What type of insurance is not covered under HIPAA?

Editorial team Published on

Workers' compensation and programs providing only excepted benefits (such as auto medical payment, accident-only coverage, or disability insurance) do not fall under the definition of a health plan under HIPAA.

Excluded Programs and Insurance Types

  • Workers' compensation: Run by states to handle work-related injuries, this is legally classified as a separate work-related insurance program rather than a HIPAA health plan.
  • Excepted benefits: Standalone policies covering only accident, disability income, liability, or automobile medical payment are explicitly excluded.
  • Small self-administered group plans: Group health plans with fewer than 50 participants that are managed entirely by the employer are also exempt.
  • Life and property-casualty insurers: These companies operate under separate financial privacy laws unless they concurrently run a major medical health plan.

What isn't covered under HIPAA?

HIPAA does not cover health information handled by non-medical organizations, employment records, student records, or publicly available data.

Non-Covered Entities

HIPAA only applies to Covered Entities and Business Associates (like doctors, hospitals, and health insurance plans). It does not cover:

  • Employers and HR departments: Sick notes or medical leave forms given to an employer become employment records, not protected health information (PHI).
  • Life and disability insurers: Sharing your medical history when applying for life insurance is not protected by HIPAA.
  • Consumer apps and wearables: Fitness trackers, period-tracking apps, and wellness platforms do not fall under HIPAA unless they work directly under a contract for a healthcare provider.
  • Schools and universities: Student health records are usually governed by student privacy laws like FERPA instead of HIPAA.
  • Financial and tech companies: Data brokers, banks, and advertising networks tracking health-related website visits are exempt from HIPAA rules.

Excluded Types of Information

Even within healthcare settings, certain data is excluded:

  • De-identified data: Medical information that has all personal identifiers (like names, birth dates, and contact info) removed.
  • Personal use: An individual accessing or sharing their own medical records for personal reasons is not restricted by HIPAA.
  • Public information: Details published in news reports, court records, or your own social media posts.

Which group plans do HIPAA rules not apply?

HIPAA rules do not apply to small, employer-administered group health plans with fewer than 50 participants, nor do they apply to non-health benefit plans like disability income, life insurance, or workers' compensation.

Exempt Group and Benefit Plans

  • Small Self-Administered Plans: Group health plans with fewer than 50 participants that are managed entirely in-house by the sponsoring employer (not through an insurer or third-party administrator).
  • Disability Income Plans: Insurance policies that replace lost income due to disability rather than paying for medical care.
  • Life and Auto Insurance: Policies covering life, property, casualty, or auto medical payments.
  • Workers' Compensation: Programs providing benefits for work-related injuries or illnesses.
  • Excepted Benefits: Stand-alone dental or vision plans, and accident-only coverage.

When HIPAA Does Apply

HIPAA rules do apply to group health plans if they have 50 or more participants, or if they are managed by an outside insurer or third-party administrator (TPA), regardless of how small the group is. You can read more about definitions via the U.S. Department of Health & Human Services.

Are insurance companies covered by HIPAA?

Health insurance companies are considered "covered entities" under HIPAA when they operate health plans, meaning they must protect your health information.

How HIPAA Applies to Insurance Companies

  • Covered Entities: Health insurance issuers, HMOs, employer-sponsored group health plans, and government programs like Medicare are directly regulated by HIPAA.
  • Protected Health Information (PHI): Insurers must secure your member IDs, claims data, treatment details, and medical diagnoses.
  • Permitted Disclosures: Insurance companies can use or share your PHI without your explicit permission for treatment, payment (such as processing claims), and routine healthcare operations.

Limits and Exceptions

  • Non-Health Lines of Business: HIPAA rules generally do not apply to non-health coverage, such as standalone life insurance, disability income, or auto accident insurance policies, unless the insurer is acting as a business associate.
  • Marketing Restrictions: Insurers cannot use or disclose your PHI for marketing purposes without your explicit written authorization.
  • Self-Insured Plans: If an insurance company only administers a self-funded employer plan (where the employer pays the actual claims), the insurer acts as a business associate rather than the primary covered entity.

Which is not considered a HIPAA covered entity?

Employers, life insurance companies, law enforcement agencies, and standalone fitness apps are not considered HIPAA covered entities.

The Three Covered Entities

Under HIPAA (Health Insurance Portability and Accountability Act), only three specific groups are classified as covered entities:

  • Healthcare providers (like doctors, clinics, dentists, and pharmacies) that transmit health information electronically in standard transactions.
  • Health plans (like health insurance companies, HMOs, Medicare, and Medicaid).
  • Healthcare clearinghouses that process nonstandard health data into standard electronic formats (or vice versa).

Common Non-Covered Entities

Any organization outside those three definitions is generally not a covered entity. Common examples include:

  • Employers (in their role as employers handling HR files, workers' compensation, or sick leave notes).
  • Life and disability insurers.
  • Law enforcement agencies (like police and sheriff departments).
  • Schools and school districts (whose student records are governed by FERPA instead).
  • Consumer wellness and fitness apps that collect data directly from users.
  • Business associates (vendors or contractors who handle protected health information for a covered entity are directly bound by HIPAA rules via a contract, but they are technically classified as business associates rather than covered entities).

You can read more about definitions and official rules directly through the U.S. Department of Health and Human Services.

