Public Law 104-191 (Aug. 21, 1996); Administrative Simplification rules at 45 CFR Parts 160 and 164 · Last verified
HIPAA
HIPAA is Public Law 104-191 (1996); the applicability rule in 45 CFR 160.102 and the civil penalty tiers are reproduced verbatim on this page. Enacted 21 August 1996, its Administrative Simplification rules are reproduced here in their own wording, with section numbers and links to the official text — this page does not interpret them or assess applicability.
- Citation
- Public Law 104-191 (Aug. 21, 1996); Administrative Simplification rules at 45 CFR Parts 160 and 164
- Jurisdiction
- US
- Regulator
- HHS Office for Civil Rights (Privacy and Security Rules — 65 FR 82381; 74 FR 38630)
- Last verified
What it is
Enacted 21 August 1996, its Administrative Simplification rules are reproduced here in their own wording, with section numbers and links to the official text — this page does not interpret them or assess applicability.
Health Insurance Portability and Accountability Act of 1996 ↗
Key dates
- Enacted: —
"Public Law 104-191 ... Aug. 21, 1996" (govinfo PLAW page)
- § 160.102 first published: —
amendment note: "[65 FR 82798, Dec. 28, 2000...]"
- § 160.102 last amended (Omnibus Rule): —
amendment note: "78 FR 5687, Jan. 25, 2013"
Scope
45 CFR § 160.102 — Applicability
(a) Except as otherwise provided, the standards, requirements, and implementation specifications adopted under this subchapter apply to the following entities:
(1) A health plan.
(2) A health care clearinghouse.
(3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.
(b) Where provided, the standards, requirements, and implementation specifications adopted under this subchapter apply to a business associate.
eCFR — 45 CFR Part 160 (General Administrative Requirements) ↗
Penalties
45 CFR § 160.404(b)(2)
For violations occurring on or after February 18, 2009, the Secretary may not impose a civil money penalty— (i) For a violation in which it is established that the covered entity or business associate did not know and, by exercising reasonable diligence, would not have known that the covered entity or business associate violated such provision, (A) In the amount of less than $100 or more than $50,000 for each violation; or (B) In excess of $1,500,000 for identical violations during a calendar year
45 CFR § 160.404(a)
These amounts were adjusted in accordance with the Federal Civil Monetary Penalty Inflation Adjustment Act of 1990, (Pub. L. 101-140), as amended by the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015, (section 701 of Pub. L. 114-74), and appear at 45 CFR part 102. These amounts will be updated annually and published at 45 CFR part 102.
Who is a covered entity
45 CFR § 160.103
Covered entity means: (1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.
Sources
Last verified:
This page is for information only and is not legal advice. It reproduces the regulation's own wording; always confirm against the primary source linked above and consult qualified counsel for how it applies to your organisation.