HIPAA: The Complete Executive Guide

"HIPAA compliance" is really compliance with three distinct rules governing different aspects of protected health information — treating it as one undifferentiated obligation is where most programs first go wrong.

"HIPAA compliance" is really compliance with three distinct rules issued under HIPAA's authority — the Privacy Rule governing use and disclosure of protected health information, the Security Rule governing safeguards for electronic PHI, and the Breach Notification Rule governing what happens after a breach — each with meaningfully different obligations and a different natural owner inside the organization. Obligations fall on Covered Entities (health plans, clearinghouses, and providers) and their Business Associates, a category that captures most healthtech vendors, billing services, and cloud providers serving healthcare, often without a dramatic announcement that HIPAA now applies to them. A vendor handling PHI without a signed Business Associate Agreement is a real, common gap in healthcare vendor management, and a risk analysis that exists as a document but was never genuinely conducted against real systems remains the single most-frequently-cited deficiency in actual OCR investigations. HHS's proposed Security Rule update — which would convert several currently "addressable" safeguards, including MFA and encryption, into requirements with no flexibility clause — has not been finalized; HHS has moved it to its Long-Term Actions agenda with July 2027 as the current anticipated timeframe, a real delay worth tracking rather than assuming. That delay is not a reason to deprioritize MFA and encryption, since current enforcement already treats risk analysis and reasonable safeguards as required regardless of the final rule's date. Enforcement itself is tiered by culpability, not flat — willful neglect that goes uncorrected carries materially higher exposure than a documented, good-faith gap being actively remediated. This guide covers who is actually in scope by contractual relationship, what genuine implementation of the Security Rule's safeguards and the breach-notification workflow requires, a realistic maturity model for closing the gap between a documented and a genuinely conducted risk analysis, and how to avoid the mistakes that most commonly leave a HIPAA program looking compliant on paper without actually being so.

Key findings

1. "HIPAA compliance" is really compliance with three distinct rules governing different aspects of protected health information.

2. A vendor handling PHI without a signed Business Associate Agreement is a real, common gap in healthcare vendor management.

3. The proposed Security Rule update that would make MFA and encryption mandatory has not been finalized — HHS's own Long-Term Actions agenda now points to July 2027, a real delay from the original spring 2026 target.

4. A risk analysis that exists as a document but was never genuinely conducted against real systems remains the single most-frequently-cited deficiency in actual OCR investigations.

5. Enforcement is tiered by culpability, not flat — willful neglect that goes uncorrected carries materially higher exposure than a documented, good-faith gap.