HIPAA compliance means meeting the duties to protect health information under the Health Insurance Portability and Accountability Act (HIPAA), a United States law. For companies in Indonesia, these rules become a practical concern when a US client asks you to handle its patient data.
This article covers the data HIPAA protects, who must comply, the four core rules, and the safeguards in the HIPAA Security Rule. It then compares HIPAA with the European Union’s General Data Protection Regulation (GDPR) and Indonesia’s Personal Data Protection Law (UU PDP), followed by penalties and the Security Rule update.
What Is HIPAA?
HIPAA, the Health Insurance Portability and Accountability Act, is a 1996 United States law that underpins the rules for protecting the privacy and security of health information. The US Department of Health and Human Services (HHS) issues the rules that put it into practice.
The rules cover when patient information may be used, how to secure it, what to do after a breach, and how the government enforces them. The Privacy Rule, HIPAA’s privacy standard, aims to protect individuals’ health information without blocking the flow of data that health care needs.
Does HIPAA Apply in Indonesia?
HIPAA does not apply automatically in Indonesia. It binds covered entities (health care providers, health plans, and clearinghouses) and business associates (vendors that handle patient data for them), not every holder of health data.
Companies in Indonesia are bound when they act as business associates, meaning they handle patient data for a US clinic or insurer and sign a business associate agreement (BAA). Patient data in Indonesia itself falls under the PDP Law, which classifies health data and information as specific personal data (Article 4(2)(a) of the PDP Law).
Data Protected by HIPAA
The data HIPAA protects is health information that can be linked to a specific individual, called protected health information (PHI), including its electronic form (ePHI).
PHI
PHI (protected health information) is health information that identifies a specific individual and is held by a party that HIPAA regulates. It covers physical or mental health conditions, health care received, and payment for that care.
A lab result that carries a patient’s name, address, or birth date, for example, already counts as PHI.
ePHI
ePHI (electronic PHI) is PHI stored or sent in electronic form, such as electronic health records, spreadsheets, and email. Patient data in a vendor’s application database also counts as ePHI.
Who Must Comply with HIPAA
Two groups must comply with HIPAA: covered entities and business associates. Covered entities provide, pay for, or process health care transactions, while business associates handle PHI on their behalf.
Covered Entities: Providers, Health Plans, and Clearinghouses
HIPAA divides covered entities into three types:
- Health care providers that send health information electronically in transactions HIPAA regulates, such as clinics and hospitals.
- Health plans, meaning insurers and other organizations that provide or pay for health care.
- Health care clearinghouses, meaning entities that convert health information from a nonstandard format to a standard one, or the reverse.
Business Associates: Third Parties That Handle PHI
A business associate is a party outside a covered entity’s workforce that performs functions or provides services for the covered entity by creating, receiving, maintaining, or transmitting PHI. A subcontractor that handles PHI for a business associate is also a business associate.
HHS gives these examples of business associates:
| Type of party | Function that makes it a business associate |
|---|---|
| Cloud service provider | Stores or processes ePHI on behalf of a covered entity |
| IT vendor and managed service provider | Maintains or supports information systems that handle ePHI |
| Health app developer | Provides an app to a covered entity’s patients and handles their PHI |
| AI chatbot provider on a patient portal | Assesses symptoms, sends reminders, or schedules appointments using patients’ PHI |
| Medical transcription service | Provides transcription services for physicians |
| Third party administrator | Helps a health plan process claims |
Access to PHI while performing the work determines business associate status, not the type of company.
A party that merely passes PHI along, such as the US Postal Service or certain couriers, falls under the conduit exception. If you or your vendor routinely access PHI to deliver a service, that exception does not apply.
BAA: The Contract That Binds Vendors
A business associate agreement (BAA) is a written contract that must be in place before a covered entity shares PHI with a business associate. It limits how the vendor may use PHI and requires the vendor to comply with the Security Rule.
The vendor must also report any security incident it becomes aware of, including breaches of PHI, to the covered entity. If the vendor uses a subcontractor, it must sign a similar BAA with that subcontractor before sharing PHI.
The Four Core Rules of HIPAA Compliance
HIPAA compliance rests on four core rules: the Privacy Rule, the Security Rule, the Breach Notification Rule, and the Enforcement Rule. The first three set an organization’s duties, while the Enforcement Rule governs how the US government enforces them.
Privacy Rule: Limits on Use and Individual Rights
The Privacy Rule sets national standards to protect medical records and other identifiable health information. It limits how PHI may be used and disclosed without the individual’s authorization.
Individuals can also examine and obtain a copy of their records, request corrections, and have a copy of their electronic health record sent to a third party.
