--- title: "What is HIPAA?" description: "HIPAA is the US law that protects patient health information. Read what it asks of a support team, plus HIPAA-trained staff and a signed BAA." url: https://assistbpo.com/glossary/hipaa/ updated: 2026-09-20 publisher: AssistBPO (SS Support Network LLC) language: en-US --- # What is HIPAA? Glossary What is HIPAA? HIPAA, the Health Insurance Portability and Accountability Act, is the US federal law that sets national standards for protecting patient health information. Its Privacy Rule governs who may see or share patient data, its Security Rule requires administrative, physical and technical safeguards, and its Breach Notification Rule sets reporting duties. The HHS Office for Civil Rights (OCR) enforces it. Updated September 2026 · Reviewed by [Nimra Khalid](https://assistbpo.com/team/nimra-khalid/) ## How does HIPAA work? 1. Covered entities (providers, health plans, clearinghouses) and their business associates must follow the Privacy, Security and Breach Notification Rules. 2. Staff may only use the minimum necessary PHI for the task, whether that is confirming an appointment or checking a copay. 3. Safeguards include unique logins, role-based access, encrypted devices, audit logs and documented training for everyone who touches records. 4. Breaches affecting 500 or more people must be reported to OCR and the media within 60 days; smaller ones are logged and reported annually. 5. Patients have rights to access their records, request corrections and receive a notice of privacy practices. ## A worked example A two-location physical therapy clinic in Colorado adds a remote scheduler to handle intake calls. The clinic's HIPAA officer updates the risk assessment to list the new workflow, signs a BAA with the staffing provider, and gives the scheduler a WebPT login limited to the calendar and demographics screens. The scheduler completes the clinic's annual HIPAA training module, reads back only the date of birth and the last four digits of the phone number on calls, and never emails patient details outside the encrypted portal. ## Where does HIPAA show up in your tools? HIPAA obligations surface as BAA checkboxes in vendor forms, as role-based permission sets in athenahealth, eClinicalWorks, Kareo and Dentrix, and as audit-log exports the practice reviews during its annual risk assessment. ## Common mistakes - Sending patient names and appointment details over plain email or consumer chat apps instead of the practice's encrypted portal. - Sharing one login among several staff, which destroys the audit trail the Security Rule expects. - Asking a vendor for a certification that does not exist: OCR does not certify companies, so ask for training records, safeguards and a signed BAA instead. ## Why does HIPAA matter? For a small practice, a HIPAA gap is both a regulatory risk and a patient-trust risk, and OCR settlements have included solo practices, not only hospital systems. Getting the basics right (BAA, minimum necessary access, training, breach process) is what lets a remote assistant safely touch the schedule. This is a plain-language summary, not legal advice. ## How does AssistBPO handle HIPAA? Healthcare desks at AssistBPO are built with HIPAA-trained staff and a BAA in place before any record is opened, following the pattern our sister brand SS Support Network uses in its own medical work. Assistants work on managed devices with unique logins scoped to the screens their role needs, and the team lead reviews access every quarter. [Compliance, country by country](https://assistbpo.com/compliance/)[Get a staffing plan](https://assistbpo.com/get-a-staffing-plan/) ## Related terms - [Business associate agreement](https://assistbpo.com/glossary/business-associate-agreement/) - [Least privilege access](https://assistbpo.com/glossary/least-privilege-access/) - [Eligibility verification](https://assistbpo.com/glossary/eligibility-verification/) - [Prior authorization](https://assistbpo.com/glossary/prior-authorization/) - [Team lead](https://assistbpo.com/glossary/team-lead/) - [Workflow](https://assistbpo.com/glossary/workflow/) ## Where it is used - [Compliance, country by country](https://assistbpo.com/compliance/) ## Next in the A to Z - [Hours bank](https://assistbpo.com/glossary/hours-bank/) - [Inbox zero](https://assistbpo.com/glossary/inbox-zero/) - [Inside sales agent](https://assistbpo.com/glossary/inside-sales-agent/) - [Intake form](https://assistbpo.com/glossary/intake-form/) [All 148 terms, A to Z](https://assistbpo.com/glossary/) Next step ## Your desk, staffed. Wherever you are. Tell us what is overloaded. A named person replies within 1 business day with a staffing plan, and we propose your assistant within 72 hours. [Get a staffing plan](https://assistbpo.com/get-a-staffing-plan/) [Book a 20-minute call](https://assistbpo.com/book-a-call/) Or call [+1-657-777-0006](tel:+16577770006) during US, UK or Australian business hours, or [hear our demo receptionist](https://assistbpo.com/demo-line/). - A named assistant proposed within 72 hours - Employed, screened and managed staff, never freelancers - Your hours, your tools, your data --- Source: https://assistbpo.com/glossary/hipaa/ · Contact: https://assistbpo.com/contact/ · Full site map for agents: https://assistbpo.com/llms.txt