, before applying HHS's 2019 notice of enforcement discretion that lowered the annual caps for the lower tiers.⁵⁶⁵⁷ Lesson 8 covers the tiers, the cure period, the largest cases and how OCR calculates amounts.

State attorneys general

HITECH section 13410(e), codified at 42 U.S.C. 1320d-5(d), lets a state attorney general sue in federal district court on behalf of state residents to stop HIPAA violations or obtain damages of up to $100 per violation, capped at $25,000 for all violations of an identical requirement in a calendar year, plus costs and attorney fees. The state must give HHS written notice first, and HHS may intervene.⁵⁸ States usually pair HIPAA claims with their own consumer protection and breach laws, as the 16 states did against Medical Informatics Engineering in 2018 and 2019.³² Research for this lesson found no HIPAA lawsuit filed by the Idaho Attorney General, and Idaho was not among the 16 states in that case. The Idaho Attorney General's office does post the security breach notices it receives under Idaho Code 28-51, which include health care entities such as Minidoka Memorial Hospital in 2026.⁵⁹

The Justice Department: criminal cases

42 U.S.C. 1320d-6 makes it a federal crime to knowingly obtain or disclose individually identifiable health information in violation of HIPAA. Penalties are up to $50,000 and one year in prison; up to $100,000 and five years if done under false pretenses; and up to $250,000 and ten years if done with intent to sell, transfer or use the information for commercial advantage, personal gain or malicious harm. HITECH added a sentence making clear that a person, "including an employee or other individual," violates the law by obtaining or disclosing information maintained by a covered entity without authorization.⁶ The Justice Department prosecutes; OCR refers cases. A widely cited early case: on April 27, 2010, a former UCLA Health System researcher was sentenced to four months in federal prison after pleading guilty to four misdemeanor counts of accessing patient records without authorization; federal prosecutors described him as the first person in the nation to be convicted and incarcerated for misdemeanor HIPAA offenses.⁶⁰

CMS and other enforcers

The transactions, code sets, identifier and operating rule standards in Part 162 are enforced by the CMS National Standards Group through compliance reviews and complaints.¹¹ There is no private right of action under HIPAA: a patient cannot sue a clinic in federal court for a HIPAA violation as such, though state courts sometimes look to HIPAA as evidence of the standard of care in negligence or privacy claims under state law. Licensing boards may discipline clinicians for confidentiality breaches under state practice acts.

The Idaho picture

Idaho has no state law that replaces HIPAA for health records, so for most Idaho health organizations the federal rule is the main privacy and security law, with Idaho's breach notice statute (Idaho Code 28-51-104 to 28-51-107) and professional licensing rules alongside it. The covered entities are easy to name: every hospital from Kootenai Health in Coeur d'Alene to Portneuf in Pocatello, the critical access hospitals and rural health clinics, community health centers, the seven public health districts where they bill for clinical services, private practices, dental offices, pharmacies, ambulance services, Blue Cross of Idaho and the other insurers, employer group health plans, and Idaho Medicaid. Southwest District Health in Caldwell, for example, publishes a Notice of Privacy Practices effective July 1, 2024, stating it is required to abide by the terms of its notice.⁶¹

Recent Idaho incidents show every category in this lesson:

• A hospital (covered provider). Kootenai Health identified a 2024 intrusion on March 2, 2024, after data was taken around February 22; it reported 464,088 people affected in its filing with the Maine attorney general, and the 3AM ransomware group claimed the attack, according to SecurityWeek.⁶² Weiser Memorial Hospital identified unusual network activity on September 4, 2024 and later reported 59,990 people affected, with data that may include Medicare and Medicaid numbers.⁶³ Minidoka Memorial Hospital in Rupert suffered a cyberattack on Easter morning 2026, reported to OCR as affecting up to 22,000 patients, and filed notices with the Idaho Attorney General in August and September 2026.⁶⁴⁵⁹
• A public health district (covered provider, insider). Eastern Idaho Public Health reported that a former employee accessed patient clinic notes without authorization, affecting 759 people.⁶⁵
• A business associate. Boundary Regional Community Health Center, doing business as Kaniksu Community Health in the Bonners Ferry and Sandpoint area, reported 88,000 people affected by a hacking incident at its business associate Aesto Health, according to HIPAA Journal's July 2026 report.⁶⁶
• A health plan and its contractor. The 2023 Idaho Medicaid incident described above involved a provider payment account in a claims system run by a contractor.⁵¹

