HIPAA
A 1996 federal law that protects health records held by doctors, insurers and their vendors, gives you access rights, and requires notice after certain breaches.
Also called: Health Insurance Portability and Accountability Act, HIPAA privacy rule, HIPAA breach notification rule
A 1996 federal law that protects health records held by doctors, insurers and their vendors, gives you access rights, and requires notice after certain breaches.
What it means
HIPAA is the Health Insurance Portability and Accountability Act, a federal law passed in 1996. Its privacy and security rules limit how health plans, most health care providers, billing clearinghouses and their business partners use and share your protected health information. Its breach notification rule requires them to tell you when unsecured health information is exposed.
HIPAA also gives you rights. You can see and get a copy of your records, and the provider generally must respond within 30 days. If you think a covered organization broke the rules, you can file a complaint with the Department of Health and Human Services (HHS). You generally have 180 days from when you knew, or should have known, about the problem.
HHS and state attorneys general enforce HIPAA. The law has no provision that lets you sue, so lawsuits after a health data breach have to rely on other laws.
What it means for you
HIPAA matters at two moments. First, after a breach at a hospital, insurer or vendor, the organization must notify you in writing. The deadline is 60 days after it discovers the breach. That notice can point you to a class action settlement. Second, HIPAA covers only certain organizations. A medical office is covered. A wellness app or shopping site usually is not, even if it collects health details. A complaint to HHS asks the agency to investigate. It is separate from a settlement claim.
Example
Say a hypothetical clinic's billing vendor is hacked and patient files are copied. Under HIPAA the clinic must send affected patients a written notice no later than 60 days after it discovers the breach. One patient also asks the clinic for a copy of her records, and the clinic has 30 days to respond. Weeks later a class action is filed against the vendor and the clinic. HIPAA itself does not let her sue, so the case would rely on other laws.
FAQ
The law has no provision that lets individuals sue. HHS and state attorneys general enforce it. You can file a complaint with HHS, and you may have claims under other laws, so a lawyer can explain your options.
A complaint to HHS generally must be filed within 180 days of when you knew, or should have known, about the problem. HHS can waive that limit for good cause.
Related terms
- 42 U.S.C. 1320d-5: HIPAA penalties and state attorney general enforcement (Cornell LII)
- 45 CFR 164.404: notice to individuals after a breach (Cornell LII)
- 45 CFR 160.306: complaints to HHS and the 180-day limit (Cornell LII)
- 45 CFR 164.524: your right of access to records (Cornell LII)
Updated Oct 18, 2026. Plain-English definitions for general information — not legal or tax advice.