Health Insurance Portability and Accountability Act - U.S. legislation providing data privacy and security provisions for safeguarding medical information
HIPAA
HIPAA, the Health Insurance Portability and Accountability Act of 1996, is the U.S. law that sets the baseline for how protected health information (PHI) must be kept private and secure. For anyone building an API that touches patient data, its Privacy Rule and Security Rule are not optional guidance — they are the legal contract that governs who may access data, how it must be transmitted, and what has to be logged when it moves.
- Privacy Rule - Defines what counts as protected health information and the conditions under which it may be used or disclosed.
- Security Rule - Requires administrative, physical, and technical safeguards — access control, encryption in transit, and audit trails — for electronic PHI.
- Right of access - Gives patients a legal right to obtain their own records, a right increasingly fulfilled through APIs.
- Business Associate Agreements - Extends compliance obligations to any vendor, cloud provider, or API partner that handles PHI on a covered entity’s behalf.
In real API operations, HIPAA is what turns healthcare integration into a governance problem as much as an engineering one — it dictates authentication, authorization, encryption, and auditability long before you get to the shape of an HL7 v2 message or FHIR resource. When I score healthcare providers, a clear HIPAA posture and a signed BAA are prerequisites, and as agents begin to read and act on health data, HIPAA’s access and audit requirements become the guardrails that decide what an autonomous system is even allowed to do.
Referenced on the API Evangelist blog
Where this standard shows up across sixteen years of my writing at apievangelist.com — how it fits into API design, governance, and the agentic turn.