Security Rule: Protecting ePHI
The Security Rule requires covered entities and business associates to protect the confidentiality, integrity, and availability of ePHI. The types of safeguards it requires are covered in the safeguards section below.
Breach Notification Rule: Obligations After a Data Breach
The Breach Notification Rule requires covered entities to notify affected individuals, HHS, and in some cases the media after a breach of unsecured PHI. A business associate must notify the covered entity no later than 60 days after discovering the breach (45 CFR 164.410).
A covered entity notifies individuals without unreasonable delay and no later than 60 days after discovery (45 CFR 164.404). Reports to HHS for breaches affecting 500 or more people follow the same deadline (45 CFR 164.408).
Breaches affecting fewer than 500 people are reported annually, no later than 60 days after the end of the calendar year of discovery (45 CFR 164.408). Media notice is required only when a breach affects more than 500 residents of one state or jurisdiction (45 CFR 164.406).
An impermissible use or disclosure of PHI is presumed to be a breach unless a documented risk assessment shows a low probability of compromise (45 CFR 164.402). The burden of proof rests with the organization (45 CFR 164.414).
Encryption that follows HHS guidance can remove the duty to notify. PHI made unusable, unreadable, or indecipherable through encryption or destruction counts as secured, so a breach involving it does not trigger notification.
Enforcement Rule: Investigations and Fines
The Enforcement Rule contains provisions on compliance and investigations, civil money penalties for violations, and hearing procedures. It is codified in 45 CFR Part 160, Subparts C, D, and E.
The penalty tiers and the ways cases are resolved are covered in the penalties section below.
Safeguards in the HIPAA Security Rule
Safeguards in the HIPAA Security Rule are the protections an organization must apply to secure ePHI, divided into administrative, physical, and technical safeguards.
Administrative Safeguards: Policies, Training, and Risk
Administrative safeguards are the policies, procedures, and staff management that determine how an organization handles ePHI. The main standards include:
- A risk analysis of threats and vulnerabilities to ePHI, followed by risk management to reduce them to a reasonable and appropriate level.
- A designated security official who develops and implements the security policies.
- Role-based limits on access to ePHI through an identity and access management (IAM) system, so each user sees only the data their job requires.
- Training for all staff on the security policies, with sanctions for staff who violate them.
- Procedures to identify, respond to, and document suspected or known security incidents.
- A contingency plan for emergencies, including data backup, data recovery, and continuity of critical operations.
- Periodic technical and nontechnical evaluation of how well the policies meet the Security Rule.
- A written BAA with every business associate before that vendor handles ePHI.
Physical Safeguards: Facilities, Workstations, and Media
Physical safeguards limit physical access to the systems that store ePHI and to the facilities that house them. The main controls include:
- Limits on access to facilities and system rooms, while authorized personnel keep their access.
- Rules for the use and physical protection of workstations, meaning the work computers that can access ePHI.
- Management of the receipt, movement, and disposal of devices and media that contain ePHI.
- Removal of ePHI from media before the media is reused.
Technical Safeguards: Access, Audit Logs, and Transmission
Technical safeguards are technology controls that restrict access to ePHI and keep the data intact. The technical standards include:
- Access control that lets only authorized users open ePHI.
- Audit logs, meaning mechanisms that record and examine activity in systems that hold ePHI.
- Integrity controls that confirm ePHI has not been altered or destroyed improperly.
- Authentication that verifies the person requesting access is who they claim to be.
- Transmission security that protects ePHI from unauthorized access when it travels over an electronic network.
Required vs Addressable: How Mandatory Each Control Is
The Security Rule is flexible and does not prescribe specific technology. An organization’s size, technical capability, costs, and the level of risk to ePHI determine which protections are adequate, so an accurate and thorough risk analysis underlies every decision.
An implementation specification marked required must be applied as written. One marked addressable, meaning its application adapts to the organization’s circumstances, is not optional.
The organization must implement an addressable specification when it is reasonable and appropriate, or adopt an alternative and document the reasons.
Read also: Incident Response Plan (IRP): Definition and Recommendations
HIPAA vs GDPR vs Indonesia’s PDP Law
HIPAA protects only health information held by covered entities and business associates, while GDPR and the PDP Law protect all personal data and apply stricter treatment to health data. The table below compares the three on six aspects.
