HIPAA

What it means

HIPAA is the Health Insurance Portability and Accountability Act, a US law with rules for protected health information. The main ones are the Privacy Rule, the Security Rule and the Breach Notification Rule. They apply to covered entities, such as providers and health plans, and to business associates that handle data for them.

If your software stores or processes health data for a US healthcare customer, you are probably a business associate. That means a signed agreement with the customer and a direct legal duty to protect the data, even though you are not a clinic.

Why it matters

Customers in healthcare will ask about HIPAA before they sign. A weak answer ends the deal. A breach of protected health information also triggers notification duties and can bring penalties from the US Department of Health and Human Services. Hospitals and clinics also review their suppliers each year.

The Security Rule requires a risk analysis and safeguards for electronic health data. It does not name penetration testing as a required step, but testing is a practical way to show that your access control and risk analysis hold up against a real attempt.

How it shows up

You meet it in patient portals, scheduling tools, billing systems and any API that carries records. The typical failures are plain ones: a patient ID in a URL that returns another patient's file, a staff account that can open records outside its clinic, logs that capture health details, or a missing audit log.

Check who can read what, whether data is encrypted in storage and in transit, how access is logged, and whether staff accounts can reach only the records they should. The IDOR class of flaw is the one that turns a single record request into someone else's health file.