What HIPAA Doesn’t Cover: Understanding HIPAA Exceptions

While HIPAA provides robust protections for protected health information (PHI), it doesn’t cover every type of data or situation.

Common exceptions include:

• Employment records held by a covered entity in its role as an employer (these are not considered PHI under HIPAA).

• Education records are covered by the Family Educational Rights and Privacy Act (FERPA).

• De-identified data—once PHI has been de-identified according to HIPAA standards, it is no longer subject to HIPAA.

• Health information shared outside the U.S., unless handled by a HIPAA-covered entity or business associate.

• Law enforcement disclosures are made in compliance with specific legal requirements.

Understanding these exceptions helps organizations manage data consistently across regulatory frameworks.
It’s also important to align HIPAA practices with broader privacy efforts under GDPR and ISO 27001 to maintain a cohesive global approach to data protection.