--- title: Introduction to HIPAA Compliance - TrueVault description: A guide with everything you need to know about HIPAA compliance as it relates to your application and what steps you need to take to be sure you don't violate the law. Learn more by reading the HIPAA guide. --- - [CCPA](https://safe.truevault.com/learn/ccpa/what-is-the-ccpa) - [GDPR Compliance](https://safe.truevault.com/gdpr-guide) - [Personal Data](https://safe.truevault.com/learn/what-is-personal-data) - [DSAR](https://safe.truevault.com/learn/explaining-gdpr-data-subject-requests) - [HIPAA](https://safe.truevault.com/learn/hipaa) - [HIPAA Compliance](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html) - [Personally Identifiable Information](https://safe.truevault.com/blog/what-is-phi) - [PHI](https://safe.truevault.com/protected-health-information) - [Resources](https://safe.truevault.com/learn/) - [Resource Center](https://safe.truevault.com/learn/) - [TrueVault Safe](https://safe.truevault.com/help/truevault-safe) - [About](https://safe.truevault.com/about-us) - [Contact](https://safe.truevault.com/contact-us) - [Careers](https://careers.truevault.com/) - Solutions - [GDPR Compliance](https://safe.truevault.com/solutions/gdpr-compliance) - [HIPAA Compliance](https://safe.truevault.com/hipaa-compliance) - [For Applications](https://safe.truevault.com/solutions/application-compliance) - [For Data Exchanges](https://safe.truevault.com/solutions/data-exchange-compliance) - [Developers](https://safe.truevault.com/resources/index) - [Pricing](https://safe.truevault.com/safe-pricing) - [Blog](https://safe.truevault.com/blog) - [Login](https://console.truevault.com/login) - [Get Started](https://safe.truevault.com/get-started) # Introduction to HIPAA Compliance ## ![iStock-486105325](https://safe.truevault.com/hs-fs/hubfs/iStock-486105325.jpg?width=600&name=iStock-486105325.jpg) ## Introduction [HIPAA](https://safe.truevault.com/solutions/hipaa?hsLang=en), the [Health Insurance Portability and Accountability Act](https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act), was passed in 1996, and among other things, outlines the requirements for the management of, storage and transmission of [protected health information](https://www.truevault.com/protected-health-information?hsLang=en) (PHI) in both physical and digital form. And while the original legislation pre-dates the rise of the commercial Internet (and the iPhone by a decade) its rules govern the use of this special type of personal data by applications on the web and mobile devices. With any twenty year old piece of legislation that was written in a world without smartphones, tablets, and heck, even webmail, [HIPAA](https://safe.truevault.com/learn/hipaa?hsLang=en) is full of requirements that are confusing and challenging, particularly for software developers who have to make sense of them as they relate to their product and the underlying technologies that we all use on a regular basis to build and deliver applications to our customer bases. ## 2013 Final Omnibus Rule Update In September of 2013, the [Final Omnibus Rule Update](https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act#cite_note-33) was passed that amended HIPAA and greatly expanded the definition of who needed to be HIPAA compliant. Previously, only covered entities (such as doctors, hospitals, and insurers) were required to be HIPAA compliant. With the recent rule change however, all entities that store, manage, record or pass Protected Health Information (we'll just call it PHI from now on) to and from covered entities are also required to be HIPAA compliant. These entities, called Business Associates, who were previously exempt from HIPAA, now fall under its governance. ## Why this guide? As you can imagine, complying with federal regulations around privacy and healthcare data is no small task. That's why we've created this guide—to help you wade through what you need to know about HIPAA compliance as it relates to your application and what steps you'll need to take to ensure you don't end up in violation of the law. There is plenty to read about HIPAA guidelines, and if you want you can spend a good chunk of the rest of the year reading up on all the details. Therefore, we're not going to rewrite everything here. This guide is not meant to be comprehensive, but rather give you a framework and reference to help you understand the major portions of the law that apply directly to the software you're developing for mobile, web and wearable applications. ## Who is this guide for? If you're a developer building a web, mobile or wearable software application that deals in the collection, storage, or transmission of personally identifiable health information to covered entities like doctors this is for you. You'll get the ins and outs of HIPAA compliance guidelines and the steps you'll want to take to ensure you're within those guidelines in the development, hosting, and communication with your users. From a