HIPAA Privacy Rule
HIPAA regulates applicable uses and disclosures of PHI and provides certain individual rights. When UHIQ performs qualifying services on behalf of a covered entity or another business associate, its responsibilities derive from applicable law and relevant agreements.
HIPAA Security Rule
The Security Rule requires applicable safeguards for electronic PHI. UHIQ evaluates risk analysis, risk management, workforce security, access controls, audit controls, integrity, authentication, transmission security, incident procedures and documentation obligations. Proposed rules are not presented as effective requirements.
HITECH and breach notification
HITECH expanded relevant privacy, security and enforcement provisions, including direct business-associate obligations. Under HIPAA's Breach Notification Rule, a business associate must notify the covered entity after discovery of a breach of unsecured PHI, without unreasonable delay and no later than the federal outer limit, unless a stricter applicable contractual deadline controls. Other notifications depend on the legal role and circumstances.
BAA requirements
Where required, an appropriate Business Associate Agreement must be executed before qualifying PHI processing. The BAA addresses permitted uses/disclosures, safeguards, reporting, subcontractors, cooperation and return/destruction of PHI subject to applicable requirements.
42 CFR Part 2
Special confidentiality and consent rules may apply to qualifying substance use disorder records. Part 2 applicability and downstream redisclosure restrictions require use-case evaluation, including changes effective in 2026.
Healthcare transactions and coding
Applicable HIPAA Administrative Simplification standards can cover eligibility, claims, claim status, remittance, EFT-related data and other adopted transactions. UHIQ supports only those transactions enabled through its actual integration arrangements. ICD-10-CM, CPT and HCPCS coding is subject to applicable code-set requirements, licensing, version control and professional verification.
EHR and interoperability
ONC Health IT Certification Program claims must not be made without verified certification for the identified product/version. Interoperability and information-blocking obligations are assessed based on UHIQ's role and the feature's intended function.
Federal and state overlap
Applicable state laws may impose more protective privacy, confidentiality, breach reporting and health-record obligations. UHIQ evaluates state-specific applicability; HIPAA does not categorically preempt all more stringent state health privacy requirements.
Customer responsibilities
Providers and other covered entities maintain their own obligations for notices, workforce policies, patient rights and authorized use. UHIQ assists to the extent required by law and agreement, but software use alone does not guarantee compliance.