HIPAA (Health Insurance Portability and Accountability Act)

HIPAA is the US federal law governing protected health information (PHI). The HIPAA Security Rule (45 CFR Part 164, Subpart C) establishes administrative, physical, and technical safeguards for electronic PHI. Software handling ePHI must address access controls (164.312(a)(1)), audit controls (164.312(b)), integrity controls (164.312(c)), and transmission security (164.312(e)). Violations carry tiered civil monetary penalties, with an annual cap for identical violations that is adjusted each year for inflation (about $2 million in recent years).