What Is
What Is HIPAA
The Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the HITECH Act in 2009, is the main federal health privacy law. Its rules, at 45 C.F.R. parts 160 and 164, apply to covered entities (health plans, health care clearinghouses, and health care providers that conduct standard transactions electronically) and to their business associates, which handle protected health information on their behalf (45 C.F.R. 160.103).
HIPAA has three core rules:
- Privacy Rule (45 C.F.R. part 164, subpart E): limits uses and disclosures of protected health information, requires a notice of privacy practices, and gives individuals rights to access and amend their records.
- Security Rule (subpart C): requires administrative, physical, and technical safeguards for electronic protected health information.
- Breach Notification Rule (subpart D): after a breach of unsecured protected health information, notify affected individuals without unreasonable delay and within 60 days of discovery (164.404); notify prominent media outlets serving the state or jurisdiction if more than 500 residents of a state or jurisdiction are affected (164.406); and notify the Department of Health and Human Services at the same time for breaches of 500 or more, or within 60 days after year-end for smaller breaches (164.408).
The HHS Office for Civil Rights enforces HIPAA through tiered civil money penalties that rise with the violator's culpability, and the Justice Department prosecutes criminal violations (42 U.S.C. 1320d-5, 1320d-6). State attorneys general, including Texas's, may sue in federal court for injunctions or damages of up to $100 per violation, capped at $25,000 a year for identical violations, after notifying HHS (42 U.S.C. 1320d-5(d)). HIPAA gives individuals no right to sue.
On June 18, 2025, in Purl v. HHS, the Northern District of Texas vacated most of HHS's 2024 reproductive-health amendments to the Privacy Rule under the Administrative Procedure Act. As to notice-of-privacy-practices requirements, the court vacated 45 C.F.R. 164.520(b)(1)(ii)(F), (G), and (H), while leaving the other notice amendments in effect; HHS required compliance with the surviving changes by February 16, 2026. HHS did not appeal; on September 10, 2025, the proposed intervenors voluntarily dismissed their appeal.
Why it matters in Texas. Texas adds its own layer. The Texas Medical Records Privacy Act (Health and Safety Code chapter 181) uses a broader definition of covered entity that reaches many businesses HIPAA does not, and SB 1188 (chapter 183) requires electronic health records to be stored in the United States or a U.S. territory, while expressly excluding certain facility types from its covered-entity definition (§183.001(2)). HIPAA-covered entities are exempt from the Texas Data Privacy and Security Act (§541.002(b)(3)).
Pinpoint: 45 C.F.R. parts 160 and 164. Related term: HIPAA covered entity (HIPAA).