What qualifies as a covered entity under HIPAA?

Editorial team Published on

A covered entity under HIPAA is any healthcare provider, health plan, or healthcare clearinghouse that transmits health information in electronic form for standard transactions.

According to the U.S. Department of Health and Human Services, these organizations must follow HIPAA rules to protect patient data.

The Three Types of Covered Entities

  • Healthcare Providers: Doctors, clinics, dentists, pharmacies, psychologists, and hospitals that send patient data electronically for billing or claims.
  • Health Plans: Health insurance companies, HMOs, company health plans, Medicare, and Medicaid.
  • Healthcare Clearinghouses: Companies that translate nonstandard health data into standard electronic formats, or the reverse.

Covered Entities vs. Business Associates

  • Covered Entities create, use, or store primary patient medical data.
  • Business Associates are outside vendors (like billing services or cloud storage providers) that access this data to help a covered entity do its work. They must also follow HIPAA rules.

What are examples of covered entities?

Under HIPAA, covered entities are divided into three main categories: health care providers, health plans, and health care clearinghouses.

Health Care Providers

Providers who transmit any health information electronically in connection with standard transactions (like billing or claims) are covered entities.

  • Doctors and Physicians: General practitioners, specialists, and surgeons.
  • Clinics and Centers: Urgent care facilities, walk-in clinics, and public health centers.
  • Dentists and Orthodontists: Dental practices and oral surgeons.
  • Hospitals: Acute care, community, and specialty medical centers.
  • Pharmacies: Retail and independent drugstores.
  • Other Specialists: Chiropractors, psychologists, physical therapists, and nursing homes.

Health Plans

Health plans include individual and group plans that provide or pay for the cost of medical care.

  • Health Insurance Companies: Commercial or private insurance providers.
  • Government Programs: Medicare, Medicaid, and military/veterans health programs.
  • HMOs: Health maintenance organizations.
  • Employer-Sponsored Plans: Group health plans managed by companies for their workers.

Health Care Clearinghouses

Clearinghouses process nonstandard health data into standard electronic formats, or vice versa.

  • Billing Services: Companies that reprice, format, or process claims for medical offices.
  • Community Health Management Information Systems: Organizations that translate health data elements.

Who is not a HIPAA covered entity?

An organization is not a HIPAA-covered entity if it is not a health care provider conducting standard electronic transactions, a health plan, or a health care clearinghouse.

According to guidelines from the Department of Health and Human Services, HIPAA rules apply strictly to covered entities and their business associates. Many organizations that handle health-related information fall outside this definition.

Common Non-Covered Entities

  • Employers: General human resources records, sick leave notes, and drug tests are excluded, unless the employer operates a self-funded group health plan (and even then, only the plan itself is covered).
  • Schools and Universities: Student health and educational records are governed by the Family Educational Rights and Privacy Act (FERPA) rather than HIPAA.
  • Life and Disability Insurers: Companies underwriting life, auto, liability, or disability insurance are not health plans under HIPAA.
  • Consumer Wellness Apps: Standalone fitness trackers, nutrition logs, and mood apps that collect user data directly do not qualify as covered entities.
  • Law Enforcement and Gyms: Police agencies, fitness clubs, and community groups are exempt unless they provide medical care and bill insurance.

Note: Even if an organization is not a covered entity, it may still be regulated by state privacy laws or the Federal Trade Commission's Health Breach Notification Rule.

What are the three covered entities?

The three categories of covered entities under HIPAA are health care providers, health plans, and health care clearinghouses.

The Three Categories

  • Health Care Providers: Doctors, clinics, dentists, pharmacies, psychologists, and hospitals that transmit any health information in electronic form standard for certain transactions.
  • Health Plans: Health insurance companies, HMOs (health maintenance organizations), company health plans, and government programs like Medicare and Medicaid that pay for medical care.
  • Health Care Clearinghouses: Companies that process nonstandard health data into standard electronic formats, or the reverse, acting as middlemen.