HIPAA Journal counted four large breaches affecting 154,525 Idahoans in 2025.⁶⁷ Several of the incidents above appear on both the HHS breach portal (because of HIPAA) and the Idaho Attorney General's list (because the data included identifiers covered by the Idaho statute), which is a practical illustration of two laws applying to one event.⁵⁹

Common mistakes, drawn from OCR cases

1. "We don't need a business associate agreement with that vendor." North Memorial Health Care of Minnesota paid $1.55 million in March 2016 after an unencrypted laptop holding data on nearly 10,000 people was stolen from an employee of its billing and revenue cycle vendor, Accretive Health. North Memorial had given the vendor access to PHI on more than 250,000 people for months before signing a business associate agreement, and had not done an enterprise-wide risk analysis.⁶⁸ In April 2016, Raleigh Orthopaedic Clinic agreed to pay $750,000 after handing X-ray films to a vendor that converted them to digital images and harvested the silver, with no business associate agreement.⁶⁹ Lesson: any vendor that touches PHI, even briefly and even for a side purpose, needs a written agreement before it gets the data.
2. "The cloud vendor can't see our data, so it isn't a business associate." OCR's cloud guidance rejects this directly.³⁷ VPN Solutions, a Virginia company providing data hosting and cloud services to covered entities, paid $90,000 in January 2025 after a ransomware attack it reported on behalf of 12 covered entities; OCR found it had not done a compliant risk analysis.⁴⁸
3. "We're only the vendor; HIPAA compliance is the clinic's job." Since 2013, the Security Rule applies to business associates directly. Health Fitness Corporation, Comstar and Consociate Health each paid OCR because they, as business associates, had not done an accurate and thorough risk analysis.³³³⁴¹⁶
4. "Our employee health plan is HR's business, not HIPAA's." Group health plans are covered entities, as the Spencer Gifts and Star Group settlements in 2026 show.¹⁵¹⁶ HR staff who administer the plan must keep plan PHI out of employment decisions.
5. "We removed the names, so it's de-identified." Removing names leaves at least 17 other safe harbor identifiers. Dates of service, ZIP codes, medical record numbers and photos are the usual leftovers.
6. "HIPAA means we can't tell you anything." The opposite mistake. OCR's Right of Access Initiative, which reached 56 enforcement actions with the Shen Smiles settlement announced October 8, 2026, exists because covered entities used HIPAA as a reason to delay giving patients their own records (see lesson 2).
7. Calling a non-covered company "HIPAA compliant." A consumer app or gym that advertises HIPAA compliance is not bound by HIPAA unless it is a covered entity or business associate; the claim may mislead consumers and can draw FTC attention under the FTC Act.

Questions people ask

Our practice is cash only and never bills insurance. Are we covered?

Not unless you, or someone on your behalf, sends a standard transaction electronically. Check carefully: an electronic eligibility check, a claim filed for a patient as a courtesy, or a lab that bills a plan in your name can count. Many cash practices follow HIPAA anyway because state law, contracts or patient expectations require similar protections, and because one change in billing would make them covered overnight.

Do we need a business associate agreement with every vendor?

No. You need one with each vendor that creates, receives, maintains or transmits PHI on your behalf. You do not need one with conduits, banks processing payments, janitors with incidental access, other providers receiving PHI for treatment, or software vendors with no access to your PHI.²⁷²⁶ When in doubt, ask whether the vendor could see, store or move your patients' information as part of its job. If yes, get the agreement.

Is our IT company a business associate even if it only fixes computers occasionally?

Usually yes, if its technicians have access to systems that hold ePHI as part of the service. HHS treats incidental access (an electrician in the server room) differently from routine access (an administrator with remote login). A technician who repairs a laptop containing patient files is handling ePHI on your behalf.

Can my employer see my medical records because it pays for the health plan?