breakdown of the terms and requirements, to specific examples of HIPAA-covered activities, we've tried to give you what you need to understand the laws in plain language so that you can make the right decisions when developing your application. Whether you decide that your application falls under HIPAA guidelines or not, this guide will give you the information you need to make that decision. ## Build on our Work This guide is the just the beginning. We hope you'll help us build it out further to make it the go-to source for information on HIPAA compliance and software development. ## Questions/Feedback You can drop us a line any time at [hello@truevault.com](mailto:hello@truevault.com). We'd love to hear from you. ## Mandatory disclaimer We're software developers just like you, but we've spent countless hours researching, studying and learning the ins and outs of HIPAA compliance. We've worked with industry experts and attorneys to understand the various portion of the law. In short, we think we have a solid handle on it. However, we need to be clear — we're not lawyers and you should not take this as legal advice. If you need to make business decisions around HIPAA you'll probably sleep better at night knowing you paid a very expensive attorney to give their opinion on your specific question. [![Get The HIPAA Compliant Checklist](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/4693513/e7f4b6db-52ca-46a0-bd1e-cb24ace89926.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/4693513/e7f4b6db-52ca-46a0-bd1e-cb24ace89926) ## Navigation [Chapter 2: What is HIPAA?](https://safe.truevault.com/learn/what-is-hipaa?hsLang=en) ### **Disclaimer** ### *This article is provided for general informational purposes only and is not intended to be legal advice.  By using the article, you agree that the information on this article does not constitute legal or other professional advice. The article is not a substitute for obtaining legal advice from a qualified attorney licensed in your state. The information on the article may be changed without notice and is not guaranteed to be complete, correct or up-to-date, and may not reflect the most current legal developments.* ### Table of Contents - Chapter 1: [Introduction to HIPAA Compliance](https://safe.truevault.com/learn/introduction-to-hipaa-compliance?hsLang=en) - Chapter 2: [What is HIPAA?](https://safe.truevault.com/learn/what-is-hipaa?hsLang=en) - Chapter 3: [Do I need to be HIPAA Compliant?](https://safe.truevault.com/learn/do-i-need-to-be-hipaa-compliant?hsLang=en) - Chapter 4: [HIPAA Security Rule](https://safe.truevault.com/learn/the-hipaa-security-rule?hsLang=en) - Chapter 5: [Becoming HIPAA Compliant](https://safe.truevault.com/learn/becoming-hipaa-compliant?hsLang=en) - Chapter 6: [Who Certifies HIPAA Compliance?](https://safe.truevault.com/learn/who-certifies-hipaa-compliance?hsLang=en) - Chapter 7: [HIPAA Fines](https://safe.truevault.com/learn/hipaa-fines?hsLang=en) - Chapter 8: [Developer Considerations](https://safe.truevault.com/learn/developer-considerations?hsLang=en) - Chapter 9: [Mobile Applications and HIPAA Compliance](https://safe.truevault.com/learn/mobile-applications-and-hipaa-compliance?hsLang=en) - Chapter 10: [Wearable Applications and HIPAA Compliance](https://safe.truevault.com/learn/wearable-applications-and-hipaa-compliance?hsLang=en) - Chapter 11:[Apple Healthkit](https://safe.truevault.com/learn/apple-healthkit?hsLang=en) ### Latest Posts ## [Should Utah's Privacy Law Be on Your Radar?](https://safe.truevault.com/blog/utah-privacy-law-does-it-apply?hsLang=en) Phillip Walters / November 17, 2022 ## [Connecticut’s Privacy Law: Does It Apply to Your Business?](https://safe.truevault.com/blog/connecticut-privacy-law-does-it-apply?hsLang=en) Phillip Walters / November 10, 2022 ## [Global Privacy Control: A New Requirement for Compliance](https://safe.truevault.com/blog/global-privacy-control?hsLang=en) Phillip Walters / November 7, 2022 ### Blog Subscription ### Company - [Blog](https://safe.truevault.com/blog) - [Contact Us](https://safe.truevault.com/contact-us-2019) - [Careers](https://truevault.workable.com) - [HIPAA Compliance Checklist](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html) - [PDF: Developers Guide to HIPAA compliance](https://my.leadpages.net/leadbox/14472b173f72a2%3A131fd12f8b46dc/5760820306771968/) ### Developers - [Patterns](https://safe.truevault.com/patterns) - [Documentation](https://docs.truevault.com/) - [Quick Start Guide](https://safe.truevault.com/quick-start-guide) - [Secure Infrastructure](https://safe.truevault.com/secure-infrastructure) - [API Overview](https://safe.truevault.com/api-overview) ### Latest Posts ### Contact Us 201 Mission Street, 12th Floor San Francisco, CA 94105 Email: [hello@truevault.com](mailto:hello@truevault.com) 2021 © All Rights Reserved. [Privacy Policy](https://privacy.truevault.com/privacy-policy) | [Terms of Service](https://safe.truevault.com/terms-of-service?hsLang=en) - - -