The Health Insurance Portability and Accountability Act, a 1996 US law that sets rules for protecting the privacy and security of health information.
HIPAA applies to covered entities, which include health plans, healthcare clearinghouses, and most healthcare providers, and to business associates that handle protected health information on their behalf, such as billing companies and many software vendors. The Privacy Rule limits how health information can be used and shared, the Security Rule requires safeguards for electronic records, and the Breach Notification Rule requires notifying people and regulators after certain breaches.
For example, a clinic choosing a telehealth or AI documentation tool should confirm the vendor will sign a business associate agreement and explain how data is encrypted, stored, and accessed. HIPAA is enforced mainly by the Office for Civil Rights at the US Department of Health and Human Services. It applies only in the United States; other countries have their own health privacy laws.
An incident in which sensitive, protected, or confidential information is accessed, stolen, or disclosed without authorization.
Electronic Health RecordA digital version of a patient's medical history that can be shared securely among authorized healthcare providers.
SOC 2An auditing framework from the AICPA that assesses how a service company protects customer data, based on five trust services criteria.
TelemedicineDelivering healthcare services remotely using video calls, phone, messaging, and digital tools instead of in-person visits.
When US law requires a website privacy policy, which state privacy laws reach small businesses, and the sections your policy needs to cover.
A buyer's checklist for AI meeting assistants covering recording consent laws, accuracy testing, integrations, data retention, security and cost.
Every comprehensive US state consumer privacy law in effect or enacted as of October 2026, with effective dates, thresholds, key rights and official sources.