# Internet of Things-Based Healthcare Systems: An Overview of Privacy-Preserving Mechanisms
## 2 Background on Concepts and Requirements
### HIPAA: Operationalizing Privacy Requirements  
A comprehensive regulatory framework is in place under the HIPAA, a United States (U.S.) law introduced in 1996. The HIPAA aims to safeguard individuals' health information by ensuring its confidentiality, integrity, and security while facilitating its effective flow to address essential medical needs. This law establishes a set of rules that govern how healthcare practices comply with privacy and security requirements, determined by numerous studies. These guidelines include the following [11]:  
1. Protected Health Information (PHI): The healthcare system's main operating entities, like hospitals, financial institutions, insurance providers, and many others, transfer health data and refer to it as PHI.
2. Acceptable Uses and Disclosures: The Privacy Rule governs how appropriate entities can use and disclose PHI. Most uses and disclosures are subject to individual consent under these rules.
3. Minimum Necessary Standard: The participating entities in healthcare must request, use, and disclose the minimum amount of health information to achieve their goal and guarantee that only needed information is disclosed and used to fulfill this purpose.
4. Individual Rights: When it comes to personal PHI, people have certain rights that include accessing it, asking for changes, obtaining an account of disclosures, and placing restrictions on its use.
5. Notice of Privacy Procedures: The covered entity must be provided with a detailed notice of their legal responsibilities, privacy policies, the usage of PHI, the procedure of disclosure, and the mandatory rights for each individual.
6. Safeguards: Protecting the privacy, accuracy, and accessibility of PHI requires covered organizations to establish administrative, technological, and physical protections designed to prevent unauthorized access, use, or disclosure.
7. Business Associate Agreements: A formal agreement with third parties is a must for covered entities so they can handle the PHI on their behalf and make sure that other partners adhere to the HIPAA's specified privacy and security rules.
8. Breach Notification: In the U.S., if PHI is involved in a breach, the covered entities are responsible for notifying the Department of Health and Human Services (HHS), any impacted parties, and sometimes the media. The HHS is a federal agency tasked with protecting the health of Americans and ensuring the privacy and security of their health information. Within the HHS, the Office for Civil Rights (OCR) is responsible for enforcing the HIPAA rules, including breach notification requirements. Typically, the notification discloses the full situation and outlines the steps taken to mitigate the effects.
9. Implementation: The responsibility of the HHS OCR is to implement privacy rules, along with programs of remedial action and civil financial penalties. Furthermore, noncompliance with privacy rules might lead to criminal consequences.  
To protect the privacy of patients, determining the amount of data that need to be shared and the protection of health information are the responsibilities of the HIPAA. The HIPAA's law guarantees the protection of health information, as well as guiding acceptable practices and implementing strict security measures. Legal compliance and maintaining the safety and security of medical records depend on adherence to these standards.