On this page
HIPAA stands for the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, which became law on August 21, 1996 (Public Law 104-191). It is the federal law behind the HIPAA Privacy, Security and Breach Notification Rules, which protect health information held by health plans, health care clearinghouses, health care providers that conduct standard transactions electronically, and their business associates (HHS; HHS). Curve Compliance, a marketing and website tracking service for healthcare that signs a BAA on every plan, checked the law's text and HHS's pages on November 2, 2026.
Book a call. Need to know what HIPAA means for your ads? Curve Compliance handles the marketing and website tracking side: it strips PHI before data reaches an ad platform, sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What HIPAA stands for
Each letter is one word of the law's short title, set out in section 1 of Public Law 104-191 (govinfo): H for Health, I for Insurance, P for Portability, A for Accountability and A for Act. The law has five titles. The table lists them by their headings in the law's table of contents.
| Title | Heading in the law | What it covers |
|---|---|---|
| I | Health Care Access, Portability, and Renewability | Group and individual health insurance rules, including “Increased portability through limitation on preexisting condition exclusions” (govinfo) |
| II | Preventing Health Care Fraud and Abuse; Administrative Simplification; Medical Liability Reform | Fraud and abuse control, and Subtitle F, Administrative Simplification, the source of the privacy and security rules (govinfo) |
| III | Tax-Related Health Provisions | Medical savings accounts and the deduction for health insurance costs of self-employed people (govinfo) |
| IV | Application and Enforcement of Group Health Plan Requirements | How the group health plan rules are applied and enforced (govinfo) |
| V | Revenue Offsets | Revenue provisions, starting with company-owned life insurance (govinfo) |
For marketers, the part that matters is Title II, Subtitle F. That is where Congress asked for national standards for electronic health information and for privacy protections, which HHS later wrote as the HIPAA Rules.
HIPAA or HIPPA: the right spelling
The right spelling is HIPAA: one P for Portability, then two As for Accountability and Act. HIPPA is a common misspelling. People sometimes assume one P stands for privacy, but it does not. The word privacy is not in the law's name at all. The privacy protections came later, through rules HHS wrote under the law.
What the 1996 law set out to do
The law's long title lists its aims: “to improve portability and continuity of health insurance coverage in the group and individual markets, to combat waste, fraud, and abuse in health insurance and health care delivery, to promote the use of medical savings accounts, to improve access to long-term care services and coverage, to simplify the administration of health insurance, and for other purposes” (govinfo).
Section 261 gives the purpose of the Administrative Simplification subtitle: to improve Medicare, Medicaid and the health care system “by encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information” (govinfo). Section 264 handled privacy. If Congress did not pass privacy legislation within 36 months, HHS “shall promulgate final regulations containing such standards” (govinfo). Congress did not, so HHS did (HHS). The HIPAA history and timeline covers what happened next.
The HIPAA Rules written under it
HHS lists the rules that came out of the law (HHS):
- Privacy Rule. Published as a final rule in December 2000 and modified in August 2002. Compliance was required as of April 14, 2003 (April 14, 2004, for small health plans) (HHS).
- Security Rule. Published as a final rule in February 2003. Compliance was required as of April 20, 2005 (April 20, 2006 for small health plans) (HHS).
- Enforcement Rule. Standards for the enforcement of all the Administrative Simplification Rules (HHS).
- Omnibus Rule. A final rule that implements a number of HITECH Act provisions and finalized the Breach Notification Rule (HHS).
See the five HIPAA rules explained, the HIPAA Privacy Rule for marketers and the Omnibus Rule for marketers.
Who HIPAA applies to
The HIPAA Rules apply to covered entities and their business associates. A covered entity is a health plan, a health care clearinghouse, or a health care provider who transmits health information electronically in connection with a covered transaction (45 CFR 160.103). A business associate handles PHI on a covered entity's behalf. HHS is direct about everyone else: “If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules” (HHS).
That test decides whether a med spa, a cash-pay telehealth brand or an agency is in scope. See what a covered entity is, does HIPAA apply to cash-pay telehealth and what HIPAA compliance means in practice.
