HIPAA – the Health Insurance Portability and Accountability Act of 1996 – is the primary regulatory framework for data protection of sensitive patient information. As such, it is the responsibility of every healthcare organization, its subcontractors, and every other institution that handles this type of data to comply with its physical and technical security requirements.