What must a covered entity do?

Editorial team Published on

Covered entities are required to comply with HIPAA Rules to protect the privacy, security, and confidentiality of Protected Health Information (PHI).

Core Requirements for Covered Entities

  • Protect PHI: Safeguard patient health data from unauthorized use or disclosure.
  • Assign Responsibility: Designate a privacy and security officer to oversee compliance.
  • Conduct Risk Assessments: Regularly evaluate potential security risks and vulnerabilities.
  • Provide Staff Training: Train employees on proper handling of protected health information.
  • Maintain Documentation: Keep written policies, procedures, and records for at least six years.
  • Establish Business Associate Agreements: Put written contracts in place with vendors or partners who handle PHI.

What are the three covered entities that must comply with HIPAA?

The three categories of covered entities that must comply with HIPAA are health plans, healthcare clearinghouses, and healthcare providers.

1. Healthcare Providers

  • Definition: Doctors, clinics, hospitals, psychologists, dentists, chiropractors, nursing homes, and pharmacies.
  • Requirement: They must transmit any health information in an electronic form connected with standard HIPAA transactions (like billing or claims).

2. Health Plans

  • Definition: Individual and group health insurance plans, Health Maintenance Organizations (HMOs), company health plans, and government programs like Medicare and Medicaid.
  • Requirement: They provide or pay the cost of medical care.

3. Healthcare Clearinghouses

  • Definition: Billing services, community health information systems, and value-added networks.
  • Requirement: They process nonstandard health data into standard electronic formats, or the reverse, when acting for another organization.

Which standard is a covered entity's primary responsibility to comply with?

A covered entity's primary responsibility is to comply with standards regarding the use and disclosure of Protected Health Information (PHI) under the HIPAA Privacy Rule.

Core Compliance Standards

  • Use and Disclosure: Limiting the sharing and handling of patient medical data to permitted purposes.
  • Minimum Necessary Standard: Restricting PHI access only to what is required for a specific task.
  • Patient Rights: Allowing individuals to view, copy, or correct their own health records.
  • Administrative Safeguards: Training staff, appointing a privacy officer, and writing security policies.

Related Rules to Follow

  • Security Rule: Protecting electronic medical records (ePHI) with technical and physical safety controls.
  • Breach Notification Rule: Reporting unsecured data leaks or hacks promptly.

Do covered entities need to comply with HIPAA?

Yes, covered entities must comply with HIPAA Rules to protect patient privacy and security.

Who Qualifies as a Covered Entity

  • Health Care Providers: Doctors, clinics, hospitals, and psychologists who transmit health information electronically for standard transactions.
  • Health Plans: Health insurance companies, HMOs, company health plans, and government programs like Medicare.
  • Health Care Clearinghouses: Entities that process nonstandard health data into standard formats (or vice versa).

Core Compliance Rules

  • Privacy Rule: Controls how Protected Health Information (PHI) is used and shared, granting patients rights to view their records.
  • Security Rule: Requires administrative, physical, and technical safeguards for electronic PHI.
  • Breach Notification Rule: Mandates alerting affected individuals and the government if a data breach occurs.

Which excludes a provider from being considered a covered entity?

A healthcare provider is excluded from being considered a HIPAA covered entity if they do not transmit any health information electronically in connection with standard transactions (such as electronic billing, claims, or eligibility inquiries).

Key Rules for Provider Exclusion

  • No Electronic Transactions: A provider who handles paper-only records and submits zero standard electronic claims (or doesn't use a billing service/clearinghouse to do so electronically) is not a covered entity.
  • Cash-Only Practices: Providers operating strictly on a cash or check basis who never engage in electronic data interchange (EDI) for covered transactions fall outside HIPAA's direct scope.
  • Spiritual Healing: Practitioners who provide health care solely through spiritual methods are not considered healthcare providers under the regulation, excluding them as well.

What are Covered Entities?

9 related questions found

What group is not one of the three covered entities?

Depending on the context of the question or the specific multiple-choice options you are choosing from, the group that is not one of the three covered entities under HIPAA is typically Patients or Business Associates.

Other common incorrect choices (groups that are not covered entities) include employers, life insurers, or schools.

Why these are incorrect options

  • ❌ Patients: HIPAA is a federal law designed to protect the privacy and security of a patient's medical information. The law assigns compliance responsibilities to the organizations handling the data, meaning patients themselves are the beneficiaries of these rights, not the covered entities.
  • ❌ Business Associates: While contractors and vendors (like IT companies or billing services) must comply with HIPAA rules by signing a Business Associate Agreement (BAA), they are legally distinct from the three core "covered entities".
  • ❌ Employers / Life Insurers / Schools: These groups generally handle health data for employment, insurance underwriting, or educational records (which fall under FERPA), meaning they are excluded from direct HIPAA coverage.

