What are covered entities required to do?

Editorial team Published on

Covered entities are required to comply with HIPAA Rules to protect the privacy, security, and confidentiality of Protected Health Information (PHI).

Core Requirements for Covered Entities

  • Protect PHI: Safeguard patient health data from unauthorized use or disclosure.
  • Assign Responsibility: Designate a privacy and security officer to oversee compliance.
  • Conduct Risk Assessments: Regularly evaluate potential security risks and vulnerabilities.
  • Provide Staff Training: Train employees on proper handling of protected health information.
  • Maintain Documentation: Keep written policies, procedures, and records for at least six years.
  • Establish Business Associate Agreements: Put written contracts in place with vendors or partners who handle PHI.

What are examples of covered entities?

Under HIPAA, covered entities are divided into three main categories: health care providers, health plans, and health care clearinghouses.

Health Care Providers

Providers who transmit any health information electronically in connection with standard transactions (like billing or claims) are covered entities.

  • Doctors and Physicians: General practitioners, specialists, and surgeons.
  • Clinics and Centers: Urgent care facilities, walk-in clinics, and public health centers.
  • Dentists and Orthodontists: Dental practices and oral surgeons.
  • Hospitals: Acute care, community, and specialty medical centers.
  • Pharmacies: Retail and independent drugstores.
  • Other Specialists: Chiropractors, psychologists, physical therapists, and nursing homes.

Health Plans

Health plans include individual and group plans that provide or pay for the cost of medical care.

  • Health Insurance Companies: Commercial or private insurance providers.
  • Government Programs: Medicare, Medicaid, and military/veterans health programs.
  • HMOs: Health maintenance organizations.
  • Employer-Sponsored Plans: Group health plans managed by companies for their workers.

Health Care Clearinghouses

Clearinghouses process nonstandard health data into standard electronic formats, or vice versa.

  • Billing Services: Companies that reprice, format, or process claims for medical offices.
  • Community Health Management Information Systems: Organizations that translate health data elements.

What is not considered a covered entity?

An organization is not considered a covered entity under HIPAA if it does not operate as a health care provider conducting standard electronic transactions, a health plan, or a health care clearinghouse.

Under the Health Insurance Portability and Accountability Act (HIPAA Rules applicability), only specific groups handling protected health information in designated ways must follow the primary privacy and security rules.

Common Examples of Non-Covered Entities

  • Employers: Companies acting in their role as an employer (handling HR files, FMLA, or sick leave notes) are not covered entities.
  • Life and Disability Insurers: Companies underwriting or managing life, auto, liability, or disability insurance policies are not covered entities.
  • Schools and Educational Institutions: Student health and education records managed by K-12 schools or universities fall under FERPA instead of HIPAA.
  • Fitness and Wellness Apps: Consumer sleep, step, or heart-rate apps that collect data directly from users are not covered entities.
  • Workers' Compensation Carriers: Programs paying solely for work injury claims do not qualify as HIPAA health plans.

Important Distinctions

  • Business Associates: An entity like a cloud vendor, billing service, or third-party administrator is a Business Associate rather than a covered entity. They must sign a contract (Business Associate Agreement) to protect data, but they are classified differently.
  • Other Laws Apply: Even if an organization is not a HIPAA covered entity, it may still face rules under state privacy laws or the Federal Trade Commission.

Do two covered entities need a BAA?

Two covered entities do not need a Business Associate Agreement (BAA) when sharing Protected Health Information (PHI) for routine treatment, payment, or healthcare operations.

When a BAA is NOT Required

  • Treatment: Sharing patient charts or test results between a hospital and a specialist, or a physician and a lab, for direct patient care.
  • Payment & Operations: Exchanging data between two covered entities for joint payment activities or basic healthcare quality assessment operations.
  • According to guidelines from the Department of Health and Human Services, HIPAA allows these direct clinical and operational exchanges without a contract.

When a BAA IS Required Between Covered Entities

  • Acting as a Vendor: If one covered entity performs a non-treatment/non-operations service on behalf of another covered entity (such as a hospital providing third-party billing or IT hosting services for another independent clinic), the providing entity acts as a business associate.
  • In this dual-role scenario, a formal Multi-Party BAA must be executed before sharing PHI.

What are the security rule's basic requirements for covered entities?

The HIPAA Security Rule requires covered entities to protect electronic protected health information (ePHI) by implementing reasonable administrative, physical, and technical safeguards.

The core goal is to maintain the Confidentiality, Integrity, and Availability (known as the CIA triad) of all electronic health data.

Core Objectives

Covered entities must:

  • Ensure the confidentiality, integrity, and availability of all ePHI they create, receive, maintain, or transmit.
  • Protect against any reasonably anticipated threats or hazards to the security of the data.
  • Protect against any reasonably anticipated uses or disclosures of information that are not permitted.
  • Ensure compliance across their workforce.

The Three Safeguard Categories

1. Administrative Safeguards (Management and Policies)

  • Security Management Process: Perform a thorough risk analysis to identify potential vulnerabilities and implement measures to reduce risks to a reasonable level.
  • Assigned Security Responsibility: Designate a specific security official in charge of creating and enacting security policies.
  • Workforce Security: Ensure employees have the proper authorization and supervision when accessing ePHI.
  • Information Access Management: Restrict access to data based on user roles and job duties.
  • Security Awareness and Training: Provide ongoing security training for all staff members, including applying sanctions for policy violations.
  • Contingency Plan: Create disaster recovery and data backup plans for emergencies.

