On this page
HIPAA was enacted on August 21, 1996, when the Health Insurance Portability and Accountability Act became Public Law 104-191 (govinfo). Congress passed it to make health coverage portable, fight fraud and simplify health care administration. The privacy and security rules marketers deal with today came later, as HHS regulations under the law, starting with the Privacy Rule's compliance date of April 14, 2003 (HHS). Curve Compliance, a marketing and website tracking service for healthcare that signs a BAA on every plan, checked every date below on govinfo, HHS and the Federal Register on November 2, 2026.
Book a call. The rules that grew out of this history now reach the tracking code on clinic websites. Curve Compliance handles that marketing and website tracking part: it strips PHI before data reaches an ad platform, sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.
Why HIPAA was created
The law's long title sets out its aims: “to improve portability and continuity of health insurance coverage in the group and individual markets, to combat waste, fraud, and abuse in health insurance and health care delivery,” to promote medical savings accounts, to improve access to long-term care, and “to simplify the administration of health insurance” (govinfo).
HHS explains the part that matters most today. The law “included Administrative Simplification provisions that required HHS to adopt national standards for electronic health care transactions and code sets, unique health identifiers, and security.” Then: “At the same time, Congress recognized that advances in electronic technology could erode the privacy of health information” (HHS). Moving health records and claims onto computers made them easier to share, so the same law that pushed electronic transactions also called for privacy protections.
Congress gave itself a deadline. Under section 264, if privacy legislation was not enacted within 36 months, HHS “shall promulgate final regulations containing such standards” (govinfo). HHS's summary of what followed: “Because Congress did not enact privacy legislation, HHS developed a proposed rule and released it for public comment on November 3, 1999” (HHS). For what each letter of the name means, see what HIPAA stands for.
Timeline: 1996 to 2026
Each row comes from the law itself, HHS or the Federal Register, opened November 2, 2026.
| Date | What happened | Source |
|---|---|---|
| August 21, 1996 | HIPAA becomes Public Law 104-191 | govinfo |
| November 3, 1999 | HHS releases a proposed Privacy Rule for public comment | HHS |
| December 28, 2000 | Final Privacy Rule published (65 FR 82462); a correction published February 26, 2001 set its effective date as April 14, 2001 (66 FR 12434) | Federal Register; Federal Register |
| August 14, 2002 | Privacy Rule modifications published (67 FR 53182) | Federal Register |
| February 20, 2003 | Final Security Rule published (68 FR 8334) | Federal Register |
| April 14, 2003 | Privacy Rule compliance required (April 14, 2004, for small health plans) | HHS |
| April 20, 2005 | Security Rule compliance required (April 20, 2006 for small health plans) | HHS |
| February 16, 2006 | Final Enforcement Rule published (71 FR 8390) | HHS; Federal Register |
| February 17, 2009 | HITECH Act signed into law as part of the American Recovery and Reinvestment Act of 2009 | HHS |
| July 27, 2009 | HHS's Office for Civil Rights becomes responsible for enforcing the Security Rule | HHS |
| August 24, 2009 | Breach Notification interim final rule published (74 FR 42740), effective September 23, 2009 | Federal Register |
| January 25, 2013 | Omnibus Rule published (78 FR 5566), effective March 26, 2013 | Federal Register |
| June 20, 2024 | A federal court vacates part of HHS's online tracking guidance | HHS |
| January 6, 2025 | Proposed Security Rule update published (90 FR 898) | Federal Register |
| June 18, 2025 | A federal court vacates most of the 2024 reproductive health care privacy rule | HHS |
The Privacy Rule and its 2003 compliance date
HHS published the final Privacy Rule in December 2000 and modified it in August 2002. It “set national standards for the protection of individually identifiable health information by three types of covered entities: health plans, health care clearinghouses, and health care providers who conduct the standard health care transactions electronically” (HHS). HHS says “Enforcement of the Privacy Rule began April 14, 2003 for most HIPAA covered entities” (HHS).
Since that compliance date, HHS reports that its Office for Civil Rights “has received over 374,321 HIPAA complaints,” in results as of October 31, 2024 (HHS). The Privacy Rule is also where marketing rules live, including the authorization requirement for marketing. See the HIPAA Privacy Rule for marketers.
The Security Rule
HHS published the final Security Rule in February 2003. It “sets national standards for protecting the confidentiality, integrity, and availability of electronic protected health information,” and compliance was required as of April 20, 2005 (HHS). HHS's Office for Civil Rights “became responsible for enforcing the Security Rule on July 27, 2009” (HHS). For the three kinds of safeguards it requires, see HIPAA safeguards: administrative, physical and technical.
