HIPAA compliance: what it means for teams that handle health documents

HIPAA compliance means healthcare providers, health plans, clearinghouses and the vendors that handle protected health information (PHI) for them protect it with the administrative, physical and technical safeguards federal law requires. It isn't a certification: it's an ongoing program of risk analysis, safeguards, business associate agreements and records that show the controls work. HHS's Office for Civil Rights enforces it.

This guide covers who HIPAA applies to, its three rules, the safeguards they require, what violations cost, and how to handle PHI in document workflows.

What is HIPAA compliance?#

HIPAA, the Health Insurance Portability and Accountability Act, sets national rules for using, disclosing and securing health information. What most people get wrong: there's no official HIPAA certification. HHS doesn't recognize private certifications of Security Rule compliance, and one doesn't relieve you of any obligation. Compliance is something you maintain and can show: a current risk analysis, policies people follow, agreements with every vendor that touches PHI, and records that the controls work.

Who has to comply with HIPAA#

HIPAA applies to three kinds of covered entities and to their business associates:

• Healthcare providers

  Hospitals, clinics, practices, pharmacies and dentists that send health information electronically in standard transactions, such as claims.

• Health plans

  Insurers, HMOs, employer group health plans, Medicare and Medicaid.

• Healthcare clearinghouses

  Organizations that convert health information between nonstandard and standard formats.

• Business associates

  Vendors that create, receive, keep or send PHI for a covered entity, such as billing services, cloud hosts and document processing platforms.

Business associates are directly liable: HHS can fine them for violations, just as it can fine covered entities. A signed business associate agreement (BAA) shares accountability; it doesn't hand it over to the vendor.

The three HIPAA rules#

• Privacy Rule

  Governs how PHI may be used and disclosed. Its minimum necessary standard limits each use or disclosure to the information needed for the purpose.

• Security Rule

  Requires administrative, physical and technical safeguards for electronic PHI (ePHI), starting with a risk analysis.

• Breach Notification Rule

  Requires notice to individuals without unreasonable delay, and within 60 calendar days of discovering a breach of unsecured PHI, plus notice to HHS and, for large breaches, the media.

Minimum necessary shapes document workflows directly. If a claims processor needs a diagnosis code and a date of service, the workflow shouldn't route the patient's full history to them.

The safeguards the Security Rule requires#

The Security Rule groups its standards into three kinds of safeguards:

Some specifications are "required" and others "addressable." Addressable doesn't mean optional: implement it if it's reasonable and appropriate, or document why not and use an equivalent measure. Encryption is addressable today. HHS proposed in January 2025 to drop the distinction and require encryption of ePHI at rest and in transit; as of September 2026 the rule isn't final. More in data encryption.

What counts as protected health information#

PHI is individually identifiable health information held or sent by a covered entity or business associate: health data that can be linked to a person. HIPAA's Safe Harbor method lists 18 identifiers to remove before health data counts as de-identified:

• Names, geographic units smaller than a state, and all dates except the year (birth, admission, discharge, death)
• Phone numbers, fax numbers and email addresses
• Social Security, medical record, health plan beneficiary and account numbers
• Certificate and license numbers, vehicle identifiers and device identifiers
• Web URLs, IP addresses, biometric identifiers and full-face photos
• Any other unique identifying number, characteristic or code

If any of these appear next to health information in an intake form, claim or lab result, treat the document as PHI.

How to conduct a HIPAA risk assessment#

The Security Rule requires "an accurate and thorough assessment of the potential risks and vulnerabilities" to ePHI. A defensible risk analysis leaves these records behind:

In document-heavy operations, the easy places to miss are temporary files created during OCR, review queues where staff see PHI, shared download folders, and test environments loaded with real data.

Business associate agreements explained#

A BAA is the written contract between a covered entity and a business associate, or between a business associate and its subcontractor. HIPAA spells out what it must include:

• Permitted usesWhat the vendor may and may not do with PHI.
• SafeguardsA commitment to protect PHI and to follow the Security Rule for ePHI.
• ReportingNotice of any use or disclosure the contract doesn't allow, including breaches of unsecured PHI.
• SubcontractorsThe same restrictions passed down to any subcontractor that handles PHI.
• Access for HHSRecords made available to HHS to check compliance.
• End of contractPHI returned or destroyed when the contract ends, or protected if that isn't feasible.

A BAA doesn't make a vendor compliant; it creates obligations and liability. Check the vendor's safeguards before you sign.

HIPAA compliance for document workflows#

Document workflows concentrate HIPAA risk: they're where PHI in intake forms, claims, prior authorizations, lab results and medical records enters, gets copied and leaves.

• IntakeEach channel (fax, email, portal, mail) has different risks. Route them into one controlled queue.
• SortingManual sorting shows staff PHI they don't need. Classify automatically so each person sees only their own work.
• ExtractionOCR creates temporary files, logs and outputs. Secure them, and delete them on schedule.
• ReviewException queues give reviewers access to PHI. Limit each reviewer to their queue and log every view in an audit trail.
• ExportSend the next system only the fields it needs, so PHI isn't copied into places it doesn't belong.

Docsumo supports HIPAA compliance with a BAA available, is SOC 2 Type 2 audited and ISO/IEC 27001:2022 certified, and doesn't use customer data to train shared or third-party models. Fields the model is unsure about go to your own reviewers, it can redact sensitive data such as Social Security and account numbers, and audit logging is on the Business plan. It doesn't make you compliant on its own: your risk analysis and access policies stay yours. See IDP for healthcare and the security page.

HIPAA violation penalties#

Civil penalties depend on culpability. These amounts apply to penalties assessed from January 28, 2026, when HHS last adjusted them for inflation:

The yearly cap applies to all violations of the same requirement in a calendar year. Since 2019, as a matter of enforcement discretion, HHS has applied lower yearly caps to the first three tiers: $25,000, $100,000 and $250,000 before inflation adjustments.

Criminal penalties are separate: up to $50,000 and 1 year in prison for knowingly obtaining or disclosing health information, $100,000 and 5 years under false pretenses, and $250,000 and 10 years with intent to sell or use it for commercial advantage, personal gain or malicious harm.

How to become HIPAA compliant, and stay that way#

1. Confirm your roleCovered entity, business associate or both.
2. Map PHI and assess riskFind where PHI lives, how it moves and where controls fall short.
3. Put safeguards in placeAdministrative, physical and technical.
4. Sign BAAsWith every vendor that touches PHI, after checking its safeguards.
5. Train and documentTrain each role on your policies, and keep required documentation for 6 years.
6. Monitor and reassessReview activity logs, test controls and update the risk analysis when systems or vendors change.

Most programs fail in the gap between paper and practice:

The bottom line#

HIPAA compliance isn't a certificate. It's a risk analysis you keep current, safeguards you can show working, and agreements with every vendor that touches PHI. In document workflows, give each person only what their job needs, log who saw what, and choose vendors that sign a BAA and can prove their controls.

Book a demo with a few de-identified health documents, or start a free trial.

Frequently asked questions#