Not freely. The employer as plan sponsor may receive plan PHI only for plan administration after amending the plan documents, and may not use it for employment decisions.²⁸ The employer may ask you directly for a doctor's note; the Privacy Rule controls whether your provider may give the employer information, which requires your authorization unless another law requires the disclosure.⁴²

My parent died last year. Are their records still protected?

Yes, for 50 years after death. The personal representative of the estate can exercise your parent's rights, including the right of access. The Privacy Rule also permits covered entities to share relevant information with family members who were involved in the person's care, unless the person had said otherwise.

Can a hospital sell de-identified data?

HIPAA does not restrict the use or disclosure of properly de-identified data, including sale.⁴⁰ The sale of PHI itself requires the patient's authorization. Whether a given data set is truly de-identified is the hard part, and state laws and contracts can add limits.

If our clinic uses an AI scribe or chatbot vendor, is that vendor a business associate?

If it creates, receives, maintains or transmits PHI on the clinic's behalf, yes, under the same definition that applies to any vendor. OCR has not issued guidance specific to AI vendors; the cloud computing guidance and the business associate definition apply. Lesson 6 covers AI vendors in detail.

We are a free clinic run by volunteers. Are we covered?

If you never bill anyone electronically, probably not as a provider. But if the clinic bills Medicaid or a plan for any service, or a partner bills on its behalf, it is covered. Volunteers who work under a covered entity's direct control are part of its workforce, not business associates.¹²

Hard questions

Should HIPAA coverage still depend on electronic billing?

The case for change: The 1996 trigger made sense when the goal was billing standardization, but today it produces odd results. A cash-only mental health app that employs licensed therapists can be outside HIPAA while a small-town chiropractor is inside it, and patients cannot tell the difference. Advocates for change argue coverage should attach to anyone who provides health care or holds clinical information, regardless of billing. The case against: HHS's statutory authority comes from the Administrative Simplification provisions, so changing the trigger requires Congress. Expanding HIPAA to all health data holders would also impose the full Privacy and Security Rules on many small businesses never designed for them, and other laws (the FTC Health Breach Notification Rule and state health data laws) are being built to fill the consumer gap. What the evidence shows: The gap is real and growing as care moves to cash-pay digital services, and the FTC expanded its rule in 2024 specifically to cover health apps.⁴⁴

Should business associates carry the same obligations as covered entities?

The case for more: Vendors were involved in breaches affecting 85 percent of the people in 2024's large breach reports, and the biggest single breach in history hit a company that sits between providers and payers.¹⁹ Some argue OCR should be able to enforce every term of a business associate agreement, and that large vendors should face audits and transparency obligations at least as heavy as hospitals'. The case for the current line: Business associates do not have a direct relationship with patients, so duties like Notices of Privacy Practices and fee limits make more sense on the covered entity. Covered entities can and do write stricter contracts. The proposed Security Rule update would require business associates to verify their technical safeguards in writing at least once every 12 months, which addresses some concerns without changing the structure.⁹ What the evidence shows: OCR has used its direct authority mostly for risk analysis failures, with relatively modest payments (for example $75,000 to $227,816 in the 2025 and 2026 vendor cases above). Whether larger vendor penalties would change behavior is untested; the largest vendor breach, Change Healthcare, had no OCR resolution agreement or penalty announced that research for this lesson could find as of October 28, 2026.

Is the safe harbor de-identification method still good enough?

The case for concern: Latanya Sweeney's widely cited 2000 study found that 87 percent of the U.S. population (based on 1990 Census data) was likely uniquely identifiable by five-digit ZIP code, gender and date of birth.⁷⁰ Since then, commercial data brokers, social media and location data have made linking easier, and critics of safe harbor argue that a fixed list of 18 identifiers written in 2000 cannot keep up. The case for it: Safe harbor removes exactly those quasi-identifiers that Sweeney showed were dangerous (full dates and five-digit ZIP codes), and the "no actual knowledge" condition and the expert determination alternative exist for harder cases. HHS's 2012 guidance gives detailed instructions, and a predictable checklist lets small organizations share data for public health and research without hiring statisticians. What the evidence shows: Safe harbor protects best against the specific linkages it was designed for; risk rises with rich free-text fields, rare conditions and small populations, which is why HHS guidance stresses the actual knowledge test and why expert determination is common for large data sales.⁴⁰

Does OCR have enough resources to police who is covered?

