HIPAA and Health Insurance Portability

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes two distinct frameworks that shape how Americans obtain, maintain, and transition between health coverage: portability protections that limit coverage exclusions when workers change jobs, and privacy and security standards governing protected health information. Both frameworks carry federal enforcement authority and directly affect enrollment decisions, plan design, and administrative practice across employer-sponsored and individual markets. Understanding HIPAA's scope clarifies how it interacts with subsequent legislation — particularly the Affordable Care Act — and where its protections end.

Definition and scope

HIPAA, enacted as Public Law 104-191, divides into two operative titles. Title I addresses health insurance portability and group health plan reform. Title II — the Administrative Simplification title — establishes national standards for electronic health care transactions and, crucially, the Privacy Rule and Security Rule that restrict use and disclosure of protected health information (PHI).

For portability purposes, HIPAA applies to group health plans with 2 or more participants, health insurance issuers offering group coverage, and health maintenance organizations (HHS HIPAA Overview). Individual market plans and grandfathered plans carry different obligations. Self-funded employer plans that fall under ERISA must comply with HIPAA's portability provisions; the interaction of those two federal statutes is addressed in the companion page on ERISA and employer plan regulation.

The Privacy Rule, codified at 45 CFR Parts 160 and 164, covers "covered entities" — health plans, health care clearinghouses, and health care providers that transmit PHI electronically — and their "business associates." A health insurer processing a claim is a covered entity; a third-party billing firm handling that data is a business associate and faces direct liability under the HITECH Act amendments of 2009.

How it works

HIPAA's portability mechanism operates through a certification of creditable coverage. When an individual leaves a group health plan, the prior plan must provide a certificate documenting the length of continuous coverage (45 CFR § 146.115). A new group health plan may impose a pre-existing condition exclusion period of no more than 12 months (18 months for late enrollees), but that period must be reduced by the individual's prior creditable coverage — effectively eliminating the exclusion for workers who maintained continuous coverage.

The Privacy Rule functions through four operational requirements:

1. Notice of Privacy Practices (NPP): Covered health plans must furnish enrollees with a written NPP describing how PHI is used and disclosed, individual rights, and the plan's legal duties.
2. Minimum necessary standard: Disclosures of PHI must be limited to the minimum information needed to accomplish the intended purpose.
3. Authorization requirements: Most uses and disclosures beyond treatment, payment, and health care operations require a signed, specific authorization from the individual.
4. Individual rights: Enrollees hold rights to access their own records, request amendments, receive an accounting of disclosures, and request restrictions on certain uses.

The Security Rule applies specifically to electronic PHI (ePHI) and requires covered entities to implement administrative, physical, and technical safeguards. Penalty tiers under HIPAA range from $100 to $50,000 per violation, with an annual cap of $1.9 million per violation category (HHS Civil Money Penalties).

Common scenarios

Job change with no coverage gap: A worker covered for 18 consecutive months under an employer's plan changes jobs. The certificate of creditable coverage eliminates any pre-existing condition exclusion the new employer's plan might otherwise apply. The plan enrollment decision — whether to choose an HMO, EPO, or high-deductible plan — turns on cost and network factors, not medical history gating. The HMO Authority reference site documents how managed care structures handle incoming enrollees and what network credentialing means for continuity of specialist care.

COBRA gap and portability clock: An individual elects COBRA after leaving a job, maintains coverage for 8 months, then allows it to lapse before enrolling in a new group plan. The 8-month COBRA period counts as creditable coverage, reducing the exclusion window from 12 months to 4 months. The gap of more than 63 days, however, breaks the creditable coverage chain under 45 CFR § 146.113, resetting the clock. The companion page on pre-existing conditions and guaranteed issue covers how the ACA later eliminated pre-existing condition exclusions in most markets, making the HIPAA portability mechanism largely superseded for ACA-compliant individual and group coverage.

PHI breach and notification: A health insurer's business associate suffers a ransomware incident affecting 600 enrollee records. Under the Breach Notification Rule (45 CFR §§ 164.400–414), the covered entity must notify affected individuals within 60 days and, because the breach affects fewer than 500 residents of any single state, report to HHS on an annual log rather than immediately. For those evaluating plan types with significant data-handling differences, the EPO Authority resource examines how exclusive provider organization plans administer claims within closed networks, which affects how and where PHI flows.

Decision boundaries

HIPAA's portability protections operate differently depending on market segment:

For individuals selecting high-deductible health plans paired with health savings accounts, portability rules interact with HSA eligibility determinations. The HDHP Authority site provides structured analysis of how prior coverage types affect HSA contribution eligibility — a distinct but frequently confused question from HIPAA portability rights.

The Privacy Rule does not follow individuals across all data contexts. Wearable device data, consumer health apps, and employer wellness platforms that do not involve a covered entity are not HIPAA-regulated, even if the data is health-related. State breach notification laws and the FTC Act fill portions of that gap.

The broader regulatory landscape for health insurance — including ACA requirements, state insurance department roles, and rate review processes — is mapped across the National Health Insurance Authority resource hub, which aggregates federal and state framework analysis across plan types and market segments.

References

• U.S. Department of Health and Human Services — HIPAA for Professionals
• Public Law 104-191, Health Insurance Portability and Accountability Act of 1996
• 45 CFR Parts 160 and 164 — HIPAA Privacy and Security Rules (eCFR)
• 45 CFR Part 146 — Requirements for the Group Health Insurance Market (eCFR)
• HHS HITECH Act Enforcement Interim Final Rule
• HHS Civil Money Penalties and Settlement Information
• HHS Breach Notification Rule — 45 CFR §§ 164.400–414

The law belongs to the people. Georgia v. Public.Resource.Org, 590 U.S. (2020)