HIPAA is not a single law but a collection of interrelated rules that together define how healthcare organizations, their business associates, and their vendors must handle PHI. Each rule sets specific expectations: some high-level, others deeply technical.