HIPAA is the 1996 US law that governs the privacy and security of protected health information (PHI). Its Privacy Rule sets the terms under which PHI may be used and disclosed and grants patients a right of access to their own records (§164.524); its Security Rule mandates administrative, physical, and technical safeguards for electronic PHI. Enforced by the HHS Office for Civil Rights, HIPAA is the legal and ethical baseline every US healthcare API operates under — and the reason consent is not a nicety but a foundation.
HIPAA
Statute United States
HIPAA is the law that makes consent the moral center of US healthcare, and it is the reason the patient-directed API is more than a nice idea. Its Privacy Rule sets when protected health information may move and gives patients a right of access to their own records; its Security Rule requires real safeguards on electronic PHI. Together they are the baseline every healthcare API in the country operates under.
- The right of access (§164.524) - The paper-era right that a patient can get, and direct, their own record — the legal seed of the patient-directed API.
- The Security Rule - Administrative, physical, and technical safeguards, the floor that frameworks like HITRUST are built to demonstrate against.
- Enforced with teeth - The HHS Office for Civil Rights investigates and penalizes, which is why compliance posture is a first-order concern for every vendor.
HIPAA is the regulation I keep pointing to when I say healthcare should have been the API economy’s gift on consent. The law makes consent foundational; the technical layer has never caught up. Across every healthcare cohort I score, not one provider exposes consent as a first-class, machine-legible surface — HIPAA makes it central, FHIR even defines a Consent resource, and still the agent gets scopes and no consent state. Closing that gap is the single most important thing the sector could do, and HIPAA is the reason it is not optional.
Implemented by these standards
A regulation is the law; a standard is the machine-readable contract that makes it real. These are the technical standards that implement this regulation, catalogued at standards.apievangelist.com.
HL7 FHIR
FHIR APIs carry the protected health information HIPAA governs.
HITRUST CSF
The framework organizations most use to demonstrate HIPAA Security Rule coverage.
Reaches these HTTP headers
Where a regulation actually touches the wire. Mandated means the law, or a technical standard it makes binding, names this header. Evidentiary means no law names it, but it is the deployed control for an obligation the law does impose. Inferred means it would be good evidence and nothing requires it — interesting to read, never to score.
cache-control
evidentiary
observable at the edge
`no-store` on a response carrying PHI, so it does not land in a shared cache.
strict-transport-security
evidentiary
observable at the edge
Security Rule technical safeguards for transmission security.
