Life and Health Insurance · Accident and Health Insurance · 6 min read
HIPAA Privacy and Portability
- Identify HIPAA covered entities, business associates, and the core rules governing Protected Health Information disclosure, individual privacy rights, and security safeguards.
- Explain HIPAA group health plan portability requirements, special enrollment triggers, and nondiscrimination standards based on health status factors.
- Contrast historical HIPAA preexisting condition and creditable coverage rules with the protections established under the Affordable Care Act.
HIPAA Privacy Rule and Protected Health Information
HIPAA stands for the Health Insurance Portability and Accountability Act of 1996. The law contains federal standards designed to improve health insurance portability, access, and administrative simplification. One major component of this law is the HIPAA Privacy Rule, which establishes national standards to protect individuals' medical records and other personal health information.
The Privacy Rule centers on Protected Health Information, often abbreviated as PHI. PHI includes individually identifiable health information held or transmitted by a covered entity or its business associate. Individually identifiable health information relates to an individual's past, present, or future physical or mental health, the provision of healthcare, or the payment for healthcare services.
HIPAA applies directly to covered entities, which include health plans, healthcare clearinghouses, and healthcare providers that transmit health information electronically in connection with covered transactions. A business associate is a person or organization that performs certain functions or activities involving Protected Health Information on behalf of a covered entity. Covered health plans generally must provide a Notice of Privacy Practices, subject to exceptions for certain group health plans; covered healthcare providers with direct treatment relationships generally must provide one to their patients.
Individuals hold specific legal rights concerning their records. Patients have the legal right to inspect and obtain copies of their PHI in designated record sets. They also have the right to request amendments to their health records if they believe information is inaccurate or incomplete, the right to request reasonable restrictions on how their information is used or disclosed, and the right to receive an accounting of certain disclosures of their PHI made by a covered entity.
Common mistakes
- Thinking voluntary cancellation of insurance triggers a HIPAA special enrollment period. Loss of eligibility for other coverage is one special enrollment trigger; exhaustion of COBRA coverage, an employer's cessation of contributions, and acquiring a dependent can also trigger special enrollment, while voluntarily dropping coverage or failing to pay premiums generally does not.
- Applying the minimum necessary standard to treatment discussions between healthcare providers. While the minimum necessary rule applies to billing, operations, and insurance requests, it explicitly does not apply to disclosures made to providers for treatment purposes.
- Confusing the 30-day and 60-day special enrollment windows. Marriage, birth, adoption, and general loss of coverage carry a minimum window of at least 30 days, whereas Medicaid or CHIP coverage loss or premium assistance eligibility grants at least 60 days.
- Assuming certificates of creditable coverage are still required to reduce preexisting condition exclusion periods. The Affordable Care Act eliminated preexisting condition exclusions in group health plans and non-grandfathered individual plans, which removed the need for certificates of creditable coverage for that purpose.
Key points
- HIPAA establishes federal standards designed to improve health insurance portability, access, and administrative simplification, including national standards under the Privacy Rule to safeguard Protected Health Information.
- Covered entities include health plans, healthcare clearinghouses, and healthcare providers transmitting electronic health transactions; business associates are outside entities performing services involving PHI on their behalf.
- PHI may be used or disclosed without individual authorization for treatment, payment, and healthcare operations and for other purposes HIPAA permits or requires, such as certain public health disclosures; uses or disclosures that lack another HIPAA basis generally require a valid authorization.
- The minimum necessary rule requires covered entities to limit PHI disclosures to the minimum required for the task, but this restriction does not apply to treatment disclosures among providers.
- The HIPAA Security Rule requires covered entities and business associates to safeguard electronic PHI; following a reportable breach of unsecured PHI, a covered entity generally must notify affected individuals, while its business associate must notify the covered entity.
- HIPAA special enrollment rules generally allow at least 30 days to request enrollment after acquiring a dependent or a qualifying loss of other coverage, and at least 60 days after losing Medicaid or CHIP eligibility or becoming eligible for Medicaid or CHIP premium assistance.
- While historical HIPAA rules permitted 12-month or 18-month preexisting condition exclusions that could be reduced by creditable coverage, the Affordable Care Act banned preexisting condition exclusions in group health plans and non-grandfathered individual plans.
Practice this section
Explained Accident and Health Insurance questions, no account needed. Accident and Health Insurance practice test
The full lesson continues with 4 more sections with exam tips, audio in English and Spanish, 5 Check yourself questions and 20 flashcards.
- 1 month
$53.99$26.99 - 3 months
$158.99$79.49 - Lifetime
$323.99$161.99
One payment, no subscription.
See Life and Health plansAlready a member? Log in
Sample lesson: Risk and Insurable Losses in Health Insurance25 practice questions on this exam
Each Life and Health practice test has 25 original questions with the answers explained. No account needed.
Open the Life and Health practice testsOriginal lesson written for Life and Health Insurance practice · updated October 29, 2026. Exam names are trademarks of their owners; tests.global is not affiliated with them.