WASHINGTON, July 18 — The figure that matters: 1996. The Health Insurance Portability and Accountability Act — HIPAA, also called the Kennedy‑Kassebaum Act — was signed into law by President Bill Clinton on August 21, 1996. The law aimed to alter the transfer of healthcare information and stipulated guidelines to protect personally identifiable information maintained by the healthcare and healthcare insurance industries from fraud and theft.
It also addressed some limitations on healthcare insurance coverage. HIPAA generally prohibits healthcare providers and businesses called covered entities from disclosing protected information to anyone other than a patient and the patient’s authorized representatives without their consent.
The law does not restrict patients from accessing their own information, except in limited cases, nor does it prohibit patients from voluntarily sharing their health information however they choose.
By the numbers: five titles, one statute
HIPAA consists of five titles: Title I protects health insurance coverage for workers and their families if they change or lose jobs. Title II, known as Administrative Simplification, requires national standards for electronic health care transactions and national identifiers. Title III sets guidelines for pre-tax medical spending accounts. Title IV sets guidelines for group health plans. Title V governs company-owned life insurance policies. The law amended the Employee Retirement Income Security Act, the Public Health Service Act, and the Internal Revenue Code.
A common misperception is that HIPAA stops doctors from talking about a patient’s condition at all. That is false.
The law only restricts covered entities from sharing protected information with third parties without patient authorization. It does not prevent a patient from telling anyone, including the press, about their own health. Likewise, patients can always request their own medical records.
The exceptions are narrow — typically involving psychotherapy notes or information that could endanger someone — and even those have specific rules. The law was passed by the 104th United States Congress and took effect after a multi‑year rulemaking process that gave the industry time to comply with the electronic‑transaction standards.
Enforcement falls chiefly on the Department of Health and Human Services Office for Civil Rights, which investigates complaints and levies fines for violations.
Still the backbone of health privacy
HIPAA remains the primary federal privacy law for health data in the United States. It does not cover every scenario — for instance, many wearable‑device companies and health apps are not covered entities — but it set the framework that insurers and providers must follow. The five‑title structure also means changes to one part can ripple across group‑insurance plans, tax‑advantaged accounts, and the electronic back‑office systems that hospitals run.
For anyone switching jobs or enrolling in a new health plan, Title I’s portability protections remain the most immediate practical benefit: a guarantee that coverage can be kept despite a job change, without being hit by a new pre‑existing condition exclusion. Consult your doctor for medical advice.
