What are considered entities under HIPAA?

Editorial team Published on

Under HIPAA, covered entities include three primary groups that create, receive, or transmit protected health information: healthcare providers, health plans, and healthcare clearinghouses.

You can review formal guidelines directly through the U.S. Department of Health & Human Services.

1. Healthcare Providers

Healthcare providers are covered if they transmit any health information electronically in connection with standard transactions (such as billing, insurance claims, or eligibility verifications).

  • Doctors, physicians, and specialists
  • Clinics, hospitals, and outpatient surgery centers
  • Dentists, orthodontists, and oral surgeons
  • Psychologists and licensed therapists
  • Chiropractors and physical therapists
  • Pharmacies (community, mail-order, and specialty)
  • Nursing homes and home health agencies

2. Health Plans

Health plans are individual and group organizations that pay for or provide medical care and health benefits.

  • Health insurance companies
  • Health maintenance organizations (HMOs)
  • Employer-sponsored health plans
  • Government healthcare programs (Medicare, Medicaid, and military/veterans health programs)

3. Healthcare Clearinghouses

Clearinghouses process nonstandard health information or data received from another entity into a standard electronic format (or vice versa).

  • Billing services
  • Community health management information systems
  • Value-added networks that translate data interchange formats

What entities are not covered under HIPAA?

Organizations that do not function as a health plan, health care clearinghouse, or a health care provider conducting standard electronic transactions are not covered under HIPAA.

Common Non-Covered Entities

  • Employers and HR Departments: Handling general employment records, FMLA notes, or ADA accommodations in their role as an employer.
  • Life and Disability Insurers: Managing underwriting or non-medical insurance policies.
  • Schools and School Districts: Maintaining student health and education records governed instead by FERPA.
  • Consumer Fitness and Wellness Apps: Collecting direct-to-consumer data like steps, sleep, or mood tracking outside of a clinical program.
  • Wearable Device Makers: Storing biosensor or heart-rate data directly on hardware or consumer apps.
  • Law Enforcement and Legal Agencies: Processing police reports, investigative case files, or court records.
  • Workers' Compensation Carriers: Administering claims under state workers' compensation laws.

Who are the 3 primary covered entities under HIPAA?

The three primary categories of covered entities under the Health Insurance Portability and Accountability Act (HHS.gov) are healthcare providers, health plans, and healthcare clearinghouses.

As outlined by the Department of Health and Human Services, these groups must protect patient data and comply with HIPAA rules:

1. Healthcare Providers

  • Definition: Doctors, clinics, hospitals, psychologists, dentists, chiropractors, nursing homes, and pharmacies.
  • Rule for coverage: They are only covered entities if they transmit health information in electronic form for standard transactions (like billing or insurance claims).

2. Health Plans

  • Definition: Organizations that pay for or provide medical care.
  • Examples: Health insurance companies, HMOs (Health Maintenance Organizations), employer-sponsored group health plans, and government programs like Medicare and Medicaid.

3. Healthcare Clearinghouses

  • Definition: Entities that process nonstandard health information into a standard electronic format, or the reverse, acting as middlemen between providers and payers.
  • Examples: Billing services, community health management information systems, and value-added networks that reformat data.

How do I know if my business is a covered entity under HIPAA?

You are a HIPAA covered entity only if your organization fits into one of three specific categories defined by the U.S. Department of Health and Human Services (HHS).

The Three Types of Covered Entities

  • Health Care Providers: Doctors, clinics, dentists, psychologists, chiropractors, nursing homes, and pharmacies. However, providers only qualify if they transmit health information electronically in standard transactions (such as electronic billing or insurance claims). Providers who only bill by paper or cash do not qualify.
  • Health Plans: Health insurance companies, HMOs, company health plans, Medicare, and Medicaid.
  • Health Care Clearinghouses: Entities that process non-standard health data into standard electronic formats (or the reverse) for other organizations.

What If You Work With a Covered Entity?

If you provide services to a covered entity (such as IT support, cloud storage, billing, or legal services) and handle patient data, you may be a Business Associate rather than a covered entity. Business associates must also follow HIPAA rules through a signed contract, but they have a distinct legal definition.

Can you give me an example of a covered entity under HIPAA?

A standard example of a covered entity under HIPAA is a local family doctor's office or hospital that submits patient insurance claims electronically.

Categories of Covered Entities

Under the guidelines provided by the U.S. Department of Health and Human Services (HHS), covered entities fall into three distinct groups:

  • Health Care Providers: Doctors, clinics, dentists, pharmacies, and hospitals count as covered entities if they transmit any health information electronically in standard transactions (such as filing claims or checking insurance eligibility).
  • Health Plans: Health insurance companies, HMOs (health maintenance organizations), company-sponsored health plans, and government programs like Medicare and Medicaid manage and pay for care.
  • Health Care Clearinghouses: Entities that process non-standard health data into standard electronic formats (or vice versa) for other organizations.

What are HIPAA Covered Entities?

9 related questions found

What are entities under HIPAA?

Under the Health Insurance Portability and Accountability Act (HIPAA), regulated groups are known as covered entities, alongside their supporting business associates.

You can learn more about official definitions through the HHS Covered Entities Guide.

1. Healthcare Providers

  • Definition: Doctors, clinics, hospitals, pharmacies, dentists, and chiropractors who transmit any health information electronically in connection with standard transactions (such as billing or insurance claims).
  • Examples: Physical therapists, psychologists, nursing homes, and medical laboratories.

2. Health Plans

  • Definition: Individual or group plans that provide or pay the cost of medical care.
  • Examples: Health insurance companies, HMOs, company health plans, Medicare, and Medicaid.

