What HIPAA is, and why it exists
HIPAA — the Health Insurance Portability and Accountability Act of 1996 — is the federal law that sets the rules for how patient health information is protected, used, and shared in the United States. Coders, billers, and every other role that touches patient data work inside HIPAA's rules every single day, whether they're the ones filing the claim or the ones auditing it.
HIPAA was originally about letting people keep their health coverage when they changed jobs (the "portability" part). Its privacy and security rules — the part almost everyone means today when they say "HIPAA" — came later, through regulations that followed the law.
Who HIPAA applies to
HIPAA doesn't apply to everyone who happens to see health information — it applies to specific categories of organizations and the vendors that work for them.
| Category | Examples |
|---|---|
| Covered entity | Doctors, hospitals, clinics, health plans, insurers, healthcare clearinghouses |
| Business associate | Billing companies, coding contractors, EHR vendors, cloud/IT vendors, transcription services — anyone handling PHI on a covered entity's behalf |
If you work as a remote medical coder or biller for a billing company, you're almost certainly a business associate (or an employee of one) — which means you sign a Business Associate Agreement (BAA) and are personally bound by HIPAA's rules.
PHI stays protected as it moves from the patient to a covered entity to any business associate that touches it.
The three rules that make up "HIPAA compliance"
| Rule | What it covers |
|---|---|
| Privacy Rule | Who can see and share Protected Health Information (PHI), and a patient's rights over their own records |
| Security Rule | Administrative, physical, and technical safeguards specifically for electronic PHI (ePHI) |
| Breach Notification Rule | Who must be told, and how fast, when PHI is exposed without authorization |
What counts as PHI
Protected Health Information is any health information that can be tied back to an individual. HIPAA lists 18 identifiers that, combined with health information, make it PHI — the most common ones coders and billers handle:
- Name, address, and dates directly related to an individual (birth date, admission date, date of death)
- Phone, fax, email, and Social Security number
- Medical record numbers and health plan beneficiary numbers
- Account numbers and any unique identifying number, code, or characteristic
- Full-face photos and any other identifying image
Minimum necessary standard: even when you're allowed to access PHI, you should only access, use, or share the minimum amount needed to do your job — not the whole chart because it happened to be open.
Patient rights under the Privacy Rule
- Right of access — get a copy of their own records
- Right to amend — request a correction to inaccurate information
- Accounting of disclosures — a list of who their information was shared with
- Right to request restrictions — ask that certain information not be shared with certain parties
- Confidential communications — request to be contacted in a specific way (e.g., a different phone number)
Safeguards under the Security Rule
| Safeguard type | Examples |
|---|---|
| Administrative | Risk assessments, workforce training, access authorization policies, a designated privacy/security officer |
| Physical | Locked server rooms, workstation placement away from public view, controlled facility access |
| Technical | Unique user logins, automatic logoff, encryption, audit logs |
Common ways HIPAA gets violated in day-to-day coding & billing work
- Discussing a patient's case somewhere it can be overheard, or on social media
- Leaving a chart, screen, or fax open/visible to people who don't need it
- Emailing PHI to a personal, unencrypted email account to "work from home faster"
- Looking up a coworker's, family member's, or celebrity's chart out of curiosity ("snooping")
- Sending a claim or statement to the wrong patient because a record wasn't rechecked
Penalties: why this isn't just paperwork
The Office for Civil Rights (OCR) enforces HIPAA and can issue civil penalties based on the level of culpability, from unaware to willful neglect:
| Culpability tier | Penalty range (per violation) |
|---|---|
| Did not know, and reasonably couldn't have known | Lower tier, still can reach tens of thousands |
| Reasonable cause, not willful neglect | Mid tier |
| Willful neglect, corrected within 30 days | Higher tier |
| Willful neglect, not corrected | Maximum tier, can reach into the millions annually |
Criminal charges are also possible for knowing violations, especially when PHI is sold, transferred, or used for personal gain.
HIPAA vs. HITECH: HITECH (2009) is a separate law that strengthened HIPAA enforcement, introduced the Breach Notification Rule, and pushed the adoption of electronic health records. In practice, people use "HIPAA" to mean the whole privacy/security framework, HITECH included.
Why this matters for your coding or billing career
Every certification exam — CPC, CCA, CBCS, and the rest — tests HIPAA basics, and every employer will require HIPAA training before you touch a real chart. Understanding why the rules exist, not just memorizing definitions, is what actually keeps you and your employer out of trouble once you're on the job.
Want to see how patient data actually flows through today's systems?
Read: Introduction to EMR and EHR →