HIPAA
CIPP/US glossary · Last reviewed: · By Victor Humenhuk (CIPP/US certified)
HIPAA - Health Insurance Portability and Accountability Act of 1996; its privacy and security rules regulate protected health information for health insurers, including self-funded health plans.
In the CIPP/US body of knowledge, HIPAA comes up under Chapter 12: Workplace Privacy; Chapter 1: Introduction to Privacy; Chapter 2: U.S. Legal Framework.
HIPAA in context
- The ==data controller== decides how and why data is processed and bears most obligations; the ==data processor== acts on the controller's behalf - under ==HIPAA, processors are 'business associates'==. (Processing and Data Roles - Subject, Controller, Processor)
- Weaknesses: ==no single DPA, plus gaps and overlaps== - illustrated by HITECH filling a gap and HIPAA/FTC overlap. (Sectoral Model (United States))
- The key question is whether a federal law ==preempts== state law: HIPAA lets states pass ==stricter== rules, while ==CAN-SPAM preempts== stricter state email rules. (Legislation and Federal Preemption)
Where HIPAA is covered in the CIPP/US study notes
- Sectoral Model (United States)
- Legislation and Federal Preemption
- Deidentification Standards: HIPAA Methods and FTC Guidance
- Federal Privacy Enforcement Outside the FTC
- HIPAA Origins and Purpose
- Federal Laws Affecting Employment Privacy
Related terms
- Sectoral model
- HITECH Act (2009)
- Preemption
- Tenth Amendment
- CAN-SPAM Act
- Safe harbor method
- Expert determination method
- OCR (HHS)
- CFPB
- GLBA
Test yourself on HIPAA
Recognising a definition is not the same as applying it in an exam scenario. Work through the free CIPP/US practice questions, or read the full CIPP/US study guide - every study note is free.