United States. Health data. Act
HIPAA (statute)Health Insurance Portability and Accountability Act of 1996 (Pub. L. 104-191)
Partly verified
Medium confidence.Source read: first 100,000 characters of Wikipedia. The in-force date used here is the signing date; it is not confirmed whether Title II took effect then. Civil tier penalty amounts in the source look outdated, so none are given. In force date: the Act (read in the Statutes at Large PDF on congress.gov) has no general effective-date clause for Title II, subtitle F (Administrative Simplification), so the enactment date is used. Compliance is required 24 months after each HHS standard is adopted (36 months for small health plans), which is why the Privacy Rule applied from 14 Apr 2003. LII (42 U.S.C. 1320d) has no effective-date note for Pub. L. 104-191.
§1Summary
- Synopsis
The statute that required HHS to set national standards for electronic health care transactions and identifiers (Title II, Administrative Simplification). HHS issued Privacy, Transactions and Code Sets, Security, Unique Identifiers and Enforcement rules under it.
- Key themes
- Unique features
The enabling statute; the operative privacy obligations are in the HHS rules recorded separately.
- SaaS relevance
SaaS vendors handling protected health information act as business associates under the rules.
§2Obligations
- Breach notification
- None
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Criminal: up to $250,000 and 10 years for offences with intent to sell or use for commercial advantage (per Wikipedia)
§3Dates
- Key dates
- Adopted
- In force
- Pub. L. 104-191 signed 21 Aug 1996. Title II (Administrative Simplification) led to HHS rules: Privacy Rule (effective 14 Apr 2003, see us-hipaa-privacy-rule), Security Rule, Enforcement Rule (effective 16 Mar 2006).
§4Text and authority
- Text
- Authoritative text congress.gov
- Authority
- HHS Office for Civil Rights
§5Where it applies
- Domestic law of
- United States
- Also applies in
- Alabama
- Alaska
- Arizona
- Arkansas
- California
- Colorado
- Connecticut
- Delaware
- District of Columbia
- Florida
- Georgia
- Guam
- Hawaii
- Idaho
- Illinois
- Indiana
- Iowa
- Kansas
- Kentucky
- Louisiana
- Maine
- Maryland
- Massachusetts
- Michigan
- Minnesota
- Mississippi
- Missouri
- Montana
- Nebraska
- Nevada
- New Hampshire
- New Jersey
- New Mexico
- New York
- North Carolina
- North Dakota
- Ohio
- Oklahoma
- Oregon
- Pennsylvania
- Puerto Rico
- Rhode Island
- South Carolina
- South Dakota
- Tennessee
- Texas
- US Virgin Islands
- Utah
- Vermont
- Virginia
- Washington
- West Virginia
- Wisconsin
- Wyoming
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Source read: first 100,000 characters of Wikipedia. The in-force date used here is the signing date; it is not confirmed whether Title II took effect then. Civil tier penalty amounts in the source look outdated, so none are given. In force date: the Act (read in the Statutes at Large PDF on congress.gov) has no general effective-date clause for Title II, subtitle F (Administrative Simplification), so the enactment date is used. Compliance is required 24 months after each HHS standard is adopted (36 months for small health plans), which is why the Privacy Rule applied from 14 Apr 2003. LII (42 U.S.C. 1320d) has no effective-date note for Pub. L. 104-191.