The Health Insurance Portability and Accountability Act of 1996 (HIPAA) created a statutory obligation and regulatory scheme to protect patient health information protected health information or PHI). The law applies to both health care providers (covered entities) as well as their business associates. Many life sciences companies are involved in providing health care, either directly or as a business associate, or are developing products for us by health care providers that create, store or manipulate PHI. This means that these companies must comply with HIPAA, and their services and products must be capable of protecting the PHI with which they deal.