MedTech Terms
    The authoritative reference
    All terms

    HIPAA

    U.S. federal law governing the privacy and security of protected health information.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026

    Definition

    The Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the HITECH Act (2009) and the HIPAA Omnibus Rule (2013), establishes federal requirements for the privacy and security of Protected Health Information (PHI) in the United States. The HIPAA Security Rule (45 CFR Part 164 Subpart C) requires Covered Entities and Business Associates to implement administrative, physical, and technical safeguards for electronic PHI (ePHI). HHS Office for Civil Rights (OCR) enforces HIPAA.
    What the regulation says
    MedTech device manufacturers are typically not Covered Entities, but become Business Associates when they store, process, or transmit PHI on behalf of a Covered Entity (a hospital, payer, or provider). Business Associates must sign a Business Associate Agreement (BAA), follow the Security Rule, and report breaches under the Breach Notification Rule. The 2024 Notice of Proposed Rulemaking (NPRM) proposes substantial Security Rule updates including mandatory MFA and annual risk analyses.

    What this means in practice

    Connected medical devices increasingly touch PHI - telemetry, patient identifiers, device-derived diagnostic data. The right design pattern is to minimize PHI on the device, encrypt in transit and at rest, segment from non-PHI workloads, and codify the BAA terms in product architecture decisions. Failure to recognize Business Associate status is a leading cause of OCR enforcement against MedTech companies.
    Common pitfalls
    • •Assuming MedTech manufacturers aren't subject to HIPAA - Business Associate status is common.
    • •Storing PHI in customer-support tooling or analytics platforms without BAAs and equivalent controls.
    • •Treating de-identified data as 'not PHI' without meeting the Safe Harbor or Expert Determination standards.

    Frequently asked questions

    When it creates, receives, maintains, or transmits PHI on behalf of a Covered Entity. Cloud-connected devices, remote monitoring services, and analytics platforms typically qualify.

    Primary references

    3 sources
    Link health: 3 verified· last checked 2026-05-09
    HHS OCR·1eCFR·1Federal Register·1
    1. 1
      HHS HIPAA Security Rule
      Verified
      HHS OCRhhs.gov
    2. 2
      45 CFR Part 164 Subpart C
      Verified
      eCFRecfr.gov
    3. 3
      HIPAA Security Rule NPRM (2024)
      Verified
      Federal Registerfederalregister.gov

    Inline markers like [1] jump to the matching reference above.