MedTech Terms
    The authoritative reference
    All terms
    CybersecurityConnected & Cyber-Physical DevicesHIPAA

    HIPAA

    U.S. federal law governing the privacy and security of protected health information.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed September 19, 2026

    Definition

    The Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the HITECH Act (2009) and the HIPAA Omnibus Rule (2013), establishes federal requirements for the privacy and security of Protected Health Information (PHI) in the United States. The HIPAA Security Rule (45 CFR Part 164 Subpart C) requires Covered Entities and Business Associates to implement administrative, physical, and technical safeguards for electronic PHI (ePHI). HHS Office for Civil Rights (OCR) enforces HIPAA.
    What the regulation says
    MedTech device manufacturers are typically not Covered Entities, but become Business Associates when they store, process, or transmit PHI on behalf of a Covered Entity (a hospital, payer, or provider). Business Associates must sign a Business Associate Agreement (BAA), follow the Security Rule, and report breaches under the Breach Notification Rule. The 2024 Notice of Proposed Rulemaking (NPRM) proposes substantial Security Rule updates including mandatory MFA and annual risk analyses.

    What this means in practice

    Connected medical devices increasingly touch PHI - telemetry, patient identifiers, device-derived diagnostic data. The right design pattern is to minimize PHI on the device, encrypt in transit and at rest, segment from non-PHI workloads, and codify the BAA terms in product architecture decisions. Failure to recognize Business Associate status is a leading cause of OCR enforcement against MedTech companies.

    Examples

    • A MedTech company developing a smart insulin pump must implement technical safeguards like encryption for blood glucose data transmitted from the device to a cloud server to comply with HIPAA's ePHI requirements.
    • When a hospital purchases a new electronic health record system, the vendor providing the system becomes a Business Associate and must sign a Business Associate Agreement (BAA) with the hospital, outlining responsibilities for protecting patient data under HIPAA.
    • A medical imaging device that stores patient scans locally before uploading them to a central repository must ensure physical and administrative safeguards are in place to prevent unauthorized access to the electronic Protected Health Information (ePHI) on the device.
    Common pitfalls
    • •Assuming MedTech manufacturers aren't subject to HIPAA - Business Associate status is common.
    • •Storing PHI in customer-support tooling or analytics platforms without BAAs and equivalent controls.
    • •Treating de-identified data as 'not PHI' without meeting the Safe Harbor or Expert Determination standards.

    Frequently asked questions

    When it creates, receives, maintains, or transmits PHI on behalf of a Covered Entity. Cloud-connected devices, remote monitoring services, and analytics platforms typically qualify.

    Related terms

    Grouped by theme
    Cited by

    Where this term appears across MedTech Terms.

    Latest in MedTech

    Sources

    3 sources

    Sources support the definition or relevant regulatory context, not necessarily every claim on this page. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

    Tier 1Binding law and standards· 2Tier 2Regulator guidance and consensus· 1
    Link health: 3 verified· last checked 2026-06-20
    HHS OCR·1eCFR·1Federal Register·1
    1. 1
      HHS HIPAA Security Rule
      Tier 2 Verified
      HHS OCRhhs.gov
    2. 2
      45 CFR Part 164 Subpart C
      Tier 1 Verified
      eCFRecfr.gov
    3. 3
      HIPAA Security Rule NPRM (2024)
      Tier 1 Verified
      Federal Registerfederalregister.gov

    Inline markers like [1] jump to the matching reference above.