On your first day in a US healthcare process, you will probably sign a confidentiality agreement and sit through HIPAA training. You will be told to keep your phone in a locker, never to take screenshots, and to verify every caller before saying a word about a patient. It can feel strict. There is a good reason.
You are handling some of the most sensitive information a person has: their health. This guide explains HIPAA and PHI in simple terms, why the rules apply to you even though you work in India, and the daily practices that keep you, your company and patients safe. It also covers the questions interviewers ask.
What is HIPAA?
The Health Insurance Portability and Accountability Act of 1996 is a US law. Its rules relevant to your work include:
- Privacy Rule: controls how PHI can be used and disclosed.
- Security Rule: requires safeguards for electronic PHI (access controls, audit logs, encryption and similar measures).
- Breach Notification Rule: requires notification when unsecured PHI is breached.
Later legislation, including the HITECH Act, strengthened enforcement and extended obligations to business associates.
Why HIPAA applies to you in India
US healthcare providers and health plans are "covered entities". When they share PHI with a billing company or outsourcing partner, that partner becomes a business associate (or a subcontractor of one) and signs a business associate agreement (BAA) committing to protect the data. Your employer’s contracts, and your own employment terms, require you to follow these rules. India’s own Digital Personal Data Protection Act, 2023 also sets expectations for handling personal data.
What counts as PHI?
Health information becomes PHI when it can be linked to an individual. HIPAA lists identifiers such as:
- Names, addresses (smaller than a state), dates related to the person (birth date, admission and discharge dates)
- Phone numbers, email addresses, fax numbers
- Social Security numbers, medical record numbers, health plan member IDs, account numbers
- Licence numbers, vehicle identifiers, device identifiers
- Web addresses, IP addresses, biometric identifiers, full-face photos
- Any other unique identifying number or code
A claim showing a patient’s name, date of birth, diagnosis code and procedure is PHI. So is a screenshot of it, a note in your diary, or a photo of the screen.
The minimum necessary rule
Use, access and share only the minimum PHI needed for the task. If you are checking claim status, you do not need to read the patient’s full medical history. If a caller asks for something beyond what the process allows, politely decline and follow the escalation process.
Caller verification
Before discussing any patient information on a call, verify that you are speaking to an authorised person, using the identifiers your client requires (for example name, date of birth, member ID and address). If verification fails, do not share information, even if the caller is insistent. On provider-side calls to payers, you will be asked to verify your provider details in the same way.
Daily workplace rules (and why they exist)
| Rule | Why |
|---|---|
| Phones and personal devices in lockers | Prevents photos or recordings of PHI |
| No screenshots, printing or copying data outside approved systems | Stops data leaving secure systems |
| Lock your screen whenever you leave your desk | Prevents unauthorised viewing |
| Clean desk: no notes with patient details | Paper is a common source of leaks |
| Use only company-approved tools and email | Personal email, chat apps and unapproved AI tools are not secure for PHI |
| Never share login credentials | Every access is logged to a person |
| Don’t discuss cases outside work or on social media | Even "anonymous" stories can identify patients |
| Report suspected breaches immediately | Quick action limits harm and is required |
Examples of violations
- Taking a photo of a screen to "ask a friend" how to handle a claim.
- Emailing a patient report to a personal email address to work from home.
- Looking up records of someone you know out of curiosity.
- Sharing claim details with a caller who failed verification.
- Pasting patient data into an unapproved online tool.
Consequences can include termination of employment, serious contractual and legal consequences for the company, and loss of the client relationship. Background verification for future jobs may also reflect a termination for a compliance breach.
Interview questions
What is HIPAA?
A US law from 1996 that protects the privacy and security of patients’ health information and sets rules for how it is used and shared.
What is PHI? Give examples.
Protected health information is health information that can identify a person, such as a name with a diagnosis, a member ID, date of birth, address or medical record number.
What is the minimum necessary rule?
Use and share only the minimum PHI needed for the task.
A caller cannot verify the patient’s date of birth but insists on claim details. What do you do?
Politely explain that you cannot share information without verification, offer the correct alternative as per the process, and document the call.
What will you do if you accidentally send PHI to the wrong person?
Report it immediately to your supervisor or compliance team as per the breach process. Do not try to hide it.
Frequently Asked Questions
What is HIPAA in a BPO?
HIPAA is the US law protecting patient health information. Healthcare BPOs in India follow HIPAA practices because they handle that information for US clients under business associate agreements.
What is PHI?
Protected health information: any health information that can identify a person, such as name with diagnosis, member ID, date of birth, address or medical record number.
Why are mobile phones not allowed on healthcare BPO floors?
To prevent photos, recordings or copying of protected health information.
What happens if an employee violates HIPAA?
Consequences can include termination, contractual and legal consequences for the company, and damage to future employment prospects.
What is the minimum necessary rule?
The principle that employees should access, use and share only the minimum health information needed to do their task.