The Health Insurance Portability and Accountability Act of 1996, which has two sections. Title I allows people who change or lose their jobs to continue their health insurance coverage. Title II is what people usually mean when they refer to HIPAA: the federal law that provides uniform baseline privacy and security standards to protect patients' medical records and other health information provided to health plans, doctors, hospitals and other health care providers. The regulations that the Department of Health and Human Services developed to implement the law also give patients access to their medical records and some control over how their personal health information is used and disclosed. HIPAA does not pre-empt state laws that provide stronger protections. HIPAA took effect on April 14, 2003. HIPAA is feared but poorly understood. From a privacy perspective, it could be more accurately described as a disclosure law than one that protects information.

The HIPAA regulations have two parts: the HIPAA Privacy Rule and the HIPAA Security Rule. The Privacy Rule covers all protected health information (PHI), whether it’s in paper or electronic format. The Security Rule applies only to PHI in electronic format. The Privacy Rule and the Security Rule both set baseline standards for protection of the information they cover.