The case that it does not: OCR told Congress it did not start any audits in 2024 because of a lack of financial resources, while receiving more than 30,000 complaints and resolving only 22 cases with payments or penalties that year.⁵³ Thousands of small business associates may never hear from OCR unless they have a breach. The case that enforcement works anyway: OCR resolves most complaints through technical assistance and corrective action, has targeted risk analysis failures through its Risk Analysis Initiative, and state attorneys general can add enforcement. What the evidence shows: Enforcement is driven largely by breach reports and complaints, so organizations that never report a breach are rarely examined. HHS's 2026 regulatory agenda includes a proposal to distribute a share of penalties to harmed individuals, but it is only a projected rulemaking.⁹

Where to go next

• CMS Covered Entity Charts: Free decision charts from CMS that ask, step by step, whether an organization is a covered provider, health plan or clearinghouse. Useful for practice managers and new compliance staff; print it and work through each role your organization plays.
• HHS: Covered Entities and Business Associates: Free HHS overview with links to the CMS question and answer decision tool and the definitions. A good first stop for anyone unsure whether HIPAA applies.
• OCR: Direct Liability of Business Associates: Free one-page OCR fact sheet listing the ten things OCR can enforce directly against a business associate. Essential for IT providers, billing companies and other vendors serving health care.
• HHS Sample Business Associate Agreement Provisions: Free sample contract language published with the 2013 Omnibus Rule. Use it to check that a vendor's agreement covers the required terms; using it is optional and it does not make anyone compliant on its own. Lesson 6 explains each term.
• OCR De-identification Guidance: Free, detailed HHS guidance on expert determination and safe harbor, with examples, the restricted ZIP code list and FAQs. For data, research and analytics staff.
• FTC Mobile Health Apps Interactive Tool: Free FTC tool, built with OCR, ONC and FDA, that asks app developers a series of questions and points to HIPAA, the FTC Act, the Health Breach Notification Rule and FDA rules as they apply.
• HHS OCR Breach Portal: Free public list of breaches affecting 500 or more people, searchable by state and entity type (provider, plan, clearinghouse, business associate). For reporters, advocates and anyone checking a vendor's history.

Still being checked (9 items)

These points could not be fully confirmed against a primary source when this lesson was written and fact checked in October 2026. The text above states each one as uncertain.

• The Idaho Department of Health and Welfare's privacy page describes its notice of privacy practices and Privacy Officer but does not say publicly whether the Department has designated itself a hybrid entity; the lesson does not assume it has.
• No HIPAA lawsuit by the Idaho Attorney General was found in searches of the Attorney General's site and news coverage; this is an absence of evidence, not a confirmed fact.
• The Massachusetts and Connecticut settlements with Comstar ($415,000 and $100,000, January 28, 2026) are taken from a law firm summary, not the states' own releases.
• Figures for the Kootenai Health, Weiser Memorial, Eastern Idaho Public Health, Minidoka Memorial and Kaniksu Community Health incidents and the 2025 Idaho total come from trade press (SecurityWeek, HIPAA Journal), not from HHS records read directly.
• The description of Catholic Health Care Services (2016) as OCR's first enforcement action against a business associate is a law firm characterization.
• The HHS release on Virtual Private Network Solutions could not be loaded directly; its details come from a verbatim reprint.
• HHS's de-identification guidance is widely reported as released November 26, 2012; the HHS page metadata shows September 7, 2012.
• Treating shredding companies, electronic fax services and IT managed service providers as business associates applies the 160.103 definition, the Omnibus preamble and OCR guidance; OCR has not issued a ruling naming each of these vendor types.
• No OCR resolution agreement or civil money penalty involving Change Healthcare was found on OCR's resolution agreements list or newsroom as of Oct. 28, 2026; this is an absence of evidence, not a confirmed fact.

Last verified October 28, 2026. General education, not legal, compliance or medical advice; rule versions and dates are stated in the text, and the sources used are listed in the Notes and Sources below. Check the regulator's current text before relying on any point.

