HIPAA

The Health Insurance Portability and Accountability Act — US federal law establishing privacy and security standards for protected health information (PHI).

Also known as: Health Insurance Portability and Accountability Act, HIPAA Privacy Rule, HIPAA Security Rule

HIPAA (Health Insurance Portability and Accountability Act) is US federal legislation enacted in 1996 that establishes national standards for protecting sensitive patient health information. It applies to covered entities — healthcare providers, health plans, and healthcare clearinghouses — and their business associates who handle protected health information (PHI) on their behalf.

HIPAA's Privacy Rule defines what constitutes PHI and restricts how it may be used and disclosed. The Security Rule establishes technical, physical, and administrative safeguards for electronic PHI (ePHI). Violations can result in civil monetary penalties ranging from $100 to $50,000 per violation, with an annual cap of $1.9 million per violation category.

How It Works

HIPAA compliance requires organizations to identify all PHI within their systems, implement safeguards proportional to the risk of unauthorized disclosure, and document their compliance program with policies, procedures, and training records.

The 18 HIPAA identifiers that must be protected include:

  • Patient names and geographic data smaller than state level
  • Dates related to an individual (birth, admission, discharge, death)
  • Phone numbers, fax numbers, email addresses
  • Social Security numbers, medical record numbers
  • Health plan beneficiary numbers, account numbers
  • Certificate and license numbers, vehicle and device identifiers
  • IP addresses, web URLs
  • Biometric identifiers, full-face photographs

Data that has had all 18 identifiers removed — through the Safe Harbor de-identification method — is no longer considered PHI and falls outside HIPAA's scope.

Why It Matters for Developers

Engineering teams building healthcare applications face HIPAA compliance requirements that extend beyond the application itself. PHI can appear unexpectedly in:

  • Application log files (patient names in debug output)
  • Analytics databases (medical record numbers in event tracking)
  • Third-party integrations (customer support tools receiving PHI in support tickets)
  • Backup and archival systems (unencrypted database dumps)
  • AI and machine learning pipelines (training data containing patient records)

Each of these surfaces requires the same protections as the primary application. A single log file containing unredacted PHI constitutes a HIPAA violation regardless of whether it was intentional.

The Office for Civil Rights (OCR), which enforces HIPAA, has increasingly targeted technical implementation gaps rather than just policy failures. Developers are now accountable for the security engineering decisions that determine whether PHI leaks.

How APIVult Helps

GlobalShield API provides automated PHI detection and redaction for engineering teams building on healthcare data. The API's HIPAA detection mode identifies all 18 HIPAA identifiers plus contextual patterns in free-text fields — clinical notes, discharge summaries, nursing observations — where standard regex approaches fail.

Engineering teams integrate GlobalShield into their data pipelines to scan ingested records before storage, redact PHI from log files in real time, and audit existing databases for PHI exposure before a regulatory review finds it first.