HIPAA

HIPAA's rules apply to covered entities, meaning health plans, health care clearinghouses and health care providers who send health information electronically in connection with standard transactions such as insurance billing, and to the business associates who handle protected health information on their behalf. A treatment center that bills insurance electronically is a covered entity.

The Privacy Rule limits how protected health information is used and disclosed. The Security Rule requires administrative, physical and technical safeguards for the electronic kind. The Breach Notification Rule sets out who must be told after a breach, and when.

For websites, the live question has been tracking technology. HHS guidance warns that analytics and advertising tools can send protected health information to vendors, and it says a banner asking visitors to accept or reject cookies is not a valid HIPAA authorization. On June 20, 2024, a federal court in Texas vacated the part of that guidance about linking an IP address to a visit to an unauthenticated public page about a health condition or a provider; the guidance on logged-in pages such as patient portals was left in place.