Notes

1. U.S. Department of Health and Human Services (HHS), The HIPAA Privacy Rule (laws and regulations page): HIPAA, Pub. L. 104-191, enacted August 21, 1996; Administrative Simplification, sections 261 to 264; Privacy Rule proposed November 3, 1999, final December 28, 2000 (65 FR 82462), modified August 14, 2002 (67 FR 53182); compliance April 14, 2003, small health plans April 14, 2004; email alone does not make a provider covered (read Oct. 28, 2026). Read it online. ↩
2. HHS, Health Insurance Reform: Standards for Electronic Transactions, final rule, 65 FR 50312, August 17, 2000 (read Oct. 28, 2026). Read it online. ↩
3. HHS, Health Insurance Reform: Security Standards, final rule, 68 FR 8334, February 20, 2003 (read Oct. 28, 2026). Read it online. ↩
4. 45 CFR 164.318, Compliance dates for the initial implementation of the security standards (April 20, 2005; April 20, 2006 for small health plans), Cornell LII text (read Oct. 28, 2026). Read it online. ↩
5. HHS, HIPAA Administrative Simplification: Enforcement, final rule, 71 FR 8390 to 8433, February 16, 2006 (Justia copy of the Federal Register document 06-1376) (read Oct. 28, 2026). Read it online. ↩
6. 42 U.S.C. 1320d-6, Wrongful disclosure of individually identifiable health information (criminal penalties), with the sentence on employees and other individuals inserted by Pub. L. 111-5, div. A, title XIII (the HITECH Act), section 13409, February 17, 2009, Cornell LII text and notes (read Oct. 28, 2026). Read it online. ↩
7. HHS, Breach Notification for Unsecured Protected Health Information, interim final rule, 74 FR 42740, August 24, 2009, effective September 23, 2009 (read Oct. 28, 2026). Read it online. ↩
8. HHS, Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the HITECH Act and GINA; Other Modifications to the HIPAA Rules (Omnibus Rule), final rule, 78 FR 5566, January 25, 2013, effective March 26, 2013, compliance September 23, 2013; preamble discussion of business associates, subcontractors, entities that maintain PHI and the conduit exception (read Oct. 28, 2026). Read it online. ↩
9. HHS, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, proposed rule, 90 FR 898, January 6, 2025 (RIN 0945-AA22), and the HHS NPRM fact sheet (December 27, 2024); Unified Agenda entry (publication ID 202510) listing the rule as a long-term action with final action projected 07/2027. The agenda's projected rulemaking on distributing civil money penalties to harmed individuals (RIN 0945-AA04) is reported by Davis Wright Tremaine, July 2026 (read Oct. 28, 2026). Read it online. ↩
10. HHS, Administrative Simplification; Adoption of Standards for Health Care Claims Attachments Transactions and Electronic Signatures, final rule, 91 FR 14350, March 24, 2026 (CMS-0053-F), effective May 26, 2026, compliance May 26, 2028; amends the 160.103 definition of transaction (read Oct. 28, 2026). Read it online. ↩
11. Centers for Medicare and Medicaid Services (CMS), Administrative Simplification: the National Standards Group enforces transaction, code set, identifier and operating rule standards through compliance reviews and complaints (read Oct. 28, 2026). Read it online. ↩
12. 45 CFR 160.103, Definitions (covered entity, health plan, group health plan, health care provider, health care clearinghouse, business associate, subcontractor, health information, individually identifiable health information, protected health information, electronic protected health information, electronic media, organized health care arrangement, transaction, workforce, small health plan), Cornell Legal Information Institute text, as amended through 91 FR 14404 (March 24, 2026) (read Oct. 28, 2026). Read it online. ↩
13. CMS, Covered Entity Charts (decision charts for providers, health plans and clearinghouses, with the list of standard transactions; undated) (read Oct. 28, 2026). Read it online. ↩
14. HHS, Covered Entities and Business Associates, first published November 23, 2015, content last reviewed August 21, 2024 (read Oct. 28, 2026). Read it online. ↩
