--- title: "HIPAA, HIPAA | MedTech Terms" description: "U.S. federal law governing the privacy and security of protected health information. Plain-English Cybersecurity definition for MedTech teams, with examples and" lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/hipaa#term", "name": "HIPAA", "alternateName": [ "HIPAA", "Health Insurance Portability and Accountability Act" ], "description": "The Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the HITECH Act (2009) and the HIPAA Omnibus Rule (2013), establishes federal requirements for the privacy and security of Protected Health Information (PHI) in the United States. The HIPAA Security Rule (45 CFR Part 164 Subpart C) requires Covered Entities and Business Associates to implement administrative, physical, and technical safeguards for electronic PHI (ePHI). HHS Office for Civil Rights (OCR) enforces HIPAA.", "url": "https://medtechterms.com/terms/hipaa", "termCode": "hipaa", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/hipaa#article", "headline": "HIPAA, HIPAA", "description": "U.S. federal law governing the privacy and security of protected health information.", "url": "https://medtechterms.com/terms/hipaa", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/hipaa" }, "about": { "@id": "https://medtechterms.com/terms/hipaa#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "HIPAA, HIPAA, Health Insurance Portability and Accountability Act, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "HHS HIPAA Security Rule", "url": "https://www.hhs.gov/hipaa/for-professionals/security/index.html", "publisher": { "@type": "Organization", "name": "HHS OCR" } }, { "@type": "CreativeWork", "name": "45 CFR Part 164 Subpart C", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C", "publisher": { "@type": "Organization", "name": "eCFR" } }, { "@type": "CreativeWork", "name": "HIPAA Security Rule NPRM (2024)", "url": "https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information", "publisher": { "@type": "Organization", "name": "Federal Register" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/phi-ephi#term", "name": "PHI and ePHI", "url": "https://medtechterms.com/terms/phi-ephi" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/hitech-act#term", "name": "HITECH Act", "alternateName": "HITECH", "url": "https://medtechterms.com/terms/hitech-act" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/de-identification#term", "name": "De-Identification of Health Data", "url": "https://medtechterms.com/terms/de-identification" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/iso-27001#term", "name": "ISO/IEC 27001", "alternateName": "ISO 27001", "url": "https://medtechterms.com/terms/iso-27001" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "HIPAA", "item": "https://medtechterms.com/terms/hipaa" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/hipaa#faq", "mainEntity": [ { "@type": "Question", "name": "When is a MedTech company a Business Associate?", "acceptedAnswer": { "@type": "Answer", "text": "When it creates, receives, maintains, or transmits PHI on behalf of a Covered Entity. Cloud-connected devices, remote monitoring services, and analytics platforms typically qualify." } }, { "@type": "Question", "name": "What's a BAA?", "acceptedAnswer": { "@type": "Answer", "text": "A Business Associate Agreement - a contract between a Covered Entity and Business Associate that establishes permitted uses, safeguards, breach notification, and subcontractor flow-down." } }, { "@type": "Question", "name": "How does GDPR interact with HIPAA?", "acceptedAnswer": { "@type": "Answer", "text": "Both can apply to the same data. GDPR has stricter consent requirements and broader extraterritorial reach; HIPAA has more prescriptive breach notification rules. A unified privacy program addressing both is the norm for global MedTech." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. HIPAA [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices)HIPAA # HIPAA U.S. federal law governing the privacy and security of protected health information. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition The Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the [HITECH Act](/terms/hitech-act) (2009) and the HIPAA Omnibus Rule (2013), establishes federal requirements for the privacy and security of [Protected Health Information](/terms/phi-ephi) (PHI) in the United States. The HIPAA Security Rule (45 CFR Part 164 Subpart C) requires Covered Entities and Business Associates to implement administrative, physical, and technical safeguards for electronic PHI (ePHI). HHS Office for Civil Rights (OCR) enforces HIPAA. What the regulation says MedTech device manufacturers are typically not Covered Entities, but become Business Associates when they store, process, or transmit PHI on behalf of a Covered