How do I know if my business is a covered entity under HIPAA?

Editorial team Published on

You are a HIPAA covered entity only if your organization fits into one of three specific categories defined by the U.S. Department of Health and Human Services (HHS).

The Three Types of Covered Entities

  • Health Care Providers: Doctors, clinics, dentists, psychologists, chiropractors, nursing homes, and pharmacies. However, providers only qualify if they transmit health information electronically in standard transactions (such as electronic billing or insurance claims). Providers who only bill by paper or cash do not qualify.
  • Health Plans: Health insurance companies, HMOs, company health plans, Medicare, and Medicaid.
  • Health Care Clearinghouses: Entities that process non-standard health data into standard electronic formats (or the reverse) for other organizations.

What If You Work With a Covered Entity?

If you provide services to a covered entity (such as IT support, cloud storage, billing, or legal services) and handle patient data, you may be a Business Associate rather than a covered entity. Business associates must also follow HIPAA rules through a signed contract, but they have a distinct legal definition.

Who are considered covered entities under HIPAA?

Under HIPAA, covered entities are defined by the U.S. Department of Health and Human Services (HHS) as health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with standard transactions.

Health Care Providers

  • Doctors, clinics, and hospitals
  • Dentists and orthodontists
  • Pharmacies and laboratories
  • Chiropractors, psychologists, and therapists
  • Nursing homes and long-term care facilities
  • Note: A provider is only covered if they conduct standard electronic transactions, such as electronic billing or insurance claims. Providers who work entirely on paper and do not bill electronically are exempt.

Health Plans

  • Health insurance companies and HMOs
  • Government programs like Medicare and Medicaid
  • Employer-sponsored group health plans
  • Military and veterans' health programs

Health Care Clearinghouses

  • Entities that process nonstandard health data into standard electronic formats (or vice versa), such as billing services or community health management information systems.

Who is not considered a covered entity under HIPAA?

An organization is not a covered entity under HIPAA unless it acts as a health care provider conducting standard electronic transactions, a health plan, or a health care clearinghouse.

Common Non-Covered Entities

  • Employers: General human resources and employment records (such as sick leave, FMLA notes, or drug tests) are not covered, though self-funded group health plans sponsored by employers are covered.
  • Life and Disability Insurers: Companies underwriting or administering life, auto, liability, or disability insurance policies are exempt.
  • Schools and Universities: Student health and education records managed by K–12 schools and colleges are governed by FERPA rather than HIPAA.
  • Fitness and Wellness Apps: Direct-to-consumer fitness trackers, nutrition logs, and step-counting apps that do not process data on behalf of a health plan or provider are not covered.
  • Law Enforcement: Police departments, courts, and correctional agencies do not qualify as covered entities in their regular investigative roles.
  • General Technology Vendors: Cloud hosts, email services, and IT providers are only bound by HIPAA if they sign a Business Associate Agreement to handle protected health information for a covered entity.

What are examples of covered entities?

Under HIPAA, covered entities are divided into three main categories: health care providers, health plans, and health care clearinghouses.

Health Care Providers

Providers who transmit any health information electronically in connection with standard transactions (like billing or claims) are covered entities.

  • Doctors and Physicians: General practitioners, specialists, and surgeons.
  • Clinics and Centers: Urgent care facilities, walk-in clinics, and public health centers.
  • Dentists and Orthodontists: Dental practices and oral surgeons.
  • Hospitals: Acute care, community, and specialty medical centers.
  • Pharmacies: Retail and independent drugstores.
  • Other Specialists: Chiropractors, psychologists, physical therapists, and nursing homes.

Health Plans

Health plans include individual and group plans that provide or pay for the cost of medical care.

  • Health Insurance Companies: Commercial or private insurance providers.
  • Government Programs: Medicare, Medicaid, and military/veterans health programs.
  • HMOs: Health maintenance organizations.
  • Employer-Sponsored Plans: Group health plans managed by companies for their workers.

Health Care Clearinghouses

Clearinghouses process nonstandard health data into standard electronic formats, or vice versa.

  • Billing Services: Companies that reprice, format, or process claims for medical offices.
  • Community Health Management Information Systems: Organizations that translate health data elements.

Can you give me an example of a business associate of a HIPAA covered entity?

An example of a HIPAA business associate is a third-party medical billing company that processes insurance claims and patient invoices for a hospital.

What is a Business Associate?

  • A business associate is a person or organization that performs services for a HIPAA Covered Entity.
  • Their work involves creating, receiving, maintaining, or transmitting Protected Health Information (PHI).
  • They are not a part of the covered entity's own workforce.

Common Examples of Business Associates

  • Cloud hosting providers or offsite data storage companies that store electronic patient records.
  • Managed IT service providers that maintain computer networks containing patient data.
  • Law firms or CPA and accounting firms that require access to patient records to provide legal or financial services.
  • Medical transcription companies that listen to audio files of doctor notes and type them into text.
  • Data shredding companies that destroy physical paper files containing patient names and medical histories.

Requirements

  • Covered entities must sign a formal Business Associate Agreement (BAA) with these vendors before sharing any PHI.
  • This contract legally requires the business associate to protect patient privacy and follow strict security rules.