15. HHS press release, OCR settles ransomware investigation with Spencer Gifts LLC Flexible Benefits and Welfare Benefit Plans ($450,000; about 10,023 people), June 18, 2026 (read Oct. 28, 2026). Read it online. ↩
16. HHS press release, OCR settles four ransomware investigations (Regional Women's Health Group, Assured Imaging, Consociate Health $225,000 and about 136,539 people, Star Group L.P. Health Benefits Plan $245,000), April 23, 2026 (read Oct. 28, 2026). Read it online. ↩
17. 42 U.S.C. 300gg-91(c)(1) (Public Health Service Act section 2791(c)(1)), excepted benefits, Cornell LII text (read Oct. 28, 2026). Read it online. ↩
18. OCR, Change Healthcare Cybersecurity Incident Frequently Asked Questions, last reviewed August 13, 2025 (about 192.7 million individuals as of July 31, 2025; initial breach report filed July 19, 2024 with a placeholder of 500) (read Oct. 28, 2026). Read it online. ↩
19. HHS Office for Civil Rights (OCR), Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2024: 663 reports of 500 or more affecting about 242,908,056 people; business associate involvement in 106 reports (16 percent) affecting 206,921,071 (85 percent); largest breach about 192,000,000 (ransomware at a health care clearinghouse) (read Oct. 28, 2026). Read it online. ↩
20. 45 CFR 164.500(b), Applicability of the Privacy Rule to health care clearinghouses, Cornell LII text (read Oct. 28, 2026). Read it online. ↩
21. OCR, Resolution Agreements and Civil Money Penalties list (including Northeast Surgical Group, $10,000, January 15, 2025, and MMG Fusion, $10,000, March 5, 2026, each with a corrective action plan) (read Oct. 28, 2026). Read it online. ↩
22. 45 CFR 164.103, Definitions (hybrid entity, health care component), Cornell LII text (read Oct. 28, 2026). Read it online. ↩
23. 45 CFR 164.105, Organizational requirements (hybrid entities, affiliated covered entities, documentation and six-year retention), Cornell LII text (read Oct. 28, 2026). Read it online. ↩
24. Idaho State University, Office of General Counsel, HIPAA page ("Idaho State University is designated as a Hybrid Entity") (read Oct. 28, 2026). Read it online. ↩
25. U.S. Department of Education and HHS, Joint Guidance on the Application of the Family Educational Rights and Privacy Act (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to Student Health Records, November 2008, updated December 2019 (read Oct. 28, 2026). Read it online. ↩
26. HHS, Business Associates frequently asked questions (OHCAs, researchers, reinsurers, software vendors, couriers, relay services) (read Oct. 28, 2026). Read it online. ↩
27. OCR, Business Associates guidance, published January 7, 2009, content last reviewed October 21, 2026 (examples of business associates; incidental access; conduits; financial institutions) (read Oct. 28, 2026). Read it online. ↩
28. 45 CFR 164.504, Uses and disclosures: organizational requirements (business associate contracts at 164.504(e); group health plan and plan sponsor requirements at 164.504(f)), Cornell LII text (read Oct. 28, 2026). Read it online. ↩
29. OCR, Direct Liability of Business Associates fact sheet, published May 24, 2019, content last reviewed July 16, 2021 (read Oct. 28, 2026). Read it online. ↩
30. Hunton Andrews Kurth, OCR Enters into First Enforcement Action Against Business Associate, Privacy and Information Security Law Blog, July 6, 2016 (Catholic Health Care Services of the Archdiocese of Philadelphia, $650,000, announced June 30, 2016) (read Oct. 28, 2026). Read it online. ↩
31. HHS, Indiana Medical Records Service Pays $100,000 to Settle HIPAA Breach (Medical Informatics Engineering), May 23, 2019 (read Oct. 28, 2026). Read it online. ↩
32. Tennessee Attorney General, Tennessee, 15 Other States Reach $900,000 Data Breach Settlement with Medical Informatics Engineering, May 29, 2019 (lawsuit filed December 2018; more than 3.9 million people; HIPAA and state law claims) (read Oct. 28, 2026). Read it online. ↩
