Health Insurance Portability and Accountability Act

HIPAA (Health Insurance Portability and Accountability Act) is a US law that mandates standards for protecting sensitive patient health information. HIPAA compliance ensures that covered entities and business associates safeguard electronic protected health information (ePHI) across storage, processing, and transmission.

HIPAA applies to covered entities (healthcare providers, health plans, clearinghouses) and business associates that handle ePHI. Any organization that stores, accesses, or transmits patient data must comply.

HIPAA defines 18 personal identifiers that must be removed to de-identify protected health information (PHI). These include:

1. Name
2. Geographic subdivisions smaller than a state
3. All elements of dates (except year) directly related to an individual
4. Telephone numbers
5. Fax numbers
6. Email addresses
7. Social Security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate/license numbers
12. Vehicle identifiers and serial numbers
13. Device identifiers and serial numbers
14. Web URLs
15. IP addresses
16. Biometric identifiers (e.g., fingerprints, voiceprints)
17. Full-face photos and comparable images
18. Any other unique identifying number, code, or characteristic

If any of these are present and improperly disclosed, it may constitute a HIPAA violation.

Information that does not relate to health status or healthcare services, and is not linked to an individual, is not considered PHI. For example, names, email addresses, or phone numbers without any medical context do not qualify as PHI.

No. A name by itself is not considered Protected Health Information (PHI) unless it is linked with health-related data. PHI only exists when personal identifiers are connected to health conditions, treatments, or care delivery.

Access control, audit logs, integrity controls, transmission security, and authentication mechanisms.

Picus validates whether your cybersecurity controls work as intended to protect ePHI and support HIPAA’s technical safeguard requirements.

Picus is not a compliance framework but helps validate your security posture and supports compliance through continuous control testing.

Yes. HIPAA requires covered entities and business associates to conduct evaluations and risk analyses to ensure that administrative, technical, and physical safeguards are working as intended. Continuous validation helps generate the evidence needed to demonstrate compliance.