Key Compliance Rules

  • Privacy Rule: Protects the privacy of medical records and personal health data.
  • Security Rule: Requires technical and physical safeguards for electronic health records.
  • Breach Notification Rule: Demands notification if unsecured patient data is compromised.

Which of the following is considered a HIPAA covered entity?

Because you didn't include the choice options in your question, here is the direct answer based on standard HIPAA criteria and common test questions:

A healthcare provider that electronically transmits protected health information (PHI) is considered a HIPAA covered entity.

Under the Health Insurance Portability and Accountability Act (HIPAA), there are three main categories of covered entities:

  • Healthcare Providers: Doctors, clinics, hospitals, psychologists, dentists, chiropractors, nursing homes, and pharmacies—provided they transmit any health information electronically in connection with a standard transaction (like billing or insurance claims).
  • Health Plans: Health insurance companies, HMOs, employer-sponsored group health plans, and government programs like Medicare, Medicaid, and military/veterans' health programs.
  • Healthcare Clearinghouses: Organizations that process nonstandard health information into standard formats (or vice versa), such as billing services or community health management information systems.

❌ Common Incorrect Options (Non-Covered Entities)

If you are matching this against a specific multiple-choice test, the following options are typically incorrect (they are not covered entities):

  • Medical device manufacturers / vendors (Usually classified as "business associates" if they handle PHI, or not covered at all).
  • Patient advocacy groups or independent health apps.
  • Life insurance companies or auto insurance companies (where health coverage is not the principal activity).
  • A pharmacy or provider that does not transmit electronic health data.

If your quiz has different choices, please reply with the options and I will gladly select the correct one for you!

What are HIPAA Covered Entities?

9 related questions found

How do I know if my business is a covered entity under HIPAA?

You are a HIPAA covered entity only if your organization fits into one of three specific categories defined by the U.S. Department of Health and Human Services (HHS).

The Three Types of Covered Entities

  • Health Care Providers: Doctors, clinics, dentists, psychologists, chiropractors, nursing homes, and pharmacies. However, providers only qualify if they transmit health information electronically in standard transactions (such as electronic billing or insurance claims). Providers who only bill by paper or cash do not qualify.
  • Health Plans: Health insurance companies, HMOs, company health plans, Medicare, and Medicaid.
  • Health Care Clearinghouses: Entities that process non-standard health data into standard electronic formats (or the reverse) for other organizations.

What If You Work With a Covered Entity?

If you provide services to a covered entity (such as IT support, cloud storage, billing, or legal services) and handle patient data, you may be a Business Associate rather than a covered entity. Business associates must also follow HIPAA rules through a signed contract, but they have a distinct legal definition.

What entities are exempt from HIPAA and not considered to be covered entities?

Entities that are exempt from HIPAA and not considered covered entities include employers, life insurance companies, law enforcement agencies, and schools.

HIPAA (the Health Insurance Portability and Accountability Act) only applies to specific groups: healthcare providers who transmit data electronically, health plans, and healthcare clearinghouses. If an organization does not fit these categories and does not process standard electronic health transactions, it is exempt.

Common Non-Covered Entities

  • Employers: Companies acting in their normal capacity as employers are not covered, even when they hold employee health or sick leave records (though employer-sponsored group health plans themselves may have separate rules).
  • Life and Disability Insurers: Companies providing life, disability, auto, or liability insurance operate outside of HIPAA.
  • Workers' Compensation Carriers: State programs and private carriers handling workers' compensation claims are exempt.
  • Law Enforcement Agencies: Police departments, sheriffs, and correctional facilities do not qualify as covered entities when gathering information for public safety or investigations.
  • Schools and School Districts: Educational records and student health information maintained by K-12 schools or universities are instead governed by FERPA (the Family Educational Rights and Privacy Act).
  • Consumer Tech and Fitness Apps: Health social media apps, wearable fitness trackers, and direct-to-consumer genetic testing services are generally not regulated by HIPAA unless they operate directly on behalf of a covered provider.
  • Paper-Only Healthcare Providers: Doctors or clinics that only use paper records and the postal service—never transmitting standard electronic claims or data—are not covered.