33. HHS press release, OCR settles HIPAA Security Rule investigation with Health Fitness Corporation ($227,816; fifth Risk Analysis Initiative action), March 21, 2025 (read Oct. 28, 2026). Read it online. ↩
34. HHS press release, OCR settles HIPAA ransomware investigation with Comstar, LLC ($75,000; about 585,621 people; business associate of more than 70 covered entities), May 30, 2025 (read Oct. 28, 2026). Read it online. ↩
35. Data Protection Report (Norton Rose Fulbright), HHS and State AGs Fine Ambulance Firm Over $500,000, March 2026 (Massachusetts $415,000 and Connecticut $100,000 settlements, January 28, 2026) (read Oct. 28, 2026). Read it online. ↩
36. OCR FAQ, Can a CSP be considered to be a "conduit" like the postal service, and, therefore, not a business associate that must comply with the HIPAA Rules?, published October 6, 2016, last reviewed September 22, 2026 (read Oct. 28, 2026). Read it online. ↩
37. OCR, Guidance on HIPAA and Cloud Computing, published October 6, 2016, last reviewed December 23, 2022 (read Oct. 28, 2026). Read it online. ↩
38. OCR, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (first issued December 2022, revised March 2024), with HHS's note on American Hospital Association v. Becerra, No. 4:23-cv-1110 (N.D. Tex. June 20, 2024); appeal dismissal in August 2024 reported by Proskauer (read Oct. 28, 2026). Read it online. ↩
39. HIPAA Journal, Largest Healthcare Data Breaches of 2025, June 5, 2026 (Blue Shield of California, 4,700,000, tracking tools) (read Oct. 28, 2026). Read it online. ↩
40. OCR, Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the HIPAA Privacy Rule, released November 2012 (page metadata shows publication September 7, 2012 and modification March 20, 2026); includes the 17 restricted three-digit ZIP codes based on 2000 Census data (read Oct. 28, 2026). Read it online. ↩
41. 45 CFR 164.514, Other requirements relating to uses and disclosures of PHI (de-identification at (a) to (c); limited data sets at (e)), as amended by the 2013 Omnibus Rule, Cornell LII text (read Oct. 28, 2026). Read it online. ↩
42. OCR, Employers and Health Information in the Workplace, originally published November 19, 2008, content last reviewed November 2, 2020 (read Oct. 28, 2026). Read it online. ↩
43. OCR, Health App Use Scenarios and HIPAA, February 2016 (read Oct. 28, 2026). Read it online. ↩
44. Federal Trade Commission, Health Breach Notification Rule, final rule, 89 FR 47028, May 30, 2024, effective July 29, 2024 (16 CFR Part 318) (read Oct. 28, 2026). Read it online. ↩
45. TechTarget HealthTech Security, FTC, HHS Update Mobile Health App Data Privacy Compliance Tool, December 8, 2022 (the FTC's Mobile Health Apps Interactive Tool, updated with OCR, ONC and FDA) (read Oct. 28, 2026). Read it online. ↩
46. Idaho Code 28-51-104, Definitions (personal information; breach of the security of the system), Idaho Legislature (read Oct. 28, 2026). Read it online. ↩
47. OCR, Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals (destruction of paper and electronic media; redaction excluded) (read Oct. 28, 2026). Read it online. ↩
48. HHS press release, HHS Office for Civil Rights Settles 9th Ransomware Investigation with Virtual Private Network Solutions, January 2025 ($90,000; Virginia business associate providing data hosting and cloud services; breach report on behalf of 12 covered entities), as reprinted by DataBreaches.net, January 8, 2025 (read Oct. 28, 2026). Read it online. ↩
49. Idaho Department of Health and Welfare, Privacy and Confidentiality page, last updated March 17, 2026 (notice of privacy practices; Privacy Officer contact) (read Oct. 28, 2026). Read it online. ↩
50. IDAPA 16.05.01.007, District court appeals, complaints and requests for reconsideration (Use and Disclosure of Department Records), effective March 17, 2022, Justia copy (read Oct. 28, 2026). Read it online. ↩