What HIPAA means for websites and ads
Under the Privacy Rule, “a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing,” with narrow exceptions (45 CFR 164.508). HHS's guidance on tracking applies that to websites: “disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures” (HHS).
So a covered entity's site has to watch what its pixels and tags send to ad platforms, especially from booking pages, forms and patient logins. HHS also notes that on June 20, 2024 a federal court vacated the part of that guidance covering IP addresses tied to visits to unauthenticated public pages about specific health conditions or providers (HHS). Where your pages fall depends on your setup, so talk to your counsel. See HIPAA marketing authorization and ad tracking and what counts as PHI on a website.
Related terms: PHI, ePHI, IIHI, BAA and more
HIPAA comes with its own shorthand. Definitions are from 45 CFR 160.103 (eCFR) unless the row says otherwise.
| Term | Stands for | Meaning in one line | Read more |
|---|---|---|---|
| PHI | Protected health information | Individually identifiable health information transmitted or maintained in any form or medium, with some exclusions | PHI meaning |
| ePHI | Electronic protected health information | PHI transmitted by or maintained in electronic media | What is ePHI? |
| IIHI | Individually identifiable health information | Health information that identifies a person, or could reasonably be used to | What is IIHI? |
| BAA | Business associate agreement | The written contract a covered entity must have with a business associate (HHS) | What is a BAA? |
| OCR | Office for Civil Rights | The HHS office that enforces the Privacy and Security Rules (HHS) | Who enforces HIPAA? |
How Curve Compliance helps
Curve Compliance works on the marketing and website tracking part of HIPAA. Curve replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok.
Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted. Curve is SOC 2 Type II and signs a BAA on every plan (BAA Directory entry). Curve's team does the setup, typically live in about a week. To see which trackers your site loads today, run the free website scan.
Sources, checked November 2, 2026: Public Law 104-191 (govinfo); HHS, HIPAA for Professionals; HHS, Summary of the HIPAA Privacy Rule; HHS, Covered Entities and Business Associates; HHS, HIPAA Enforcement; HHS, HIPAA Enforcement Highlights; HHS, Marketing; HHS, Use of Online Tracking Technologies; 45 CFR 160.103; 45 CFR 164.508; 90 FR 898.
Frequently Asked Questions
What does HIPAA stand for?
HIPAA stands for the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (govinfo). It is the federal law behind the HIPAA Privacy, Security and Breach Notification Rules (HHS).
Is it HIPAA or HIPPA?
HIPAA. There is one P, for Portability, and two As, for Accountability and Act; HIPPA is a misspelling.
What does HIPAA protect?
Through the Privacy Rule, it protects “individually identifiable health information” held or transmitted by a covered entity or its business associate, “in any form or media, whether electronic, paper, or oral” (HHS). Title I of the law also limits preexisting condition exclusions in health coverage (govinfo).
Who enforces HIPAA?
HHS's Office for Civil Rights “is responsible for enforcing the Privacy and Security Rules” (HHS), and it refers some criminal cases to the Department of Justice (HHS). See who enforces HIPAA.
Does HIPAA apply to marketing?
Yes, for covered entities. HHS says “With limited exceptions, the Rule requires an individual's written authorization before a use or disclosure of his or her protected health information can be made for marketing” (HHS). That includes PHI sent to ad platforms through tracking tools (HHS).
When was HIPAA enacted?
HIPAA became law on August 21, 1996 (govinfo). See HIPAA history for the rules that followed.
What is the new HIPAA rule in 2026?
One headline change, HHS's proposed Security Rule update, was published in the Federal Register on January 6, 2025 (Federal Register). On November 2, 2026 the Federal Register still lists only that proposal under its rulemaking, so it is not yet in force; see new HIPAA rules for 2026.
Talk to Curve Compliance
Book a call. Want your ad tracking to fit HIPAA without losing conversions? Curve Compliance strips PHI before data reaches an ad platform, sends conversions server-side and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.