The Health Insurance Portability and Accountability Act — US federal law establishing privacy and security standards for protected health information (PHI).
Also known as: Health Insurance Portability and Accountability Act, HIPAA Privacy Rule, HIPAA Security Rule
HIPAA (Health Insurance Portability and Accountability Act) is US federal legislation enacted in 1996 that establishes national standards for protecting sensitive patient health information. It applies to covered entities — healthcare providers, health plans, and healthcare clearinghouses — and their business associates who handle protected health information (PHI) on their behalf.
HIPAA's Privacy Rule defines what constitutes PHI and restricts how it may be used and disclosed. The Security Rule establishes technical, physical, and administrative safeguards for electronic PHI (ePHI). Violations can result in civil monetary penalties ranging from $100 to $50,000 per violation, with an annual cap of $1.9 million per violation category.
HIPAA compliance requires organizations to identify all PHI within their systems, implement safeguards proportional to the risk of unauthorized disclosure, and document their compliance program with policies, procedures, and training records.
The 18 HIPAA identifiers that must be protected include:
Data that has had all 18 identifiers removed — through the Safe Harbor de-identification method — is no longer considered PHI and falls outside HIPAA's scope.
Engineering teams building healthcare applications face HIPAA compliance requirements that extend beyond the application itself. PHI can appear unexpectedly in:
Each of these surfaces requires the same protections as the primary application. A single log file containing unredacted PHI constitutes a HIPAA violation regardless of whether it was intentional.
The Office for Civil Rights (OCR), which enforces HIPAA, has increasingly targeted technical implementation gaps rather than just policy failures. Developers are now accountable for the security engineering decisions that determine whether PHI leaks.
GlobalShield API provides automated PHI detection and redaction for engineering teams building on healthcare data. The API's HIPAA detection mode identifies all 18 HIPAA identifiers plus contextual patterns in free-text fields — clinical notes, discharge summaries, nursing observations — where standard regex approaches fail.
Engineering teams integrate GlobalShield into their data pipelines to scan ingested records before storage, redact PHI from log files in real time, and audit existing databases for PHI exposure before a regulatory review finds it first.