Health Insurance Portability and Accountability Act

Protected Health Information (PHI) is any individually identifiable health information—including medical records, test results, billing details, and more—that is created, received, or maintained by a covered entity or business associate. PHI covers both electronic and paper records and includes data that relates to an individual’s physical or mental health, care provided, or payment for care. PHI must be protected against unauthorized access, disclosure, or use.

• Covered Entity: Any healthcare provider, health plan, or healthcare clearinghouse that handles PHI as part of its core operations.
• Business Associate: Any organization or individual that provides services to, or performs functions for, a covered entity involving access to PHI (such as cloud providers, billing companies, or IT consultants).

The HIPAA Privacy Rule sets the national standards for how PHI must be protected, used, and disclosed. It gives individuals rights over their health information and defines when PHI can be shared—with or without patient consent—balancing privacy with the need to support healthcare delivery and operations.

A Business Associate Agreement (BAA) is a legally required contract between a covered entity and a business associate (such as a cloud provider) that describes each party’s responsibilities for safeguarding PHI. The BAA defines permitted uses and disclosures of PHI, required security measures, breach notification procedures, and more.