3. Healthcare Clearinghouses

  • Definition: Entities that process nonstandard health information from another party into a standard electronic format (or vice versa).
  • Examples: Billing services and community health management information systems that reformat data claims.

4. Business Associates

  • Definition: External vendors or persons who perform tasks on behalf of a covered entity that involve access to protected health information.
  • Examples: Cloud storage providers, IT consultants, legal counsel, billing companies, and electronic health record (EHR) vendors. They must sign a Business Associate Agreement (BAA).

What are the 10 most common HIPAA violations?

The 10 most common HIPAA violations involve mishandling protected health information (PHI) through employee error, weak security, or administrative oversight.

Top 10 Most Common Violations

  • Employee Snooping: Accessing patient files, family records, or coworker charts without a direct, professional need to know.
  • Lost or Stolen Devices: Leaving unencrypted laptops, smartphones, tablets, or USB drives where they can be stolen or accessed by outsiders.
  • Failure to Conduct Risk Analyses: Neglecting regular, organization-wide checkups to find and fix security gaps.
  • Improper Disposal of Records: Tossing paper charts in regular trash or failing to securely wipe old hard drives.
  • Weak Passwords and Access Controls: Using simple passwords or giving too many staff members broad, unmonitored access to electronic records (ePHI).
  • Unauthorized Texting or Emailing: Sending patient details over regular, unsecured text messages or standard email instead of encrypted platforms.
  • Missing Business Associate Agreements (BAAs): Failing to sign legal BAA contracts with outside vendors and cloud providers who handle patient data.
  • Delayed Breach Notifications: Missing the legal deadline to notify patients, the government, and the media within 60 days of discovering a data breach.
  • Inadequate Employee Training: Not providing regular, documented privacy and security awareness education for staff.
  • Denying or Delaying Patient Access: Taking longer than allowed (or refusing outright) to give patients copies of their own medical records.

What are the 5 main HIPAA rules?

The five main rules of the Health Insurance Portability and Accountability Act (HIPAA) are the Privacy Rule, Security Rule, Breach Notification Rule, Transactions and Code Sets Rule, and Unique Identifiers Rule.

1. The Privacy Rule

  • What it does: Controls how protected health information (PHI) is used and shared by healthcare providers and plans.
  • Key right: Gives patients the right to view, get copies of, and request corrections to their medical records.

2. The Security Rule

  • What it does: Protects electronic protected health information (ePHI).
  • Key controls: Requires administrative, physical, and technical safeguards—such as encryption and access controls—to secure digital medical data.

3. The Breach Notification Rule

  • What it does: Requires healthcare groups to report compromised PHI.
  • Key requirement: Mandates notifying affected individuals, the government, and sometimes the media without unreasonable delay (within 60 days).

4. The Transactions and Code Sets Rule

  • What it does: Standardizes electronic billing and data exchanges.
  • Key goal: Makes healthcare claims and transactions uniform and efficient by using standard coding formats like ICD-10.

5. The Unique Identifiers Rule

  • What it does: Assigns standard identification numbers to healthcare participants.
  • Key example: Requires providers to use a unique 10-digit National Provider Identifier (NPI).

What group is not one of the three covered entities?

Depending on the context of the question or the specific multiple-choice options you are choosing from, the group that is not one of the three covered entities under HIPAA is typically Patients or Business Associates.

Other common incorrect choices (groups that are not covered entities) include employers, life insurers, or schools.

Why these are incorrect options

  • ❌ Patients: HIPAA is a federal law designed to protect the privacy and security of a patient's medical information. The law assigns compliance responsibilities to the organizations handling the data, meaning patients themselves are the beneficiaries of these rights, not the covered entities.
  • ❌ Business Associates: While contractors and vendors (like IT companies or billing services) must comply with HIPAA rules by signing a Business Associate Agreement (BAA), they are legally distinct from the three core "covered entities".
  • ❌ Employers / Life Insurers / Schools: These groups generally handle health data for employment, insurance underwriting, or educational records (which fall under FERPA), meaning they are excluded from direct HIPAA coverage.

The actual three covered entities

To help you narrow down your specific multiple-choice options, the only three official groups designated as Covered Entities under the HIPAA Privacy Rule are:

  1. Healthcare Providers: Doctors, clinics, psychologists, dentists, chiropractors, nursing homes, and pharmacies that transmit health information electronically.
  2. Health Plans: Health insurance companies, HMOs, company group health plans, and government programs like Medicare and Medicaid.
  3. Healthcare Clearinghouses: Entities that process nonstandard health information into standard formats (and vice versa), such as billing services and community health information systems.

Do two covered entities need a BAA?

Two covered entities do not need a Business Associate Agreement (BAA) when sharing Protected Health Information (PHI) for routine treatment, payment, or healthcare operations.

When a BAA is NOT Required

  • Treatment: Sharing patient charts or test results between a hospital and a specialist, or a physician and a lab, for direct patient care.
  • Payment & Operations: Exchanging data between two covered entities for joint payment activities or basic healthcare quality assessment operations.
  • According to guidelines from the Department of Health and Human Services, HIPAA allows these direct clinical and operational exchanges without a contract.

When a BAA IS Required Between Covered Entities

  • Acting as a Vendor: If one covered entity performs a non-treatment/non-operations service on behalf of another covered entity (such as a hospital providing third-party billing or IT hosting services for another independent clinic), the providing entity acts as a business associate.
  • In this dual-role scenario, a formal Multi-Party BAA must be executed before sharing PHI.