HIPAA regulatory overview
A source-led map of the HIPAA Privacy, Security, and Breach Notification Rules.
Source-led regulatory knowledge
HIPAA requirements, guidance, and tools—with their status made clear
Use primary-source citations, review metadata, and practical resources to understand the rules and organize implementation work.
Educational resource, not legal advice
Applicability depends on the organization, its role, its data, and the facts. Confirm decisions against the cited source and obtain qualified professional advice when needed.
In force
Current HIPAA requirements
HIPAA Security Rule
Primary-source orientation to the administrative, physical, and technical safeguard framework.
HIPAA Privacy Rule
Primary-source orientation to uses and disclosures of protected health information.
HIPAA Breach Notification Rule
Primary-source orientation to the federal breach notification framework.
Not current obligations
Proposed rules
No proposed-rule summaries have completed editorial review for publication. This section remains separate so proposals cannot be mistaken for current requirements.
Implementation help
Nonbinding guidance and FAQs
Security risk analysis: implementation guidance
Nonbinding HHS guidance to help teams organize a documented security risk analysis.
FAQ: What is a covered entity?
Where to begin when determining whether an organization may be subject to HIPAA.
Practical resources
Versioned toolkits
HIPAA program starter toolkit
A small, versioned set of planning resources for organizing a source-led HIPAA program.