What Counts as PHI
Any health information tied to an individual and maintained or transmitted by a covered entity or business associate is PHI. Employers sponsoring self-funded health plans must ensure HR teams, brokers, and administrators only access PHI for plan administration purposes.
Core Compliance Pillars
- Administrative safeguards: Document policies for minimum necessary access, workforce training, and breach response.
- Physical safeguards: Secure paper files, restrict server rooms, and control workstation access.
- Technical safeguards: Use encryption, role-based access controls, and audit logs for all PHI systems.
2026 Action Plan
- Update your risk assessment to reflect hybrid work and new third-party integrations.
- Refresh Business Associate Agreements to account for remote services and cybersecurity responsibilities.
- Run tabletop exercises for breach notification to make sure you can meet the 60-day reporting window.
Prioritizing HIPAA now reduces exposure to OCR fines and protects employee trust. For Section 125 and benefits administration that respects privacy, contact us.
Frequently Asked Questions
What is HIPAA compliance for employers?
HIPAA compliance for employers means following the rules set by the Health Insurance Portability and Accountability Act to protect employee health information. Employers that sponsor group health plans must ensure that protected health information (PHI) is only accessed for plan administration purposes. HIPAA compliance includes implementing administrative, physical, and technical safeguards, training staff, and having a documented breach response plan.
What is considered protected health information under HIPAA?
Protected health information (PHI) is any individually identifiable health information that is created, received, maintained, or transmitted by a covered entity or business associate. PHI includes medical records, billing information, insurance claims, lab results, and any data that connects a person's identity to their health condition or treatment. PHI can exist in electronic, paper, or verbal form.
What are the HIPAA penalties for employers in 2026?
HIPAA penalties are enforced by the Office for Civil Rights (OCR) and range from $137 to $68,928 per violation, depending on the level of negligence. Annual caps can reach up to $2,067,813 per violation category. Criminal penalties can include fines up to $250,000 and imprisonment for up to 10 years in cases involving intentional misuse of PHI. The OCR adjusts penalty amounts annually for inflation.
Do small businesses have to comply with HIPAA?
Small businesses must comply with HIPAA if they are covered entities or business associates. A small employer that sponsors a self-funded health plan or handles employee health information for plan administration purposes is subject to HIPAA rules. The size of the business does not create an exemption. Even businesses with just a few employees must protect PHI if they meet the covered entity or business associate definition.
What is a HIPAA Business Associate Agreement?
A HIPAA Business Associate Agreement (BAA) is a written contract between a covered entity and any third party that creates, receives, maintains, or transmits protected health information on its behalf. BAAs must outline the permitted uses of PHI, require the business associate to implement safeguards, and establish breach notification procedures. Employers must have BAAs in place with brokers, TPAs, payroll vendors, and any other vendor that handles employee health data.
What is the HIPAA breach notification rule?
The HIPAA breach notification rule requires covered entities to notify affected individuals within 60 days of discovering a breach of unsecured PHI. If the breach affects 500 or more individuals, the covered entity must also notify the OCR and prominent media outlets. Breaches affecting fewer than 500 individuals must be reported to the OCR annually. Business associates must notify the covered entity within the timeframe specified in the Business Associate Agreement.
How often should employers conduct a HIPAA risk assessment?
The HHS recommends that employers conduct a HIPAA risk assessment at least once per year, or whenever significant changes occur in the organization's operations, technology, or workforce. A risk assessment identifies potential vulnerabilities in how PHI is stored, accessed, and transmitted. Documenting the assessment and any corrective actions taken is essential for demonstrating compliance during an OCR audit.