2. Physical Safeguards (Hardware and Facilities)

  • Facility Access Control: Limit physical access to buildings and equipment housing ePHI.
  • Workstation Use and Security: Ensure physical workstations and mobile devices that access ePHI are secure and properly positioned to prevent unauthorized viewing.

3. Technical Safeguards (Technology and Access)

  • Access Control: Use unique user names and emergency access procedures to restrict computer system entry.
  • Audit Controls: Track activity on systems that contain or use ePHI.
  • Integrity Controls: Protect data from improper alteration or destruction.
  • Transmission Security: Use encryption and secure networks to guard ePHI sent over electronic communications.

Documentation Requirements

  • Covered entities must keep written records of all policies, procedures, and security actions.
  • These records must be stored and retained for six years from the date they were created or last in effect.

What are HIPAA Covered Entities?

9 related questions found

What must a covered entity do?

Covered entities are required to comply with HIPAA Rules to protect the privacy, security, and confidentiality of Protected Health Information (PHI).

Core Requirements for Covered Entities

  • Protect PHI: Safeguard patient health data from unauthorized use or disclosure.
  • Assign Responsibility: Designate a privacy and security officer to oversee compliance.
  • Conduct Risk Assessments: Regularly evaluate potential security risks and vulnerabilities.
  • Provide Staff Training: Train employees on proper handling of protected health information.
  • Maintain Documentation: Keep written policies, procedures, and records for at least six years.
  • Establish Business Associate Agreements: Put written contracts in place with vendors or partners who handle PHI.

What are three types of covered entities?

Under the Health Insurance Portability and Accountability Act (HIPAA), the three types of covered entities are health care providers, health plans, and health care clearinghouses.

1. Health Care Providers

  • Definition: Doctors, clinics, hospitals, pharmacies, dentists, and chiropractors who transmit health information electronically for standard transactions like billing.
  • Role: They provide direct care and treatment while generating and handling patient health records.

2. Health Plans

  • Definition: Health insurance companies, HMOs (Health Maintenance Organizations), company health plans, Medicare, and Medicaid.
  • Role: They provide or pay the cost of medical care and health services.

3. Health Care Clearinghouses

  • Definition: Billing services, community health management information systems, and value-added networks.
  • Role: They act as middlemen who process non-standard health data into a standard electronic format (or vice versa) between providers and insurance payers.

What excludes a provider from being considered a covered entity?

A healthcare provider is excluded from being considered a HIPAA covered entity if they do not transmit any health information electronically in connection with standard transactions (such as electronic billing, claims, or eligibility inquiries).

Key Rules for Provider Exclusion

  • No Electronic Transactions: A provider who handles paper-only records and submits zero standard electronic claims (or doesn't use a billing service/clearinghouse to do so electronically) is not a covered entity.
  • Cash-Only Practices: Providers operating strictly on a cash or check basis who never engage in electronic data interchange (EDI) for covered transactions fall outside HIPAA's direct scope.
  • Spiritual Healing: Practitioners who provide health care solely through spiritual methods are not considered healthcare providers under the regulation, excluding them as well.

What is meant by covered entity?

A covered entity is any health plan, health care clearinghouse, or health care provider that transmits health information in electronic form under the Health Insurance Portability and Accountability Act (HIPAA).

According to guidelines from the U.S. Department of Health and Human Services (HHS), these organizations must follow strict federal rules to protect patient privacy and secure health data.

The Three Main Categories

  • Health Plans: Individual and group plans that pay for medical care. This includes health insurance companies, HMOs, employer-sponsored health plans, and government programs like Medicare and Medicaid.
  • Health Care Clearinghouses: Entities that process nonstandard health data into standard formats (or the reverse) on behalf of other organizations.
  • Health Care Providers: Doctors, clinics, psychologists, dentists, pharmacies, nursing homes, and hospitals that transmit any health data electronically for standard transactions like billing or claims.

Why the Definition Matters

  • Compliance: Only entities that fit these definitions (and handle electronic data transactions) are legally bound by HIPAA Privacy and Security Rules.
  • Business Associates: Vendors or partners who work with a covered entity and handle protected health information (such as billing services or cloud storage providers) are called Business Associates rather than covered entities, though they must also sign agreements to protect data.

Do covered entities need to comply with HIPAA?

Yes, covered entities must comply with HIPAA Rules to protect patient privacy and security.

Who Qualifies as a Covered Entity

  • Health Care Providers: Doctors, clinics, hospitals, and psychologists who transmit health information electronically for standard transactions.
  • Health Plans: Health insurance companies, HMOs, company health plans, and government programs like Medicare.
  • Health Care Clearinghouses: Entities that process nonstandard health data into standard formats (or vice versa).

Core Compliance Rules

  • Privacy Rule: Controls how Protected Health Information (PHI) is used and shared, granting patients rights to view their records.
  • Security Rule: Requires administrative, physical, and technical safeguards for electronic PHI.
  • Breach Notification Rule: Mandates alerting affected individuals and the government if a data breach occurs.