Who does HIPAA not apply to and why?

9 related questions found

Which type of insurance is not covered under HIPAA?

Workers' compensation, auto insurance, and life or disability insurance do not count as health plans under HIPAA.

Types of Excluded Coverage

  • Workers' compensation: Programs that pay for work-related injuries are run by states and are excluded from HIPAA.
  • Life and disability insurance: These policies provide benefits unrelated to primary medical care or health treatment.
  • Auto and property liability insurance: Coverage that pays medical bills only as a secondary benefit from an accident is not a health plan.
  • Small self-administered group plans: Employer-sponsored group plans with fewer than 50 participants that are managed entirely by the employer are also exempt.

Which of these is not right under HIPAA?

The correct option that is not a right under HIPAA is: "To control all disclosures of information in the health record."

Explanation

  • ❌ To control all disclosures of information in the health record: This is not a right because patients do not have absolute control over every disclosure. Under the HIPAA Privacy Rule, healthcare providers and covered entities are legally permitted to disclose Protected Health Information (PHI) without explicit patient consent for essential purposes such as treatment, payment, healthcare operations, or when required by law enforcement and public health authorities.
  • ✅ To gain access to and obtain a copy of one's health record: This is a valid right. Patients have a right to inspect and obtain copies of their medical records within a defined period.
  • ✅ To request amendment of errors found in the health record: This is a valid right. If a patient believes information is inaccurate or incomplete, they have the right to request changes or append a statement of disagreement.
  • ✅ To receive an accounting of how health information has been used: This is a valid right. Patients can request a history of specific disclosures made by the covered entity.

Who is not eligible for HIPAA coverage?

HIPAA does not apply to non-covered entities, which include most employers, life insurance companies, schools, and law enforcement agencies.

Entities Excluded from HIPAA

HIPAA only applies to covered entities (health care providers, health plans, and health care clearinghouses) and their business associates. It does not cover:

  • Most Employers: HR departments and employers are generally not bound by HIPAA, even when they collect medical notes or sick leave requests (though other laws like the ADA govern employee data).
  • Life and Property Insurers: Life insurance companies, auto insurers, and workers' compensation carriers do not fall under HIPAA rules.
  • Schools and School Districts: Student health records kept by K-12 schools and universities are protected by FERPA (Family Educational Rights and Privacy Act) instead of HIPAA.
  • Law Enforcement and Courts: Police departments, courts, and correctional facilities are not covered entities just because they hold health information.
  • Consumer Health Apps and Wearables: Fitness trackers and many health apps sold directly to consumers are usually regulated by the FTC (Federal Trade Commission), not HIPAA.

Types of Records Excluded

Even within healthcare settings, HIPAA does not protect:

  • Employment Records: Medical information that an employer holds about its own workers in an employment capacity.
  • De-Identified Data: Health information that has had all personal identifiers removed.
  • Personal Use: An individual sharing or storing their own medical records.

Who are the 3 primary covered entities under HIPAA?

The three primary categories of covered entities under the Health Insurance Portability and Accountability Act (HHS.gov) are healthcare providers, health plans, and healthcare clearinghouses.

As outlined by the Department of Health and Human Services, these groups must protect patient data and comply with HIPAA rules:

1. Healthcare Providers

  • Definition: Doctors, clinics, hospitals, psychologists, dentists, chiropractors, nursing homes, and pharmacies.
  • Rule for coverage: They are only covered entities if they transmit health information in electronic form for standard transactions (like billing or insurance claims).

2. Health Plans

  • Definition: Organizations that pay for or provide medical care.
  • Examples: Health insurance companies, HMOs (Health Maintenance Organizations), employer-sponsored group health plans, and government programs like Medicare and Medicaid.

3. Healthcare Clearinghouses

  • Definition: Entities that process nonstandard health information into a standard electronic format, or the reverse, acting as middlemen between providers and payers.
  • Examples: Billing services, community health management information systems, and value-added networks that reformat data.

What are the top 5 HIPAA violations?

The top 5 most common HIPAA violations involve failing to protect patient data through unauthorized access, weak safeguards, or delayed notifications.

1. Unauthorized Access to Patient Records

  • What it is: Staff members viewing Protected Health Information (PHI) out of curiosity or without a direct clinical need.
  • Example: Looking up the medical chart of a coworker, family member, or celebrity.

2. Theft or Loss of Unencrypted Devices

  • What it is: Laptops, phones, or USB drives containing electronic PHI (ePHI) going missing without proper encryption.
  • Example: Leaving a portable hard drive in an unlocked car where it gets stolen.

3. Lack of an Enterprise Risk Analysis

  • What it is: Failing to conduct regular, thorough security reviews of organizational systems and vulnerabilities.
  • Example: Not checking software or networks for security gaps that later lead to ransomware attacks.

4. Improper Disposal of Patient Records

  • What it is: Tossing physical paper files or un-wiped electronic media straight into standard trash or recycling bins.
  • Example: Putting printed daily appointment schedules into an open office dumpster.

5. Failure to Issue Timely Breach Notifications

  • What it is: Failing to notify affected individuals, the government, or the media within the mandatory 60-day window following a discovered data breach.
  • Example: Waiting six months to tell patients that their health records were exposed in a cyberattack.