HIPAA in Plain Terms
HIPAA is the federal law that protects the privacy and security of health information. For community health workers, the practical core is this: protect client information, share it only as permitted, and report any breach promptly.
Who Is a "Covered Entity"
HIPAA applies to covered entities — health plans, healthcare clearinghouses, and most healthcare providers who transmit health information electronically. If you work for or contract with one, the rules apply to you even if you're not the "provider" of record.
The Minimum Necessary Rule
When you do share information, share only the minimum necessary for the purpose. Telling a care team member what they need to coordinate care is appropriate; oversharing details they don't need is not.
Safeguards That Matter Most
- Physical: lock screens, secure storage, no charts visible to visitors.
- Administrative: training, access limits, and clear policies on who sees what.
- Technical: strong passwords, encrypted devices, and secure messaging — not personal texts.
When Confidentiality and Safety Conflict
There are limited exceptions — imminent harm, certain communicable diseases, court orders. Know your state's mandated reporting rules and your organization's protocol before you face the situation, not during it.
What to Do If Something Goes Wrong
Report suspected breaches immediately. Fast reporting limits harm and is often a legal requirement. Silent handling of a breach creates far larger liability than the breach itself.
For HIPAA training kits, risk assessments, and policy templates, see our HIPAA & Compliance resources.