IT Glossary
HIPAA sets US rules for protecting health information. Learn what the Security Rule requires on access, and when a European company falls under it.
August 7, 2026
HIPAA (Health Insurance Portability and Accountability Act) is a United States federal law, enacted in 1996, that sets national standards for protecting individually identifiable health information. Its Privacy Rule governs how protected health information may be used and disclosed, while its Security Rule defines the administrative, physical, and technical safeguards required for that information in electronic form.
Three requirements land directly on identity teams. Access control under 45 CFR 164.312(a) requires unique user identification and a mechanism restricting access to authorized persons. Workforce security under 164.308(a)(3) requires termination procedures that remove access when employment ends. Information access management under 164.308(a)(4) requires documented authorization, establishment, and modification of access rights. These are the offboarding and access review controls, written in 1996 language.
A European health software company signs its first US hospital customer and becomes a business associate. The contract requires evidence that access to systems holding protected health information is restricted, documented, and removed on termination. The company already meets the GDPR, but nobody has ever produced a dated access review across the applications involved. That evidence is the same work in both frameworks, and it is what Corma automates. Satelia took that route for identity governance in a regulated healthcare setting.
Not directly, since it is United States law. It applies contractually to any European company acting as a business associate for a US covered entity, through the business associate agreement it signs.
HIPAA is sector-specific US law covering health information. The GDPR is a general European regulation covering all personal data, with health data treated as a special category under Article 9.
The contract binding a vendor that handles protected health information to HIPAA safeguards, breach notification, and subcontractor obligations on behalf of a covered entity.
It does not use the phrase, but the information access management and workforce security standards require documented authorization, modification, and termination of access, which is what an access review evidences.
