Last updated: November 4, 2026 · Reviewed by BOLD VAN's EDI team. This article is general information, not legal advice.
In This Article
Quick Answer
HIPAA requires health plans, health care clearinghouses and health care providers that conduct certain administrative transactions electronically to use national standards. For most transactions, that standard is ASC X12 Version 5010, such as the 837 claim, 835 payment and remittance advice and 270/271 eligibility inquiry and response; retail pharmacy transactions use NCPDP Version D.0. HIPAA civil penalties are set in four tiers and adjusted for inflation each year, reaching $2,190,294 per violation for uncorrected willful neglect.
Definition
HIPAA (Health Insurance Portability and Accountability Act) is a U.S. federal law enacted in 1996. Among other things, it protected health coverage for people changing or losing jobs, required safeguards for protected health information, and directed the Department of Health and Human Services (HHS) to adopt national standards for electronic health care transactions, a part of the law known as Administrative Simplification.
Congress passed HIPAA in 1996, and President Clinton signed it into law. HIPAA's main goals include:
A central part of HIPAA is establishing national standards for electronic health care transactions, along with national identifiers for employers, providers and health plans. The goal is to make the U.S. health care system more efficient by replacing the hundreds of different formats once used with common standards.
Under HIPAA's transaction standards, often called the EDI rule or the Transactions and Code Sets rule, covered entities that conduct these transactions electronically must use the adopted standards:
These standards define how data is sent electronically and exactly how it must be formatted, so health care data moves in consistent formats nationwide.
HIPAA's transaction standards apply to covered entities:
| Covered Entity | Examples | When the Standards Apply |
|---|---|---|
| Health plans | Health insurers, HMOs, Medicare, Medicaid, employer group health plans | When conducting standard transactions electronically |
| Health care clearinghouses | Companies that convert health data between formats for others | When processing standard transactions |
| Health care providers | Physicians, hospitals, clinics, pharmacies, dentists | Only if they conduct any standard transaction electronically |
A few points to note:
| X12 Transaction | Name | What It Does |
|---|---|---|
| 837 | Health Care Claim (Professional, Institutional, Dental) | Submits claims and coordination of benefits information |
| 835 | Health Care Claim Payment/Advice | Explains claim payments and adjustments |
| 270/271 | Eligibility, Coverage or Benefit Inquiry and Response | Checks a patient's coverage and benefits |
| 276/277 | Health Care Claim Status Request and Response | Checks the status of a submitted claim |
| 278 | Health Care Services Review (Referral Certification and Authorization) | Requests and responds to prior authorizations and referrals |
| 834 | Benefit Enrollment and Maintenance | Enrolls and updates members in a health plan |
| 820 | Payroll Deducted and Other Group Premium Payment | Sends premium payment information to health plans |
Standardizing these transactions has made the health care system more efficient, reduced administrative overhead and made health care data easier to exchange.
HIPAA's civil penalty structure was strengthened in 2009 by the HITECH Act, part of the American Recovery and Reinvestment Act (ARRA). Penalties are set by HHS, enforced by its Office for Civil Rights (OCR), and depend on the nature and extent of the violation. Willful violations carry much heavier penalties than violations the organization didn't know about.
Penalty amounts are adjusted for inflation every year. These are the amounts that took effect January 28, 2026:
| Tier | Level of Culpability | Per-Violation Range |
|---|---|---|
| Tier 1 | Did not know, and with reasonable diligence would not have known | $145 to $73,011 |
| Tier 2 | Reasonable cause, not willful neglect | $1,461 to $73,011 |
| Tier 3 | Willful neglect, corrected within 30 days | $14,602 to $73,011 |
| Tier 4 | Willful neglect, not corrected within 30 days | $73,011 to $2,190,294 |
The official calendar-year cap for violations of an identical provision is $2,190,294. Since 2019, OCR has used enforcement discretion to apply lower annual caps for Tiers 1 through 3. In general, a violation that isn't due to willful neglect and is corrected within 30 days of discovery can avoid civil penalties. Knowingly obtaining or disclosing protected health information in violation of HIPAA can also bring criminal penalties, including fines and prison time.
Because these amounts change each year, check HHS's current penalty schedule for the latest figures.
Using an EDI provider doesn't make an organization HIPAA compliant on its own; compliance depends on your organization's policies, safeguards and agreements. But the right EDI partner can make the transaction side much easier by handling X12 formatting, trading partner connections and secure transmission.
If you are a covered entity evaluating an EDI provider for transactions that include protected health information, ask:
BOLD VAN has worked with X12 EDI since 1999. Documents are encrypted in transit and at rest on SOC 2 Type II audited infrastructure, and we support encrypted connection methods including AS2, SFTP, FTPS and HTTPS. Talk with our team about your specific HIPAA transactions and requirements.
Tell us which transactions you exchange and with whom, and our EDI experts will walk through your options. Call (844) 265-3777 or email info@boldvan.com.
Talk to an EDI ExpertHIPAA requires covered entities that conduct certain administrative transactions electronically to use national standards, ASC X12 Version 5010 for most transactions and NCPDP D.0 for retail pharmacy. It doesn't require every provider to transact electronically, but those that do must use the standards.
ASC X12 Version 5010 is the adopted standard for most HIPAA transactions. Retail pharmacy transactions use NCPDP Version D.0, and Medicaid pharmacy subrogation uses NCPDP Version 3.0.
Health plans, health care clearinghouses and health care providers that conduct any standard transaction electronically.
The 837 is the X12 Health Care Claim transaction, used to submit professional, institutional and dental claims and coordination of benefits information.
The 837 submits a health care claim. The 835 is the health care claim payment/advice, which explains how the claim was paid or adjusted.
Under the amounts effective January 28, 2026, per-violation penalties range from $145 to $73,011 for Tiers 1–3 and from $73,011 to $2,190,294 for Tier 4, with an official annual cap of $2,190,294 per identical provision. OCR applies lower annual caps for Tiers 1–3 through enforcement discretion.
No. An EDI provider can handle X12 formatting and secure transmission, but HIPAA compliance depends on your organization's own policies, safeguards and business associate agreements.
Key Facts
HIPAA, enacted in 1996, requires health plans, health care clearinghouses and providers that conduct certain administrative transactions electronically to use national standards: ASC X12 Version 5010 for most transactions (required since January 1, 2012), NCPDP D.0 for retail pharmacy and NCPDP 3.0 for Medicaid pharmacy subrogation. Key X12 transactions include the 837 claim, 835 payment/advice, 270/271 eligibility, 276/277 claim status, 278 authorization, 834 enrollment and 820 premium payment.
HIPAA civil penalties have four tiers and are adjusted annually for inflation. Under the amounts effective January 28, 2026, they range from $145 to $73,011 per violation for Tiers 1–3 and $73,011 to $2,190,294 for Tier 4, with an official annual cap of $2,190,294 per identical provision. Using an EDI provider supports, but does not by itself ensure, HIPAA compliance.
