The rules and regulations are documented in the Code of Federal Regulations (CFR). Parts 160 and 164 of the CFR are the two that pertain to HIPAA. When someone says they adhere to HIPAA rules, it means they adhere to the paragraphs in the Parts. For example, one of the paragraphs says:

Paragraph 164.308(a)(1)(i) Standard: Security Management Practices – Implement policies and procedures to prevent, detect, contain, and correct security violations.

In essence, the rules say:

• Protect the Availability, Integrity and Confidentiality of PHI
• Have Business Associates Agreement with clients who have PHI
• Report any violations of PHI misuse to the OCR.