What is considered a covered entity under HIPAA?

A covered entity under HIPAA is any health plan, health care clearinghouse, or qualifying health care provider that transmits health information in electronic form for standard transactions.

The Three Categories of Covered Entities

  • Health Care Providers: Doctors, clinics, dentists, pharmacies, psychologists, and nursing homes that conduct standard electronic transactions like billing or claims.
  • Health Plans: Health insurance companies, HMOs, company-sponsored health plans, Medicare, and Medicaid.
  • Health Care Clearinghouses: Entities that process nonstandard health data into a standard electronic format (or the reverse) for other organizations.

Important Distinction: Business Associates

  • Business Associates: Vendors or contractors (such as cloud storage providers, billing services, or IT consultants) that handle protected health information on behalf of a covered entity. They must follow HIPAA rules via a contract, but they are separate from covered entities.

What are three exceptions to HIPAA?

The three specific exceptions under the HIPAA Breach Notification Rule define when unauthorized access to or acquisition of protected health information (PHI) is not legally considered a reportable breach.

Three Core Exceptions to a HIPAA Breach

  • Unintentional Acquisition, Access, or Use of PHI: An employee or workforce member accesses health data accidentally in good faith and within their authorized scope of work, without further improper disclosure. (Example: A nurse accidentally opens the wrong electronic chart but closes it immediately upon realizing the error.)
  • Inadvertent Disclosure Between Authorized Persons: A person who is authorized to access PHI mistakenly shares it with another authorized person within the same organization or health care arrangement. (Example: Two clinicians with proper authorization mistakenly swap a verbal update using the wrong patient file name, but the recipient cannot retain or misuse the data.)
  • Unauthorized Disclosure Where Data Cannot Be Retained: An unauthorized recipient receives PHI, but the covered entity has a good-faith belief that the person could not have reasonably retained or compromised the information. (Example: A misdirected fax or email sent to an external party who immediately calls to report it and confirms they did not read, save, or print the document.)

Other Common Exceptions to HIPAA Privacy Rules

Beyond breach notification, the Department of Health and Human Services (HHS) allows the disclosure of PHI without patient authorization in specific public interest scenarios, including:

  • Treatment, payment, and healthcare operations (TPO)
  • Public health activities and disease reporting
  • Judicial and administrative court orders
  • Law enforcement and public safety threats
  • Workers' compensation compliance

What are the 10 most common HIPAA violations?

The 10 most common HIPAA violations involve mishandling protected health information (PHI) through employee error, weak security, or administrative oversight.

Top 10 Most Common Violations

  • Employee Snooping: Accessing patient files, family records, or coworker charts without a direct, professional need to know.
  • Lost or Stolen Devices: Leaving unencrypted laptops, smartphones, tablets, or USB drives where they can be stolen or accessed by outsiders.
  • Failure to Conduct Risk Analyses: Neglecting regular, organization-wide checkups to find and fix security gaps.
  • Improper Disposal of Records: Tossing paper charts in regular trash or failing to securely wipe old hard drives.
  • Weak Passwords and Access Controls: Using simple passwords or giving too many staff members broad, unmonitored access to electronic records (ePHI).
  • Unauthorized Texting or Emailing: Sending patient details over regular, unsecured text messages or standard email instead of encrypted platforms.
  • Missing Business Associate Agreements (BAAs): Failing to sign legal BAA contracts with outside vendors and cloud providers who handle patient data.
  • Delayed Breach Notifications: Missing the legal deadline to notify patients, the government, and the media within 60 days of discovering a data breach.
  • Inadequate Employee Training: Not providing regular, documented privacy and security awareness education for staff.
  • Denying or Delaying Patient Access: Taking longer than allowed (or refusing outright) to give patients copies of their own medical records.