HIPAA

US health-data privacy and security law. The Security Rule sets administrative, physical, and technical safeguards for ePHI; the Breach Notification Rule triggers HHS, media, and affected-individual reporting past the 500-record threshold; and the Privacy Rule governs uses and disclosures. Covered entities and business associates are both bound, with BAA chains extending accountability downstream. Attention spikes on ransomware affecting unencrypted ePHI and on a failed risk analysis under 45 CFR 164.308(a)(1)(ii)(A).

/hipaa