HIPAA is the 1996 US law that governs the privacy and security of protected health information (PHI). Its Privacy Rule sets the terms under which PHI may be used and disclosed and grants patients a right of access to their own records (§164.524); its Security Rule mandates administrative, physical, and technical safeguards for electronic PHI. Enforced by the HHS Office for Civil Rights, HIPAA is the legal and ethical baseline every US healthcare API operates under — and the reason consent is not a nicety but a foundation.
HIPAA
HIPAA is the law that makes consent the moral center of US healthcare, and it is the reason the patient-directed API is more than a nice idea. Its Privacy Rule sets when protected health information may move and gives patients a right of access to their own records; its Security Rule requires real safeguards on electronic PHI. Together they are the baseline every healthcare API in the country operates under.
- The right of access (§164.524) - The paper-era right that a patient can get, and direct, their own record — the legal seed of the patient-directed API.
- The Security Rule - Administrative, physical, and technical safeguards, the floor that frameworks like HITRUST are built to demonstrate against.
- Enforced with teeth - The HHS Office for Civil Rights investigates and penalizes, which is why compliance posture is a first-order concern for every vendor.
HIPAA is the regulation I keep pointing to when I say healthcare should have been the API economy’s gift on consent. The law makes consent foundational; the technical layer has never caught up. Across every healthcare cohort I score, not one provider exposes consent as a first-class, machine-legible surface — HIPAA makes it central, FHIR even defines a Consent resource, and still the agent gets scopes and no consent state. Closing that gap is the single most important thing the sector could do, and HIPAA is the reason it is not optional.
Referenced in API Evangelist papers
This regulation shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this regulation in the context of a real sector.
The State of US Healthcare APIs
The privacy law that makes consent the moral center of healthcare — and whose right of access the patient-directed API operationalizes.
Implemented by these standards
A regulation is the law; a standard is the machine-readable contract that makes it real. These are the technical standards that implement this regulation, catalogued at standards.apievangelist.com.
HL7 FHIR
FHIR APIs carry the protected health information HIPAA governs.
HITRUST CSF
The framework organizations most use to demonstrate HIPAA Security Rule coverage.
