What is the HIPAA law?

The main rules

• Privacy Rule — governs who may use or disclose protected health information, and for what. Treatment, payment and health-care operations are generally permitted; marketing and most other uses need your written authorisation.
• Security Rule — requires administrative, physical and technical safeguards for electronic records.
• Breach Notification Rule — requires notice to affected individuals, and to the federal government, when unsecured records are exposed.

Who HIPAA actually binds

Covered entities — providers who bill electronically, health plans and clearinghouses — and their business associates. It does not bind your employer as an employer, a school, a life insurer, or a fitness app you signed up for yourself. This is the single most common misunderstanding: a shop asking about your vaccination status is not violating HIPAA, because the shop is not a covered entity.

Your rights under it

You can obtain a copy of your records, usually within 30 days and for no more than a reasonable cost-based fee; ask for corrections; get a list of certain disclosures; and restrict some sharing with a health plan when you paid out of pocket in full.

If it is violated

HIPAA has no private right of action — you cannot sue under HIPAA itself. Complaints go to the Office for Civil Rights at the Department of Health and Human Services, generally within 180 days. Separately, most states allow suits for breach of medical confidentiality or invasion of privacy under state law, and a HIPAA violation is often used as evidence of the standard of care in such a case.