HIPAA Basics for Small Business Owners: Who Is Covered and What to Do First

This is general information, not legal advice

HIPAA, the Health Insurance Portability and Accountability Act, is a United States law, with rules covering privacy, security and breach notification. This article is a general introduction for business owners. It is not legal advice, and requirements depend on your exact role, state and data. Use it to understand the shape of the topic, then confirm the details with a qualified professional and the official guidance from the US Department of Health and Human Services.

Who is covered

The law applies to two broad groups. Covered entities include most healthcare providers who transmit health information electronically for billing, health plans and healthcare clearinghouses. Business associates are the organisations that create, receive, maintain or transmit protected health information on behalf of a covered entity. Typical examples include billing services, IT providers, cloud hosting providers, shredding companies and consultants who see patient data.

A small business can therefore be covered even if it is not a clinic. A software company hosting appointment data for dental practices, or an outsourced IT firm managing a doctor's servers, may be a business associate. Subcontractors of business associates can be covered too.

What counts as protected health information

PHI is health information that can identify an individual and is held or sent by a covered entity or business associate. It covers past, present or future health conditions, care and payment for care. Identifiers include names, addresses, dates, phone numbers, email addresses, record numbers and photographs.

It applies in any form: paper charts, spoken information, emails, databases, images and backups. Data that has been properly de-identified under the rules is treated differently, but the standard for de-identification is strict, so do not assume that removing a name is enough.

The main rules in outline

The framework has several parts, and each places different expectations on you.

• Privacy Rule: limits how PHI may be used and disclosed and gives individuals rights over their information
• Security Rule: requires administrative, physical and technical safeguards for electronic PHI
• Breach Notification Rule: sets duties to notify affected individuals, regulators and sometimes the media after certain breaches
• Business associate requirements: contracts and direct obligations for vendors handling PHI

First practical steps

Begin by confirming whether and how HIPAA applies to you. Then map where PHI lives in your systems: who creates it, where it is stored, who can access it and where it travels. You cannot protect what you have not found.

Carry out a documented risk analysis, which is a core requirement of the Security Rule, and act on the findings. Write policies, assign a privacy and security lead, train staff and record the training. On the technical side, expect to use unique user accounts, multi-factor authentication, encryption, audit logging, regular updates, backups and a way to remove access quickly when people leave.

Vendors and agreements

Review every vendor that touches PHI, from your email provider to your cloud backup. Where a vendor is a business associate, you need a signed agreement before sharing data. Some providers offer HIPAA-eligible plans and will sign one, while consumer-grade plans of the same product may not be suitable.

Be cautious of marketing that says a tool is HIPAA compliant. Compliance depends on configuration and use. Check what the vendor's agreement actually covers and what you must set up on your side.

Mistakes small organisations often make

Several slips appear repeatedly. Using consumer-grade email, file sharing or messaging tools to send patient information without proper agreements or safeguards is a frequent one. Another is skipping the risk analysis, or doing it once and never updating it. Staff sharing logins, leaving devices unencrypted and failing to remove access for former employees also appear often in enforcement actions.

Physical security is easy to forget. Screens facing waiting rooms, paper records in unlocked cabinets and old devices thrown away without wiping can all lead to a breach. Include these in your risk analysis along with the technical points, and keep a log of what you decided and why.

Keep it alive

HIPAA compliance is not a one-time project. Repeat the risk analysis when you change systems or offices, keep training current, and rehearse your breach response. Document everything, since regulators look for evidence of reasonable effort. A small, well-run programme that is genuinely followed is far better than a thick binder that nobody opens.