The actual three covered entities

To help you narrow down your specific multiple-choice options, the only three official groups designated as Covered Entities under the HIPAA Privacy Rule are:

  1. Healthcare Providers: Doctors, clinics, psychologists, dentists, chiropractors, nursing homes, and pharmacies that transmit health information electronically.
  2. Health Plans: Health insurance companies, HMOs, company group health plans, and government programs like Medicare and Medicaid.
  3. Healthcare Clearinghouses: Entities that process nonstandard health information into standard formats (and vice versa), such as billing services and community health information systems.

Do two covered entities need a BAA?

Two covered entities do not need a Business Associate Agreement (BAA) when sharing Protected Health Information (PHI) for routine treatment, payment, or healthcare operations.

When a BAA is NOT Required

  • Treatment: Sharing patient charts or test results between a hospital and a specialist, or a physician and a lab, for direct patient care.
  • Payment & Operations: Exchanging data between two covered entities for joint payment activities or basic healthcare quality assessment operations.
  • According to guidelines from the Department of Health and Human Services, HIPAA allows these direct clinical and operational exchanges without a contract.

When a BAA IS Required Between Covered Entities

  • Acting as a Vendor: If one covered entity performs a non-treatment/non-operations service on behalf of another covered entity (such as a hospital providing third-party billing or IT hosting services for another independent clinic), the providing entity acts as a business associate.
  • In this dual-role scenario, a formal Multi-Party BAA must be executed before sharing PHI.

What are the key responsibilities of covered entities under the HIPAA security rule?

The key responsibility of covered entities under the HIPAA Security Rule is to ensure the confidentiality, integrity, and availability of all electronic protected health information (ePHI) they create, receive, maintain, or transmit.

To achieve this, covered entities (such as health plans, clearinghouses, and certain healthcare providers) must build a security program based on three main categories of safeguards:

Administrative Safeguards

  • Security Management Process: Perform regular risk analyses and implement risk management policies to neutralize threats.
  • Assigned Security Responsibility: Designate a specific security official responsible for the development and oversight of policies.
  • Workforce Security and Training: Screen personnel, grant appropriate access, and provide ongoing security awareness training.
  • Security Incident Procedures: Detect, document, and respond to security incidents and potential data breaches.
  • Contingency Planning: Create disaster recovery, backup, and emergency mode operation plans.
  • Vendor Oversight: Execute and manage written Business Associate Agreements (BAAs) with third-party vendors who handle ePHI.

Physical Safeguards

  • Facility Access Controls: Limit physical access to buildings and equipment housing ePHI using locks, badges, or visitor logs.
  • Workstation and Device Security: Protect physical computer terminals and electronic media from unauthorized access or theft.

Technical Safeguards

  • Access Control: Restrict access to ePHI to authorized users via unique user IDs, emergency access procedures, and encryption.
  • Audit Controls: Implement hardware, software, or procedural mechanisms to record and examine activity in systems containing ePHI.
  • Integrity Controls: Protect ePHI from improper alteration or destruction.
  • Transmission Security: Guard against unauthorized access to ePHI being transmitted across an electronic network (such as via encryption).

Documentation and Retention

  • Written Policies: Maintain all security policies, procedures, and related compliance documentation in written or electronic form.
  • Six-Year Retention: Retain all documentation for six years from the date of its creation or the date when it was last in effect, whichever is later.

What is the first step a covered entity is expected to take?

According to HIPAA standards, the first step a covered entity is expected to take when a business associate violates a standard or a breach occurs is to take reasonable steps to resolve or cure the violation.

Details of the Initial Response

  • Assess the situation: Figure out how bad the breach or rule-breaking is.
  • Fix the problem: Put corrective actions in place to stop further harm.
  • Next options: If reasonable steps fail to fix the issue, the covered entity may need to end the contract or report the incident to the government.

What are examples of covered entities?

Under HIPAA, covered entities are divided into three main categories: health care providers, health plans, and health care clearinghouses.

Health Care Providers

Providers who transmit any health information electronically in connection with standard transactions (like billing or claims) are covered entities.

  • Doctors and Physicians: General practitioners, specialists, and surgeons.
  • Clinics and Centers: Urgent care facilities, walk-in clinics, and public health centers.
  • Dentists and Orthodontists: Dental practices and oral surgeons.
  • Hospitals: Acute care, community, and specialty medical centers.
  • Pharmacies: Retail and independent drugstores.
  • Other Specialists: Chiropractors, psychologists, physical therapists, and nursing homes.

Health Plans

Health plans include individual and group plans that provide or pay for the cost of medical care.

  • Health Insurance Companies: Commercial or private insurance providers.
  • Government Programs: Medicare, Medicaid, and military/veterans health programs.
  • HMOs: Health maintenance organizations.
  • Employer-Sponsored Plans: Group health plans managed by companies for their workers.

Health Care Clearinghouses

Clearinghouses process nonstandard health data into standard electronic formats, or vice versa.

  • Billing Services: Companies that reprice, format, or process claims for medical offices.
  • Community Health Management Information Systems: Organizations that translate health data elements.