hipaa-bundlelisted

# HIPAA — product-side playbook HIPAA is product-shaping, not just legal. It dictates architecture (BAA chain), UX (minimum necessary), data handling (PHI definition), and incident response (breach notification). PMs who treat HIPAA as legal-only ship products that fail audit and lose enterprise deals. ## 1. Is the product in scope? You're in scope if you handle **Protected Health Information (PHI)** — which is INDIVIDUALLY IDENTIFIABLE health information held by a: - **Covered Entity (CE)**: health plans, healthcare clearinghouses, healthcare providers conducting electronic transactions. - **Business Associate (BA)**: anyone processing PHI on behalf of a CE. **Common PM trap**: "we don't store PHI" — but your logs do. Or your support tool. Or your analytics. PHI in any system means HIPAA in that system. ## 2. What counts as PHI — the 18 identifiers PHI = health info + ANY of these identifiers: Names · geographic subdivisions smaller than state · dates (except year) related to individual · phone · fax · email · SSN · medical record number · health plan beneficiary number · account number · certificate/license number · vehicle identifiers · device identifiers · URLs · IPs · biometrics · full-face photos · any other unique identifying number/code/ characteristic. **De-identification**: removing all 18 identifiers per Safe Harbor, OR expert determination of statistical de-identification (≤0.04 re-id risk). ## 3. The three rules ### Privacy Rule - **Minimum necessary