51. KTVB, Data breach at Idaho Department of Health and Welfare, June 2023 (April 18, 2023 access to a Medicaid provider payment account; 2,501 members) (read Oct. 28, 2026). Read it online. ↩
52. HHS press release, HHS OCR Clarifies Privacy Rules for State Medicaid Programs (42 CFR Part 2 FAQs on Medicaid community engagement verification), September 29, 2026 (read Oct. 28, 2026). Read it online. ↩
53. OCR, Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance for Calendar Year 2024 (30,256 new complaints; 28,228 resolved; 730 compliance reviews; 22 resolutions totaling $9,944,612; no audits initiated in 2024) (read Oct. 28, 2026). Read it online. ↩
54. OCR, Filing a HIPAA Complaint (OCR Complaint Portal for HIPAA and Part 2 complaints) (read Oct. 28, 2026). Read it online. ↩
55. HHS, 42 CFR Part 2 overview, last reviewed September 29, 2026 (delegation to the OCR Director August 25, 2025; complaints to OCR from February 16, 2026) (read Oct. 28, 2026). Read it online. ↩
56. HHS, Annual Civil Monetary Penalties Inflation Adjustment, final rule, 91 FR 3665, January 28, 2026 (45 CFR 102.3 table; HIPAA tiers under 45 CFR 160.404) (read Oct. 28, 2026). Read it online. ↩
57. HHS notice, FR Doc. 2026-21524, 91 FR 66566, October 21, 2026 (no 2026 adjustment; 2025 levels continue); and Notification of Enforcement Discretion Regarding HIPAA Civil Money Penalties, 84 FR 18151, April 30, 2019 (read Oct. 28, 2026). Read it online. ↩
58. 42 U.S.C. 1320d-5, General penalty for failure to comply (state attorney general actions at subsection (d), added by HITECH section 13410(e)), Cornell LII text (read Oct. 28, 2026). Read it online. ↩
59. Idaho Office of the Attorney General, Security Breaches notice list (Minidoka Memorial Hospital notices dated 8/6/2026 and 9/28/2026) (read Oct. 28, 2026). Read it online. ↩
60. U.S. Attorney's Office, Central District of California, Ex-UCLA Healthcare Employee Sentenced to Federal Prison for Illegally Peeking at Patient Records, April 27, 2010 (Huping Zhou) (read Oct. 28, 2026). Read it online. ↩
61. Southwest District Health (Caldwell, Idaho), Notice of Privacy Practices, effective July 1, 2024 (read Oct. 28, 2026). Read it online. ↩
62. SecurityWeek, 460k Impacted by Kootenai Health Ransomware Attack, August 2024 (464,088 people per Maine attorney general filing; 3AM claim) (read Oct. 28, 2026). Read it online. ↩
63. HIPAA Journal, Weiser Memorial Hospital Data Breach, May 15, 2025 (59,990 people) (read Oct. 28, 2026). Read it online. ↩
64. HIPAA Journal, Minidoka Memorial Hospital Cyberattack, April 22, 2026 (up to 22,000 patients) (read Oct. 28, 2026). Read it online. ↩
65. HIPAA Journal, Eastern Idaho Public Health Discovers Insider Data Breach, January 9, 2025 (759 people); agency press release at eiph.id.gov (read Oct. 28, 2026). Read it online. ↩
66. HIPAA Journal, July 2026 Healthcare Data Breach Report, October 15, 2026 (Boundary Regional Community Health Center, dba Kaniksu Community Health, 88,000, business associate Aesto Health) (read Oct. 28, 2026). Read it online. ↩
67. HIPAA Journal, 2025 Healthcare Data Breach Report, February 13, 2026 (Idaho: 4 large breaches, 154,525 people) (read Oct. 28, 2026). Read it online. ↩
68. Mintz, Pay Attention to Business Associate Agreements, March 22, 2016 (North Memorial Health Care of Minnesota, $1.55 million, announced March 16, 2016) (read Oct. 28, 2026). Read it online. ↩
69. Hunton Andrews Kurth, OCR Settles Two Key HIPAA Privacy Rule Cases Involving X-Rays and Medical Reality TV Show, April 27, 2016 (Raleigh Orthopaedic Clinic, $750,000) (read Oct. 28, 2026). Read it online. ↩
70. Latanya Sweeney, Simple Demographics Often Identify People Uniquely, Carnegie Mellon University, Data Privacy Working Paper 3, 2000 (87 percent, 1990 Census data) (read Oct. 28, 2026). Read it online. ↩
71. OCR, Enforcement Highlights, data as of October 31, 2024 (more than 374,321 complaints since April 2003; 152 cases resolved with settlements or civil money penalties totaling $144,878,972) (read Oct. 28, 2026). Read it online. ↩