How Does HIPAA Define Covered Entities And BAs?

9 related questions found

What is the new HIPAA rule in 2026?

The main new HIPAA requirement for 2026 is updating privacy notices under the HHS Model Notices of Privacy Practices to include stricter protections for substance use disorder (SUD) patient records.

Key 2026 Privacy Rule Updates

  • February 16, 2026 Deadline: Healthcare providers and health plans had to update their Notice of Privacy Practices (NPP).
  • Substance Use Records: Notices must now explain how substance use disorder records are protected under 42 CFR Part 2.
  • Legal Protections: Patient records generally cannot be used in civil or criminal legal cases without explicit consent or a court order.
  • Patient Rights: Patients gained clearer rights to restrict sharing, opt out of fundraising, and file complaints.

Proposed Security Rule Changes (Under Review)

Regulators are also pushing a major update to the HIPAA Security Rule that changes how organizations handle data safety:

  • No More "Addressable" Rules: Optional security steps are becoming mandatory.
  • Mandatory MFA: Multi-factor authentication is required across all systems.
  • Required Encryption: Patient data must be encrypted both in transit and at rest.

Do two covered entities need a BAA?

Two covered entities do not need a Business Associate Agreement (BAA) when sharing Protected Health Information (PHI) for routine treatment, payment, or healthcare operations.

When a BAA is NOT Required

  • Treatment: Sharing patient charts or test results between a hospital and a specialist, or a physician and a lab, for direct patient care.
  • Payment & Operations: Exchanging data between two covered entities for joint payment activities or basic healthcare quality assessment operations.
  • According to guidelines from the Department of Health and Human Services, HIPAA allows these direct clinical and operational exchanges without a contract.

When a BAA IS Required Between Covered Entities

  • Acting as a Vendor: If one covered entity performs a non-treatment/non-operations service on behalf of another covered entity (such as a hospital providing third-party billing or IT hosting services for another independent clinic), the providing entity acts as a business associate.
  • In this dual-role scenario, a formal Multi-Party BAA must be executed before sharing PHI.

What three types of entities are covered by HIPAA?

The three types of entities covered by HIPAA (Health Insurance Portability and Accountability Act) are healthcare providers, health plans, and healthcare clearinghouses. You can learn more details directly from the U.S. Department of Health & Human Services guidelines.

1. Healthcare Providers

  • Definition: Individuals or organizations that bill, transmit, or render medical care and services electronically.
  • Examples: Doctors, clinics, dentists, pharmacies, psychologists, chiropractors, and hospitals.

2. Health Plans

  • Definition: Individual and group plans that pay for or provide medical care.
  • Examples: Health insurance companies, HMOs (health maintenance organizations), Medicare, and Medicaid.

3. Healthcare Clearinghouses

  • Definition: Entities that process non-standard health data into standard electronic formats, or vice versa.
  • Examples: Billing services, community health information systems, and electronic data interchange (EDI) translators.

Which entities are exempt from HIPAA and not considered to be covered entities?

HIPAA regulations apply strictly to designated Covered Entities (health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically) and their business associates.

Non-Covered and Exempt Entities

Many organizations that handle health-related information are not considered covered entities under HIPAA:

  • Employers: HIPAA does not apply to employers in their normal capacity or to employment records (such as HR files, sick leave notes, or injury reports), unless the employer sponsors a self-funded health plan that functions separately.
  • Life, Disability, and Auto Insurers: Non-medical insurance lines are excluded from the definition of a health plan under HIPAA rules.
  • Workers' Compensation Carriers: Entities administering workers' compensation claims act outside the scope of HIPAA's standard health plan definitions.
  • Schools and School Districts: Student educational and health records maintained by educational institutions are governed by the Family Educational Rights and Privacy Act (FERPA) rather than HIPAA.
  • Law Enforcement Agencies: Police departments, sheriffs, and correctional facilities are not covered entities when executing public safety or investigative duties.
  • Consumer Health Tech and Wellness Apps: Direct-to-consumer fitness trackers, nutrition apps, and wearable tech companies generally fall outside HIPAA unless they provide direct healthcare services or act as a business associate for a covered entity.
  • Other Non-Healthcare Organizations: Data brokers, marketing vendors, life-style coaching services, and independent researchers who do not receive data from a HIPAA-covered entity are exempt.

Note: While these entities are exempt from direct HIPAA compliance, many remain subject to other federal regulations like the FTC Act or specific state health privacy laws.

What are the three exceptions to HIPAA?

The three specific exceptions under the HIPAA Breach Notification Rule determine whether an unauthorized acquisition, access, or use of Protected Health Information (PHI) constitutes a reportable breach.

The Three Exceptions to a HIPAA Breach

  • Unintentional acquisition, access, or use of PHI: An employee or workforce member accesses PHI unintentionally, in good faith, and within the scope of their authority, without further impermissible disclosure.
  • Inadvertent disclosure between authorized persons: A person authorized to access PHI at a covered entity or business associate accidentally discloses that information to another authorized person within the same organization or arrangement, without further impermissible use.
  • Good faith belief that the recipient could not retain the information: An unauthorized disclosure where the covered entity or business associate has a good faith belief that the unauthorized person who received the PHI could not have reasonably retained it.