| Aspect | HIPAA | GDPR | Indonesia’s PDP Law |
|---|---|---|---|
| Data protected | PHI, meaning health information that can be linked to an individual | All personal data, with health data as a special category whose processing is prohibited unless specific conditions are met (GDPR Article 9) | All personal data, with health data and information as specific personal data (PDP Law Article 4(2)) |
| Who is bound | Covered entities and business associates | Controllers and processors established in the EU, and those outside the EU that offer goods or services to people there or monitor their behavior (GDPR Article 3) | Controllers and processors, including those outside Indonesia when the processing has legal consequences in Indonesia or for Indonesian citizens (PDP Law Article 2(1)) |
| Vendor contracts | A BAA is required before PHI is shared | A contract that binds the processor to the controller (GDPR Article 28) | The processor acts on the controller’s instructions, and a sub-processor needs the controller’s written approval (PDP Law Article 51) |
| Risk assessment | Risk analysis of ePHI | Data protection impact assessment (DPIA) for high-risk processing, including large-scale special category data (GDPR Article 35) | Impact assessment for high-risk processing, including specific personal data (PDP Law Article 34) |
| Breach notification | Without unreasonable delay and no later than 60 days after discovery | To the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware (GDPR Article 33) | Written notice to data subjects and the supervisory authority within 3×24 hours, or 72 hours (PDP Law Article 46) |
| Financial penalties | Civil money penalties in four tiers based on culpability | Administrative fines of up to EUR 20 million or 4 percent of worldwide annual turnover, whichever is higher, for the most serious violations (GDPR Article 83(5)) | Administrative fines of up to 2 percent of annual revenue (PDP Law Article 57) |
The breach notification deadline is the biggest difference: 60 days under HIPAA, 72 hours under GDPR, and 3×24 hours (also 72 hours) under the PDP Law. An organization subject to more than one framework should use the 72-hour deadline as the benchmark for its internal procedures.
In Indonesia, the PDP Law binds companies directly, as its two-year adjustment period ended in October 2024 (Article 74 of the PDP Law), while HIPAA binds mainly through BAAs. Its implementing regulation, Government Regulation No. 33 of 2026 (PP 33/2026), takes effect on January 16, 2027.
Read also: Data Breach Notification: Requirements Under Indonesia’s PDP Law Every Company Must Understand
HIPAA Penalties and How They Are Enforced
A HIPAA violation can lead to corrective action required by the regulator, a paid settlement, or tiered civil money penalties. The Office for Civil Rights (OCR), a unit of HHS, enforces the rules.
Civil money penalties fall into four tiers based on culpability (45 CFR 160.404):
- A violation the organization did not know about and would not have known about even with reasonable diligence.
- A violation due to reasonable cause and not to willful neglect.
- Willful neglect that is corrected within 30 days of the organization learning of it.
- Willful neglect that is not corrected within 30 days.
Penalty amounts are adjusted every year under 45 CFR Part 102, so figures from older sources may no longer apply. Check the current amounts before estimating a potential penalty.
OCR can close a case through a settlement that sets a payment equal to a percentage of the civil money penalties it could impose. The settlement also requires the organization to fix the root causes through a corrective action plan that includes monitoring.
HHS says most investigations can take multiple years to resolve.
Security Rule Update Status as of October 2026
HHS’s major Security Rule update is still only a proposal, so the existing Security Rule remains in effect. HHS has not issued a final version.
The proposal would remove the distinction between required and addressable specifications, with limited exceptions, and would require ePHI encryption and annual verification of business associates. It also includes multi-factor authentication (verifying identity with more than one proof) and annual penetration testing (simulated attacks to find weaknesses).
The timeline for the final version has slipped. In its latest regulatory agenda, HHS moved the proposal to the long-term actions category, so there is no new compliance deadline yet.
Even though the update is not final, two of its proposals are worth adopting now: encryption and multi-factor authentication. Both reduce breach risk, and encryption that follows HHS guidance can also remove the duty to notify.
Conclusion
HIPAA compliance rests on four core rules and three types of safeguards, with risk analysis as the basis for every security decision. Organizations need to keep written evidence for every control they claim.
For companies in Indonesia, the most useful step now is to check whether US clients have asked or will ask for a BAA. After that, align internal controls with the PDP Law, especially the 3×24-hour breach notification deadline.
Ready to Manage Privacy Compliance as a Business Risk?
See how GRC helps map personal data risks, monitor compliance with the PDP Law, and prepare companies for audits without complicated manual processes.
FAQ
No. The Security Rule does not require certification, HHS does not recognize private certifications, and HHS can still find violations at organizations that hold one.
Not yet. HHS’s cloud computing guidance says some controls, such as user authentication, may be the customer’s responsibility, and both parties should confirm in writing how they divide the responsibilities.
No, as long as a BAA with the cloud provider is in place and the other HIPAA requirements are met. HHS notes that the risks to ePHI can vary greatly by geographic location, so storage location belongs in the risk analysis.
Security Rule documentation must be kept for six years after the later of its creation date or the date it was last in effect (45 CFR 164.316(b)(2)(i)).
No. The Privacy Rule and Breach Notification Rule cover PHI in any form, while the Security Rule covers only ePHI.
