What does HIPAA stand for? HIPAA stands for Health Insurance Portability and Accountability Act, a federal law passed in 1996. Today it is best known for setting national rules on who may see and share your medical information.
You meet it every time a clinic hands you a privacy notice to sign, or a receptionist says they cannot discuss a patient "because of HIPAA." It is also one of the most misspelled acronyms in the country: the correct form has one P and two As.
Quick facts
Stands for
Health Insurance Portability and Accountability ActType
Acronym, said as a wordHow to say it
HIP-uhStarted
Signed into law in 1996Enforced by
U.S. Department of Health and Human Services, Office for Civil RightsCommon misspelling
HIPPA (wrong); HIPAA (right)Related terms
What does HIPAA stand for, letter by letter?
- H = Health
- I = Insurance
- P = Portability
- A = Accountability
- A = Act
The "and" is left out, which is normal for law names. The two As at the end come from Accountability and Act. That detail is the key to spelling it right: there is only one P, because only one word, Portability, starts with P.
Notice that the word "privacy" is not in the name at all. That surprises many people, since privacy is what the law is now famous for.
What the name originally meant
When Congress passed the law, the headline goals were in the title.
- Portability meant helping workers keep health coverage when they changed or lost a job, and limiting how plans could refuse coverage for existing conditions.
- Accountability covered fighting fraud and abuse in health care and setting standard formats for electronic billing.
The privacy protections came from a part of the law that called for national standards on health information. The rules that grew out of it, especially the Privacy Rule and the Security Rule, are what most people now mean when they say HIPAA.
What HIPAA protects and who must follow it
HIPAA protects what it calls protected health information, or PHI: anything that links you to your health, care or payment for care, such as test results, diagnoses or billing records.
The rules apply to covered entities: health plans, health care clearinghouses and most doctors, hospitals, pharmacies and other providers that bill electronically. Companies that handle that information for them, such as billing services, must also follow the rules.
Under HIPAA, you generally have the right to:
- get a copy of your medical records;
- ask for a mistake in your records to be corrected;
- receive a notice explaining how your information is used;
- file a complaint if you think your privacy was violated.
What HIPAA does not cover
The law is narrower than many people think. It usually does not apply to:
- a friend, coworker or neighbor who shares news about your health;
- most employers acting as employers, for example when a manager asks why you were out sick;
- school records, which usually fall under FERPA instead;
- many fitness and health tracking apps you choose on your own, unless they work on behalf of a covered provider or plan.
Office email: "Please do not share details about Jordan's surgery; it is a HIPAA issue." Kind advice, but between coworkers it is really a matter of privacy and workplace policy. HIPAA itself governs the clinic and the insurer, not the office chat.
HIPPA or HIPAA: getting the spelling right
"HIPPA" is so common that people even search "what does hippa stand for" or "hippa stands for." There is no law called HIPPA. The correct HIPAA acronym has five letters, and a quick way to remember it is one P for Portability, two As for Accountability and Act.
Say it as one word, HIP-uh. Capital letters, no dots. In a formal report, give the law's complete name on first mention and switch to HIPAA afterward. It is a proper name of a law, so you would write "HIPAA requires" rather than "the HIPAA requires."
Privacy acronyms often confused with HIPAA
| Term | Stands for | Covers |
|---|---|---|
| HIPAA (this page) | Health Insurance Portability and Accountability Act | Health records held by providers and plans |
| FERPA | The Family Educational Rights and Privacy Act | Student education records |
| PII | Personally identifiable information | Any data that identifies a person |
| PHI | Protected health information | The health data HIPAA protects |
More federal laws and agencies are listed in the government acronyms section.
Questions people ask
What does HIPPA stand for?
HIPPA is a misspelling. The law is HIPAA, short for Health Insurance Portability and Accountability Act, spelled with one P and two As.
What is the HIPAA full form?
Spelled out: Health Insurance Portability and Accountability Act. This federal law, passed in 1996, set national rules for health information privacy, among other things.
How do you pronounce HIPAA?
Say it as one word, HIP-uh. People rarely spell out the letters.
Can my employer ask about my health under HIPAA?
HIPAA usually does not cover employers acting as employers, so the question itself is not a HIPAA violation. Other laws may limit what an employer can ask or do with the answer, so check with a lawyer or your state labor office if you have concerns.
Does HIPAA let my family see my medical records?
Not automatically. You can give permission for family members to get information, and providers may share some details with people involved in your care unless you object.