HIPAA Compliance: A Practical Guide to the Privacy, Security, and Breach Notification Rules

HIPAA requires covered entities and their business associates to safeguard protected health information (PHI). HHS OCR enforces the applicable rules; it does not endorse or recognize private Security Rule certifications. Templates and a risk-assessment workbook can support documentation, but organizations must evaluate their own risks and operate the applicable safeguards.

Reviewed by Dor Israel, Founder · Updated October 8, 2026

Related toolkits: HIPAA Compliance Toolkit — Medical Practices ($149) · HIPAA Compliance Toolkit — Dental Practices ($149)

Free: the HIPAA Sanction Policy template (Word) →

What is HIPAA?

HIPAA (the Health Insurance Portability and Accountability Act) is a federal law whose privacy and security regulations live in 45 CFR Part 160 and Part 164, organized into three core rules. The Privacy Rule (Subpart E, 45 CFR 164.500 and following) governs how PHI in any form — paper, electronic, or spoken — may be used and disclosed. The Security Rule (Subpart C) sets administrative, physical, and technical safeguards for electronic PHI (ePHI) and is anchored by a mandatory risk analysis at 45 CFR 164.308(a)(1)(ii)(A). The Breach Notification Rule (Subpart D, 45 CFR 164.400 and following) dictates who must be notified, and when, after an unauthorized disclosure of unsecured PHI.

Who needs it?

HIPAA applies to two groups. Covered entities are health plans, healthcare clearinghouses, and healthcare providers (doctors, dentists, therapists, clinics, pharmacies) that transmit health information electronically in connection with standard transactions. Business associates are vendors that create, receive, maintain, or transmit PHI on a covered entity's behalf — billing companies, IT and cloud providers, EHR vendors, transcription services, and many SaaS tools — and they have been directly liable for Security Rule and many Privacy Rule obligations since the 2013 Omnibus Rule.

Software brings you under HIPAA only when it handles PHI on behalf of a covered entity or business associate, which makes you a business associate yourself; a direct-to-consumer health app that does not act on a covered entity's behalf is generally outside HIPAA and instead falls under the FTC Act and the FTC Health Breach Notification Rule. Written agreements are generally required for applicable business-associate relationships, subject to regulatory exceptions such as provider-to-provider disclosures for treatment.

What does HIPAA readiness cost?

Typical timeline

1. 1. Confirm your status and scope — Determine whether you are a covered entity, a business associate, or both, and inventory every system, vendor, and location where PHI or ePHI is created, stored, or transmitted.
2. 2. Designate accountability — Appoint a Security Official and a Privacy Official (the same person can hold both in a small practice) responsible for the program, per 45 CFR 164.308(a)(2) and 164.530.
3. 3. Conduct the Security Rule risk analysis — Complete an accurate, thorough risk analysis of threats and vulnerabilities to ePHI under 45 CFR 164.308(a)(1)(ii)(A), using a methodology appropriate to your organization. A structured workbook or the free HHS/ONC SRA Tool can help, but neither is prescribed.
4. 4. Adopt and tailor policies and safeguards — Put administrative, physical, and technical safeguards in writing and into practice — access controls, encryption, audit logging, training, workstation security, device and media controls.
5. 5. Execute Business Associate Agreements — Identify which relationships meet the business-associate definition and execute required BAAs before the relevant PHI disclosure. Check applicable exceptions, such as provider-to-provider disclosures for treatment, and track the agreements.
6. 6. Train the workforce and keep the program current — Deliver required training, maintain breach procedures, and review and update the risk analysis and policies as your environment and obligations change. HIPAA does not set a universal annual risk-analysis deadline.

How editable templates speed this up

ComplianceDocs offers $149 editions for medical, dental and mental-health practices, and home health & home care agencies. Each setting-specific edition contains 18 editable Word policies and procedures plus the HIPAA Security Risk Assessment and Audit Evidence Checklist workbooks. Review the matching preview and contents before choosing. The package includes a Business Associate Management Policy, not a BAA contract template. Templates provide a starting structure; your organization determines applicability, adapts the documents, completes its risk analysis, executes required agreements, trains staff and operates the safeguards.

Recommended HIPAA toolkits

Compare HIPAA with other frameworks

• HIPAA vs GDPR: Key Differences and Which One You Need

Frequently asked questions

Is there an official HIPAA certification?

Private certification and evaluation services exist, but HIPAA does not require a Security Rule certification. HHS does not endorse or recognize private certifications regarding the Security Rule. Such credentials do not establish compliance or remove an organization's legal obligations. The Security Rule requires periodic technical and nontechnical evaluation; an organization can perform that evaluation internally or obtain outside help.

Will buying HIPAA templates make my practice compliant?

No. Templates provide the required policies and risk-assessment methodology, but compliance comes from operating the safeguards and completing your own risk analysis for your practice under 45 CFR 164.308(a)(1)(ii)(A). The documentation supports compliance and is what auditors and investigators ask for first; running the program achieves it.

How fast do I have to report a HIPAA breach?

Under the Breach Notification Rule (45 CFR 164.400 and following), you must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured PHI. Notification to the HHS Secretary follows two tracks: a breach affecting 500 or more individuals must be reported to HHS within that same 60-day window, while breaches affecting fewer than 500 individuals are logged and reported to HHS annually (within 60 days after the end of the calendar year). Separately, a breach affecting more than 500 residents of a single state or jurisdiction also requires notice to prominent media serving that area, no later than 60 days. The toolkit includes a breach notification procedure to operationalize this.

Does HIPAA require encryption?

Under the current Security Rule, encryption of ePHI is an 'addressable' implementation specification: you must encrypt or document a reasonable, equivalent alternative. Encryption also creates a safe harbor from breach notification. Note that the HIPAA Security Rule NPRM published January 6, 2025 (comment period closed March 7, 2025) proposes to make encryption mandatory with limited exceptions; as of mid-2026 no final rule has been issued, so the current rule remains in effect — treat strong encryption as a practical baseline now.