HIPAA Is About Responsibility, Not Just Privacy

In this episode of Compliance Technologies, we begin a new series on HIPAA by clarifying what the law actually regulates and what it does not.

HIPAA is often described as a privacy law, but at its core it defines responsibility for how protected health information (PHI) is created, used, stored, and transmitted across systems and organizations. This episode explains who HIPAA applies to, what qualifies as PHI and ePHI, and why accountability sits at the center of the regulation.

We explore how HIPAA assigns obligations to covered entities and business associates, why health data naturally flows across modern systems, and how HIPAA’s structure assumes continuous risk assessment rather than one-time compliance.

If you build, operate, or oversee systems that handle health information, this episode sets the foundation for understanding HIPAA as an operating framework, not a checklist, and why responsibility, not technology, is the starting point.