Entity (a hospital, payer, or provider). Business Associates must sign a Business Associate Agreement (BAA), follow the Security Rule, and report breaches under the Breach Notification Rule. The 2024 Notice of Proposed Rulemaking (NPRM) proposes substantial Security Rule updates including mandatory MFA and annual risk analyses. ## What this means in practice Connected medical devices increasingly touch PHI - telemetry, patient identifiers, device-derived diagnostic data. The right design pattern is to minimize PHI on the device, encrypt in transit and at rest, segment from non-PHI workloads, and codify the BAA terms in product architecture decisions. Failure to recognize Business Associate status is a leading cause of OCR enforcement against MedTech companies. Common pitfalls - • Assuming MedTech manufacturers aren't subject to HIPAA - Business Associate status is common. - • Storing PHI in customer-support tooling or analytics platforms without BAAs and equivalent controls. - • Treating de-identified data as 'not PHI' without meeting the Safe Harbor or Expert Determination standards. ## Frequently asked questions When is a MedTech company a Business Associate? When it creates, receives, maintains, or transmits PHI on behalf of a Covered Entity. Cloud-connected devices, remote monitoring services, and analytics platforms typically qualify. What's a BAA? How does GDPR interact with HIPAA? ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity De-Identification of Health Data The HIPAA-defined process of removing identifiers from PHI so the resulting data is no longer subject to the Privacy Rule. ](/terms/de-identification)[ Cybersecurity HITECH Act(HITECH) U.S. law that strengthened HIPAA enforcement and introduced breach-notification requirements. ](/terms/hitech-act)[ Cybersecurity ISO/IEC 27001(ISO 27001) International standard for information security management systems (ISMS), often required of MedTech vendors by enterprise customers. ](/terms/iso-27001)[ Cybersecurity PHI and ePHI Individually identifiable health information (PHI) and its electronic form (ePHI) - the data class HIPAA protects. ](/terms/phi-ephi) ### More in Cybersecurity · Same category [ Cybersecurity AAMI SW96 AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle. ](/terms/aami-sw96)[ Cybersecurity AAMI TIR57 AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management. ](/terms/aami-tir57)[ Cybersecurity AAMI TIR97(TIR97) AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57. ](/terms/aami-tir97)[ Cybersecurity Brainjacking Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient. ](/terms/brainjacking) Cited by Where this term appears across MedTech Terms. Ecosystems (1) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 HHS OCR· 1 eCFR· 1 Federal Register· 1 1. [1 HHS HIPAA Security Rule Verified HHS OCR · hhs.gov ](https://www.hhs.gov/hipaa/for-professionals/security/index.html) 2. [2 45 CFR Part 164 Subpart C Verified eCFR · ecfr.gov ](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C) 3. [3 HIPAA Security Rule NPRM (2024) Verified Federal Register · federalregister.gov ](https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### HIPAA questions on a connected device? We help MedTech teams reason through PHI, ePHI, and Security Rule controls without slowing the product roadmap. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Acronym HIPAA Sources 3 Updated 5/5/2026 [Compare with another term](/compare?a=hipaa) Learn in 60 seconds Card Lesson Quiz U.S. federal law governing the privacy and security of protected health information. - · Connected medical devices increasingly touch PHI - telemetry, patient identifiers, device-derived diagnostic data. - · The right design pattern is to minimize PHI on the device, encrypt in transit and at rest, segment from non-PHI workloads, and codify the BAA terms in product architecture decisions. - · Failure to recognize Business Associate status is a leading cause of OCR enforcement against MedTech companies. Remember this Watch out: Assuming MedTech manufacturers aren't subject to HIPAA - Business Associate status is common. Related terms - [PHI and ePHI ](/terms/phi-ephi) - [HITECH Act(HITECH) ](/terms/hitech-act) - [De-Identification of Health Data ](/terms/de-identification) - [ISO/IEC 27001(ISO 27001) ](/terms/iso-27001) You may also need Auto-suggested from Cybersecurity and shared keywords. - [HITRUST CSF(HITRUST) ](/terms/hitrust) - [NIST SP 800-53 / 800-171(NIST 800-53/171) ](/terms/nist-800-53) - [Health Information Sharing and Analysis Center(H-ISAC) ](/terms/h-isac) - [IEC 80001-1 ](/terms/iec-80001) - [NIST IR 8473, Cybersecurity Framework Profile for HPH(NIST IR 8473) ](/terms/nist-cswp-35) - [Section 524B of the FD&C Act(524B) ](/terms/section-524b) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)