HITECH and the 2013 Omnibus Rule
The HITECH Act “was signed into law on February 17, 2009, to promote the adoption and meaningful use of health information technology,” and its Subtitle D “addresses the privacy and security concerns associated with the electronic transmission of health information” (HHS). HITECH also made business associates directly accountable: HHS says “business associates are civilly and criminally liable for penalties” for violating the Security Rule provisions that now apply to them (HHS).
HHS issued the Breach Notification interim final rule in August 2009 (Federal Register), then folded HITECH's changes into the Omnibus Rule, which modified the Privacy, Security and Enforcement Rules and the Breach Notification Rule. It took effect March 26, 2013 (Federal Register). See what the HITECH Act changed, the Omnibus Rule for marketers and the Breach Notification Rule.
Online tracking guidance and the 2024 court ruling
The newest chapter is about websites. HHS's guidance on tracking technologies says “disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures” (HHS). On June 20, 2024, a federal court in Texas vacated the guidance “to the extent it provides that HIPAA obligations are triggered” when a tool connects an IP address with a visit to an unauthenticated public page about specific health conditions or providers. HHS's page adds: “HHS is evaluating its next steps in light of that order” (HHS).
What that leaves in place for your site depends on your pages and setup, so talk to your counsel. For the line-by-line reading, see the HHS tracking bulletin after AHA v. Becerra.
What may change next
HHS says that on December 27, 2024 it “issued a proposed rule to improve cybersecurity” by updating the Security Rule (HHS). The proposal was published in the Federal Register on January 6, 2025, with comments due by March 7, 2025 (Federal Register). On November 2, 2026 the Federal Register still lists only that proposal under its rulemaking, so it is not in force. The same HHS page reports that on June 18, 2025 a court vacated most of the 2024 reproductive health care privacy rule, while the remaining notice of privacy practices changes stay in effect (HHS). See new HIPAA rules for 2026 for what is final, proposed and pending.
How Curve Compliance helps
HIPAA began as an insurance and paperwork law, and its privacy rules now reach the tracking code on clinic websites. Curve Compliance works on that marketing and website tracking part. Curve replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok.
Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Curve is SOC 2 Type II and signs a BAA on every plan (BAA Directory entry). Curve's team does the setup, typically live in about a week. To see what your site loads today, run the free website scan.
Sources, checked November 2, 2026: Public Law 104-191 (govinfo); HHS, HIPAA for Professionals; HHS, Summary of the HIPAA Privacy Rule; HHS, Summary of the HIPAA Security Rule; HHS, HIPAA Enforcement; HHS, HIPAA Enforcement Highlights; HHS, The HIPAA Enforcement Rule; HHS, HITECH Act Enforcement Interim Final Rule; HHS, Regulatory Initiatives; HHS, Use of Online Tracking Technologies; Federal Register: 65 FR 82462, 66 FR 12434, 67 FR 53182, 68 FR 8334, 71 FR 8390, 74 FR 42740, 78 FR 5566, 90 FR 898.
Frequently Asked Questions
When was HIPAA enacted?
HIPAA was enacted on August 21, 1996, as Public Law 104-191 (govinfo). HHS says enforcement of its Privacy Rule began April 14, 2003 for most covered entities (HHS).
What is the purpose of HIPAA?
The law's long title lists improving “portability and continuity of health insurance coverage,” combating waste, fraud and abuse, and simplifying the administration of health insurance (govinfo). Its Administrative Simplification provisions led to the Privacy and Security Rules, and the Breach Notification Rule was finalized later under the 2009 HITECH Act (HHS).
Why is HIPAA important?
Its Privacy Rule “establishes, for the first time, a set of national standards for the protection of certain health information” (HHS). For marketers, those standards decide what a covered entity's website may send to ad platforms (HHS).
When did the HIPAA Privacy Rule take effect?
The final rule was published December 28, 2000 (Federal Register), and a correction set its effective date as April 14, 2001 (66 FR 12434). Compliance was required as of April 14, 2003, or April 14, 2004 for small health plans (HHS).
When did the HIPAA Security Rule take effect?
HHS published it in February 2003, and compliance was required as of April 20, 2005, or April 20, 2006 for small health plans (HHS).
Is the correct spelling HIPAA or HIPPA?
HIPAA. The letters stand for Health Insurance Portability and Accountability Act, so there is one P and two As; see HIPAA meaning.
What is the new HIPAA rule in 2026?
One headline change, HHS's proposed Security Rule update, was published in the Federal Register on January 6, 2025 (Federal Register). On November 2, 2026 the Federal Register still lists only that proposal under its rulemaking; see new HIPAA rules for 2026.
Talk to Curve Compliance
Book a call. Want your website tracking to fit today's HIPAA rules? Curve Compliance strips PHI before data reaches an ad platform, sends conversions server-side and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.