Health Privacy: know when HIPAA is in play.
Healthcare organizations hold some of the most sensitive data there is, and they are among the most targeted by cyber attacks. CyRisk’s privacy scan now identifies organizations in the healthcare industry, and separates those obligated to comply with HIPAA from those that may instead face FTC, FDA or other heightened federal and state rules.
The law in brief.
Health Insurance Portability and Accountability Act (HIPAA) and the HITECH Act: the Privacy, Security and Breach Notification Rules (45 CFR Parts 160 and 164)
Covered entities (healthcare providers, health plans, clearinghouses) and their business associates (vendors handling patient data)
HHS Office for Civil Rights and state attorneys general
No
Tiered civil money penalties based on culpability, adjusted annually for inflation
Notify affected individuals and HHS, and the media for larger breaches
Three results. One clear answer.
Every privacy report now includes a Health Privacy indicator. It describes the type of organization and whether HIPAA is likely to apply, shown alongside the grade as context.
An entity in the healthcare industry that is obligated to comply with HIPAA, either as a Covered Entity (healthcare provider, health plan, clearinghouse) or a Business Associate (vendor handling patient data).
An entity in the healthcare industry. While not definitively obligated to comply with HIPAA, this entity may be required to comply with FTC, FDA guidelines or other heightened federal and state regulations.
No healthcare industry activity was detected on the assessed pages.
Health Privacy: HIPAA
Illustrative example.
Starting with the pages that settle it.
The scan reads the organization’s own public website, starting with the pages most likely to show whether HIPAA applies.
A Notice of Privacy Practices
Covered healthcare organizations are required to publish one, so finding the organization’s own notice is strong evidence.
How the organization describes itself
A care provider (hospital, clinic, pharmacy, lab, dental, vision, behavioral health, home health), a health plan, a claims clearinghouse, or a healthcare software or services vendor.
Insurance and claims activity
Accepting or billing health insurance, or submitting insurance claims electronically.
Patient-facing systems
Patient portals and electronic health records.
Statements about HIPAA status
Whether the organization calls itself a HIPAA covered entity or business associate, and whether it handles patient data on behalf of healthcare clients.
The federal provider registry
We check the organization’s name against the national registry of healthcare providers (NPI). This helps identify healthcare organizations whose websites are hard to read.
Pages we read include insurance and billing pages, patient information, FAQs and HIPAA pages, alongside the homepage and privacy policy.
Health data changes how you read everything else.
See at a glance which risks carry HIPAA exposure, including breach notification duties and regulator scrutiny.
Get context on why health-related tracking and data findings elsewhere in the report matter more for this organization.
Tracking on patient portals and appointment pages, session replay on health forms, and pixels on logged-in pages all weigh more heavily when HIPAA is in play.
How to respond.
“Is the insured a HIPAA covered entity or business associate?”
“Do advertising pixels or session tools run on patient portal, appointment or health-form pages?”
“Are business associate agreements in place with vendors that receive patient data?”
Weigh breach notification and regulatory coverage terms, and review health-related tracking findings more closely.
Keep exploring.
Exposure families to read alongside
Other laws
Is this a HIPAA compliance audit?
No. Health Privacy identifies whether HIPAA likely applies, based on public information. It is not a HIPAA compliance audit, certification or legal determination.
Does Health Privacy affect the privacy grade?
No. It’s shown alongside the grade as context and never feeds scores, rankings or the report summary.
Does “Not Detected” mean HIPAA doesn’t apply?
It means no healthcare industry activity was detected on the assessed pages.
How does CyRisk decide?
It uses public website content, starting with the organization’s own Notice of Privacy Practices, and the federal provider registry (NPI).
Why might the indicator be blank?
When the evidence is conflicting or the pages needed couldn’t be read, the scan leaves the indicator blank rather than guess. A rescan may resolve it.
Find out who honors the opt-out.
Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our disposition next to the call you made.
Severity and placement shown are CyRisk defaults and can be tuned per account. A detected exposure indicates a fact pattern common to privacy litigation, not a confirmed violation. Litigation theories explain why a finding is tracked; they are not legal advice.