HIPAA is not GDPR with a US accent

The senior courses "Compliance: GDPR deep dive" and "Compliance: LGPD deep dive" both cover omnibus laws. They bind almost any company that touches the personal data of the right people and hand those people a set of individual rights. They apply the same way whether you sell insurance or shoes. HIPAA isn't built that way, and every mistake a Rails team makes with it traces back to assuming it is.

HIPAA is sectoral and conditional. Its first question isn't "whose data is this?" It asks "who are you, and what kind of data is this?" at the same time. Get either half wrong and you get applicability wrong. That's a different failure from GDPR's territorial trigger, and a more dangerous one. It's easy to convince yourself a health-adjacent app is regulated when it isn't, or unregulated when it is.

The two-part test

HIPAA's Privacy, Security and Breach Notification Rules bind you only if both of these are true at once:

1. You're a covered entity or a business associate. A covered entity is a health plan, a healthcare clearinghouse, or a healthcare provider that transmits health information electronically for certain standard transactions: a hospital, a clinic, an insurer. A business associate is any organization that performs a function or service for a covered entity involving access to protected health information, without being a covered entity itself.
2. The data is protected health information (PHI): individually identifiable health information. That's a fact about someone's physical or mental health, the care they received or the payment for it, combined with something that identifies who they are.

A Rails team can fail this test in either direction. A fitness app where users log their own workouts, self-reported and never shared with a clinician or insurer, can hold health-related data that isn't PHI. It's neither a covered entity nor a business associate, and HIPAA doesn't reach it, however sensitive the data feels. A billing platform that processes claims for a clinic is almost certainly a business associate the moment it touches a single claim, however far from "medical software" its own marketing sounds.

Most Rails teams that touch health data are business associates

This is the fact to sit with before the rest of the course. A startup selling a product to a hospital, a clinic or an insurer, and storing or processing data on their behalf, is a business associate. The covered entity is still the hospital or the insurer.

It matters because a business associate's obligations are real and enforceable on their own, but they aren't identical to a covered entity's. A business associate doesn't, for example, owe patients the notice of privacy practices a covered entity gives them directly.

A business associate can also have its own subcontractors, such as a cloud host, an analytics vendor or a logging pipeline. HIPAA's chain of obligation follows the data through every one of them. Lesson 3 covers how that chain gets documented.

What this course covers

1. This lesson: the sectoral trigger, meaning covered entity, business associate and what counts as PHI.
2. Permitted uses, disclosures and minimum necessary: why there's no GDPR-shaped consent machinery here, and the architectural standard that replaces it.
3. The business associate agreement: the contract that makes handling PHI lawful at all, and what a chain of subcontractors looks like.
4. The Security Rule: administrative, physical and technical safeguards, the split between required and addressable, and a rule currently in flux.
5. Breach notification: a presumption you have to rebut, a clock different from GDPR's, and the 500-record line.
6. De-identification: Safe Harbor's enumerated checklist versus Expert Determination, and how sharply that contrasts with GDPR's standard for anonymisation.
7. Putting it together: an access model, an audit log, a de-identification pipeline and a vendor register, in Rails shapes.

One note before any of that: nothing in this course is legal advice. Decisions about HIPAA applicability and compliance belong with counsel who knows your business. This course teaches the engineering shape of the law well enough that you can have that conversation instead of guessing your way through it.