HIPAA
Amended United States (Federal) · In force Apr 14, 2003 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Sets national standards for the use and disclosure of protected health information (Privacy Rule), administrative, physical and technical safeguards for electronic PHI (Security Rule), and notification of breaches of unsecured PHI. A proposed overhaul of the Security Rule (Jan. 2025 NPRM) would make most 'addressable' specifications mandatory, require asset inventories, MFA, encryption, annual compliance audits and 72-hour restoration planning, but it is not final. The 2024 reproductive health care privacy amendments were vacated nationwide in June 2025.
- Who it applies to
- Covered entities (health plans, health care clearinghouses, and health care providers that conduct standard electronic transactions) and their business associates, including cloud and data vendors that create, receive, maintain or transmit PHI. No size threshold.
- Penalties
- Civil money penalties, 2026 inflation-adjusted (91 FR 3665): tiered from $145 to $73,011 per violation, with a calendar-year cap of $2,190,294 per identical provision. Criminal penalties under 42 U.S.C. 1320d-6 up to $250,000 and 10 years' imprisonment for offenses with intent to sell or use PHI for commercial advantage or malicious harm.
- Enforced by
- HHS Office for Civil Rights (OCR); State Attorneys General (HITECH); DOJ for criminal violations
- Official name
- HIPAA Privacy, Security and Breach Notification Rules (45 CFR Parts 160 and 164)
- Citation
- Pub. L. 104-191; 42 U.S.C. 1320d et seq.; 45 CFR Parts 160 and 164
- Topics
- privacy, health, cybersecurity, breach-notification
Research notes
Security Rule NPRM (90 FR 898, Jan. 6, 2025; RIN 0945-AA22): the Unified Agenda lists final action for 07/2027 (month only, so no deadline row). The NPRM proposed a compliance date 180 days after a final rule's effective date. Reproductive health rule vacated June 18, 2025 (Purl v. HHS, N.D. Tex.), except NPP amendments tied to Part 2; the Fifth Circuit dismissed the appeal in September 2025 (per ABA/law firm reporting). Original Privacy Rule compliance date April 14, 2003 (small health plans April 14, 2004); Security Rule compliance April 20, 2005. HHS also exercises 2019 enforcement discretion capping annual penalties per tier below the statutory cap.
Related
CIRCIAQuestions about HIPAA
- What are the HIPAA compliance deadlines?
- Jun 25, 2024: Reproductive health care privacy rule effective (later vacated). Dec 23, 2024: Reproductive health privacy compliance date (vacated). Mar 7, 2025: Security Rule NPRM comment period closed. Feb 16, 2026: Notice of Privacy Practices updates (Part 2 alignment).
- When does HIPAA take effect?
- HIPAA took effect on Apr 14, 2003.
- Who does HIPAA apply to?
- Covered entities (health plans, health care clearinghouses, and health care providers that conduct standard electronic transactions) and their business associates, including cloud and data vendors that create, receive, maintain or transmit PHI. No size threshold.
- What are the penalties under HIPAA?
- Civil money penalties, 2026 inflation-adjusted (91 FR 3665): tiered from $145 to $73,011 per violation, with a calendar-year cap of $2,190,294 per identical provision. Criminal penalties under 42 U.S.C. 1320d-6 up to $250,000 and 10 years' imprisonment for offenses with intent to sell or use PHI for commercial advantage or malicious harm.