HIPAA (Health Insurance Portability and Accountability Act)

A 1996 U.S. federal law governing how covered entities (health plans, healthcare clearinghouses, and providers who transmit health data electronically) and their business associates (contractors handling that data on a covered entity’s behalf, added by a 2013 rule) may use and disclose protected health information (PHI). Any patient portal, telehealth interface, appointment-booking form, or account system that touches PHI is designing against this standard, not just Fair Information Practices‘s general baseline.

A 1996 U.S. federal law governing how covered entities (health plans, healthcare clearinghouses, and providers who transmit health data electronically) and their business associates (contractors handling that data on a covered entity’s behalf, added by a 2013 rule) may use and disclose protected health information (PHI).

Give patients notice and access

Covered entities must maintain a documented Notice of Privacy Practices and name a Privacy Official patients can contact with complaints — the healthcare-specific counterpart to a Privacy Policy. The notice has specific delivery and placement requirements beyond just existing: a provider with a direct treatment relationship must deliver it no later than a patient’s first visit, post it physically at each service location somewhere a patient can actually be expected to read it, and — the requirement most directly relevant to interface design — make it electronically available on any website the provider maintains for customer service or benefits information, not just handed over on paper. A provider must also make a good-faith effort to get a patient’s written acknowledgment that they received the notice, and a health plan must re-notify every enrollee that the notice is available at least once every three years, not just once at enrollment. Patients can request their own PHI in electronic or paper form; a covered entity must fulfill that request within 30 days, and if it uses certified electronic health record (EHR) technology, must let the patient obtain records via that system’s own view/download/transfer feature at no charge. Patients can also request delivery to a specific channel (their own encrypted email, a USB drive, a designated family member) and ask to be reached at a particular contact point (e.g., a work number instead of home) rather than whatever’s on file by default.

Disclose only the minimum necessary, and get authorization for the rest

Any disclosure of PHI beyond what a specific purpose requires should be trimmed to the minimum necessary information — a general design discipline of not surfacing or transmitting more than a screen or workflow actually needs. Disclosures outside routine treatment/payment/operations uses require the patient’s written authorization; this is the authorization-gate a health-adjacent form or portal has to build, distinct from ordinary Form Design consent checkboxes.

Any disclosure of PHI beyond what a specific purpose requires should be trimmed to the minimum necessary information — a general design discipline of not surfacing or transmitting more than a screen or workflow actually needs.

Design the interface around confidentiality, not just data security

Several Security Rule requirements are visible in the interface rather than purely backend concerns:

Restricting which staff accounts can see PHI at all — access control tied to job function, not a blanket internal audience.
Positioning shared-use workstations and monitors away from public sightlines.
Encrypting PHI in transit over open networks.

Uncertainty about what’s actually required has historically pushed providers toward an overcautious, unhelpfully guarded interface — a clear, unambiguous privacy-control design reduces that hesitation rather than adding to it.

Uncertainty about what’s actually required has historically pushed providers toward an overcautious, unhelpfully guarded interface — a clear, unambiguous privacy-control design reduces that hesitation rather than adding to it.

Patterns

Principles

Trust and Credibility

Standards

Fair Information Practices

Sources

Health Insurance Portability and Accountability Act (Wikipedia) (CC BY-SA) is this page’s source for the covered-entities/business-associates scope, the 30-day access-request deadline, the minimum-necessary disclosure standard, and the Security Rule’s access-control and workstation-placement requirements above.

Summary of the HIPAA Privacy Rule (HHS.gov) (public domain) is HHS’s own official summary, the source for the Notice of Privacy Practices’ delivery/posting/electronic-availability requirements, the written-acknowledgment expectation, and the three-year health-plan re-notification cadence in the section above.