HIPAA
Health Insurance Portability and Accountability Act, US federal law that sets privacy and security standards for protected health information.
HIPAA includes the Privacy Rule (who can access PHI), the Security Rule (how to protect electronic PHI), and the Breach Notification Rule. Covered entities (providers, payers, clearinghouses) and their business associates must comply. For integration engineers, HIPAA means encryption in transit (TLS), access controls, audit logging, and BAAs with every vendor that touches PHI. Violations can result in fines up to $1.5 million per violation category per year.
FAQ
- Do integration engines need to be HIPAA compliant?
- Yes. Any system that processes, stores, or transmits PHI must comply with HIPAA Security Rule requirements: encryption, access controls, audit logging, and a Business Associate Agreement with the covered entity.