{"entity":{"id":"hipaa","kind":"term","name":"HIPAA (Health Insurance Portability and Accountability Act)","aka":["HIPAA","HIPAA Privacy Rule","Privacy Rule","protected health information","PHI","de-identification","safe harbour de-identification","HITECH Act","HIPAA authorisation"],"tldr":"The 1996 US law whose privacy rules govern how hospitals, insurers and their contractors may use and share a patient's health records, including tumour genomics, and what must be stripped out before data can be used for research without consent.","summary":"United States, federal statute and regulations. The Health Insurance Portability and Accountability Act was signed on 21 August 1996 (Public Law 104-191). Its administrative simplification title produced the Privacy Rule (final in 2000, compliance from 2003), the Security Rule (2003) and, after the HITECH Act of 2009, breach notification and stronger enforcement. Primary text: the Department of Health and Human Services Privacy Rule page and the Congress.gov record of H.R.3103.\n\nWhat it means in cancer care: covered entities (providers, health plans, clearing houses) and their business associates may use protected health information for treatment, payment and operations without consent, but research use needs the patient's authorisation, an institutional review board waiver, or de-identification under the safe harbour (removing eighteen identifiers) or an expert determination. Genomic data are protected health information when held by a covered entity, and the 2013 Omnibus Rule confirmed that genetic information is health information. Patients have a right of access to their records, reinforced by the 21st Century Cures Act's information-blocking rules.\n\nThe arguments: HIPAA is at once criticised as an obstacle to research data sharing and as too narrow, since it does not cover consumer apps, wearables or direct-to-consumer genetic testing companies, and de-identified genomic data can in principle be re-identified. The European GDPR takes the opposite design, regulating the data wherever it goes rather than the holder.","asOf":"2026-09-17","wikipedia":"https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act","links":[{"label":"Wikipedia","url":"https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act"},{"label":"HHS: the HIPAA Privacy Rule","url":"https://www.hhs.gov/hipaa/for-professionals/privacy/index.html"},{"label":"Congress.gov: H.R.3103, HIPAA (Public Law 104-191)","url":"https://www.congress.gov/bill/104th-congress/house-bill/3103"}],"tags":["law","us"],"related":["gdpr","gina","common-rule","21st-century-cures-act","uk-data-protection-act","pipl","myriad-ruling","oncology-real-world-data","germline-testing"],"cancers":[],"sections":[],"technologies":[],"targets":[],"drugs":[],"companies":[],"institutions":[],"pathways":[],"terms":[],"trials":[],"people":[],"bottlenecks":["b-data-silos","b-real-world-evidence"],"keyPapers":[],"journals":[],"dependsOn":[],"notes":[],"category":"Regulation & policy"},"route":"/terms/hipaa/","neighbours":{"term":[{"id":"21st-century-cures-act","kind":"term","name":"21st Century Cures Act","route":"/terms/21st-century-cures-act/"},{"id":"myriad-ruling","kind":"term","name":"Association for Molecular Pathology v. Myriad Genetics (2013)","route":"/terms/myriad-ruling/"},{"id":"china-hgr-rules","kind":"term","name":"China Human Genetic Resources rules (2019, 2023)","route":"/terms/china-hgr-rules/"},{"id":"european-health-data-space","kind":"term","name":"European Health Data Space Regulation (EU) 2025/327","route":"/terms/european-health-data-space/"},{"id":"gdpr","kind":"term","name":"GDPR and health data (Regulation (EU) 2016/679)","route":"/terms/gdpr/"},{"id":"gina","kind":"term","name":"GINA (Genetic Information Nondiscrimination Act 2008)","route":"/terms/gina/"},{"id":"pipl","kind":"term","name":"PIPL (China Personal Information Protection Law 2021)","route":"/terms/pipl/"},{"id":"common-rule","kind":"term","name":"The Common Rule (45 CFR 46)","route":"/terms/common-rule/"},{"id":"uk-data-protection-act","kind":"term","name":"UK Data Protection Act 2018 and health data law","route":"/terms/uk-data-protection-act/"}],"technology":[{"id":"germline-testing","kind":"technology","name":"Germline (hereditary) testing","route":"/technologies/germline-testing/"},{"id":"oncology-real-world-data","kind":"technology","name":"Oncology EHR and real-world data platforms","route":"/technologies/oncology-real-world-data/"}],"bottleneck":[{"id":"b-data-silos","kind":"bottleneck","name":"Data silos","route":"/bottlenecks/b-data-silos/"},{"id":"b-real-world-evidence","kind":"bottleneck","name":"Weak real-world evidence and registries","route":"/bottlenecks/b-real-world-evidence/"}]}}