The Office for Civil Rights (OCR), part of the Department of Health and Human Services (HHS), closed out 2025 with one of its most active enforcement years on record. OCR ended 2025 with 21 settlements and civil monetary penalties, the second-highest annual total on record. HIPAA Journal's tracking of federal penalties shows enforcement activity increased again this year. Many of those cases involved ordinary business failures: a missing risk analysis, a slow breach response, a vendor contract that never got signed.
This article surveys the three core HIPAA laws that govern day-to-day compliance for any organization touching patient data: the Privacy Rule, the Security Rule, and the Breach Notification Rule. Each one covers a distinct stage of the information lifecycle, and together they make up the bulk of the HIPAA laws and regulations that a business owner actually needs to understand. The goal here is a business-level map of what each rule demands, not a legal treatise.
What Are HIPAA Laws and Regulations?
HIPAA regulations apply to two categories of organizations. The HIPAA Rules apply to covered entities and business associates, and individuals, organizations, and agencies that meet the definition of a covered entity must comply with the Rules to protect the privacy and security of health information. A covered entity generally means a health care clearinghouse, a health plan, or a health care provider who carries out HIPAA-covered electronic transactions.
Business associates extend that reach further. Under the Health Information Technology for Economic and Clinical Health (HITECH) Act, the Privacy Rule also governs business associates. A business associate is an entity that performs work on behalf of a covered entity involving the use or disclosure of protected health information. A software vendor hosting patient records, a billing contractor, or a cloud platform processing claims data typically falls into this category. A covered entity must put a written business associate agreement in place before sharing protected health information with such a vendor.
The HIPAA Privacy Rule: Controlling Use and Disclosure
The Privacy Rule sets boundaries on how protected health information moves. As a general matter, the Rule prohibits using or disclosing protected health information except as the Rule expressly permits or requires. Outside of treatment, payment, and a short list of other permitted purposes, a patient's written authorization becomes necessary before information changes hands.
The Privacy Rule also grants patients enforceable rights, including the right to access and obtain copies of their own records. OCR treats this obligation seriously: its Right of Access enforcement initiative has produced more than 54 settlements since 2019, a pace that shows no sign of slowing. A delayed response to a routine records request can turn into a federal investigation.
The HIPAA Security Rule: Safeguarding Electronic Health Data
Where the Privacy Rule governs the “what,” the Security Rule governs the “how” for data in electronic form. The Security Rule establishes national standards to protect electronic protected health information created, received, used, or maintained by a covered entity or its business associate. It requires administrative, physical, and technical safeguards to protect confidentiality, integrity, and availability.
Those three safeguard categories break down roughly as follows:
- Administrative safeguards: security management policies, workforce training, and incident response procedures
- Physical safeguards: facility access controls, workstation protections, and device and media handling
- Technical safeguards: access controls, audit logging, authentication, and transmission security
The rule is intentionally flexible rather than prescriptive. Because the health care marketplace is diverse, the Security Rule is designed to be flexible, scalable, and technology neutral, allowing an organization to implement measures appropriate to its size and risks.
Why a HIPAA Risk Assessment Comes First
Every other safeguard decision under the Security Rule traces back to one step: the risk analysis. The Security Rule requires a risk analysis under 45 CFR 164.308(a)(1)(ii)(A). It serves as the foundation of every compliance program and must be conducted and documented on a regular basis. A HIPAA risk assessment identifies where electronic health data lives, who can reach it, and where current protections fall short.
HHS does not mandate a single methodology for this process. Official guidance states that the rule does not prescribe a specific risk analysis methodology, leaving room for a smaller practice and a large health system to take different but equally defensible approaches. What OCR does expect is evidence of a thorough, accurate, and current analysis. By the end of May 2025, OCR had announced ten additional financial penalties tied to its Risk Analysis Initiative. The initiative targets organizations that never completed a required security risk assessment. Skipping this step remains one of the most common and most costly compliance gaps.
The HIPAA Breach Notification Rule: What Happens After an Incident
The HIPAA Breach Notification Rule, found at 45 CFR 164.400 through 414, requires covered entities and business associates to notify affected parties following a breach of unsecured protected health information. The obligations split into three tracks, each running on its own clock:
- Affected individuals: notice without unreasonable delay, and no later than 60 calendar days after discovering the breach
- HHS: for breaches affecting 500 or more individuals, notification must occur within 60 days; smaller breaches are reported annually, within 60 days of the end of the calendar year
- Media outlets: required when a breach involves unsecured protected health information of more than 500 individuals in a given state or jurisdiction
Business associates face their own notification deadline under the Breach Notification Rule. A business associate that discovers a breach must notify the covered entity within 60 days under 45 CFR 164.410, after which the covered entity handles outward notification. A vendor that sits on a known incident, even briefly, creates liability that extends well past its own contract.
What Do HIPAA Violations Cost a Business?
Civil penalties follow a four-tier structure based on culpability, adjusted periodically for inflation. For penalties assessed from January 2026 onward, Tier 1 runs from $145 to $73,011 per violation with an annual cap of $2,190,294; Tier 2 is $1,461 to $73,011; Tier 3 is $14,602 to $73,011; and Tier 4 is $73,011 to $2,190,294, with the same annual cap.
These numbers are not limited to hospitals and insurers. In February 2025, eyewear retailer Warby Parker received a $1,500,000 civil money penalty from OCR tied to Security Rule failures following a hacking incident. The case is a reminder that any company holding electronic health data sits inside OCR's jurisdiction regardless of industry label.
A Major Security Rule Update Is Still Pending
A substantial rewrite of the Security Rule has been in motion since early 2025 but has not taken effect. OCR proposed an update to the HIPAA Security Rule in January 2025 and initially targeted a May 2026 release. That date has since slipped by a year to July 2027, according to HIPAA Journal's regulatory tracking. Until a final rule publishes, the current Security Rule stays fully in force, and OCR continues citing it in every resolution agreement. Treating the proposal as a planning signal, rather than an active deadline, keeps compliance priorities grounded in what currently carries legal weight.
HIPAA compliance rewards organizations that treat these three rules as one connected system rather than three separate checklists. A sound risk assessment informs the safeguards the Security Rule expects. Strong Privacy Rule practices reduce the odds of a reportable incident. A tested breach response plan keeps the Breach Notification Rule's short deadlines from becoming a second crisis. Working through each rule with an experienced compliance partner, rather than piecing together guidance from multiple vendor blogs, tends to produce a program that holds up under an actual OCR inquiry.
Planet 9 is a Bay Area cybersecurity consulting firm specializing in HIPAA readiness for SMBs in healthcare and health technology. Our vCISOs and compliance managers help organizations choose the right approach, configure GRC tools if needed, and get audit-ready without wasted time.
