What types of organizations are subject to HIPAA?

Editorial team Published on

HIPAA applies strictly to Covered Entities and Business Associates that create, receive, maintain, or transmit protected health information.

Covered Entities

  • Healthcare Providers: Doctors, clinics, dentists, psychologists, chiropractors, nursing homes, and pharmacies that transmit health data electronically.
  • Health Plans: Health insurance companies, HMOs, company health plans, and government programs like Medicare and Medicaid.
  • Healthcare Clearinghouses: Entities that process non-standard health data into standard electronic formats (or vice versa).

Business Associates

  • Vendors and Partners: Third-party companies that handle protected health information on behalf of a covered entity.
  • Examples: Cloud storage providers, IT service contractors, billing companies, legal or accounting consultants, and data destruction services.

Who are the 3 primary covered entities under HIPAA?

The three primary categories of covered entities under the Health Insurance Portability and Accountability Act (HHS.gov) are healthcare providers, health plans, and healthcare clearinghouses.

As outlined by the Department of Health and Human Services, these groups must protect patient data and comply with HIPAA rules:

1. Healthcare Providers

  • Definition: Doctors, clinics, hospitals, psychologists, dentists, chiropractors, nursing homes, and pharmacies.
  • Rule for coverage: They are only covered entities if they transmit health information in electronic form for standard transactions (like billing or insurance claims).

2. Health Plans

  • Definition: Organizations that pay for or provide medical care.
  • Examples: Health insurance companies, HMOs (Health Maintenance Organizations), employer-sponsored group health plans, and government programs like Medicare and Medicaid.

3. Healthcare Clearinghouses

  • Definition: Entities that process nonstandard health information into a standard electronic format, or the reverse, acting as middlemen between providers and payers.
  • Examples: Billing services, community health management information systems, and value-added networks that reformat data.

What entities are exempt from HIPAA?

Entities that do not meet the definition of a covered entity (health plans, health care providers transmitting electronic data, and clearinghouses) or their business associates are exempt from HIPAA.

Common HIPAA-Exempt Entities

  • Employers: Handling employee medical or sick leave records in an employment capacity does not make a company subject to HIPAA (though employer-sponsored group health plans themselves may be separate covered entities).
  • Life and Disability Insurers: These companies collect health data, but they do not conduct standard electronic health care transactions regulated by HIPAA.
  • Schools and School Districts: Most student health and educational files are governed by the Family Educational Rights and Privacy Act (FERPA) instead of HIPAA.
  • Law Enforcement Agencies: Police departments, sheriffs, and local agencies do not function as health providers or health plans.
  • Consumer Tech and Wellness Apps: Direct-to-consumer fitness trackers, wellness mobile apps, and data brokers usually operate outside the scope of HIPAA (though they may fall under FTC rules).
  • Workers' Compensation Carriers: These organizations process medical claims for work injuries under state insurance laws rather than HIPAA standards.

How do you know if a company is HIPAA compliant?

You can check if a company is HIPAA compliant by asking them to sign a Business Associate Agreement (BAA) and reviewing their security documentation, as the U.S. government does not issue an official HIPAA certification badge.

Key Steps to Verify HIPAA Compliance

  • Ask for a Business Associate Agreement (BAA): A legitimate HIPAA-compliant vendor or partner must be willing to sign a BAA. This is a legal contract accepting responsibility for protecting patient data (Protected Health Information or PHI).
  • Understand the Lack of Official Certification: The U.S. Department of Health and Human Services (HHS) and the Office for Civil Rights (OCR) do not officially certify software, services, or companies. If a company claims to have an "official HHS HIPAA certificate," treat it as a red flag.
  • Look for Third-Party Audits: While there is no government stamp, reputable companies often undergo independent third-party assessments. Ask for reports from independent audits like SOC 2 Type II, HITRUST CSF, or ISO/IEC 27001.
  • Verify Specific Safeguards: Request documentation proving they use technical, physical, and administrative safeguards under the HIPAA Security Rule, such as:
    • End-to-end encryption for data in transit and at rest.
    • Robust access controls and audit logs.
    • Secure data backup and disaster recovery plans.
  • Check Seal Verification Tools: Some private organizations (like the Compliancy Group's HIPAA Seal of Compliance Verification) provide verification programs confirming a company has completed an internal compliance program, though this still does not replace federal oversight.

What organization does not comply with HIPAA?

Organizations such as employers, life insurance companies, schools, and workers' compensation carriers do not need to comply with HIPAA unless they operate a specific covered healthcare component or handle protected health information under a business associate agreement.

Organizations Exempt From HIPAA

  • Employers: Managing employee sick leave or health records for general HR purposes is not covered.
  • Life and Disability Insurers: These companies do not process electronic health records for standard healthcare transactions.
  • Schools and School Districts: Student health records managed within educational institutions fall under FERPA (Family Educational Rights and Privacy Act) instead.
  • Workers' Compensation Carriers: State programs and auto or property/casualty insurers providing wage and medical benefits for job injuries are exempt.
  • Law Enforcement Agencies: Police departments and courts do not function as healthcare providers, health plans, or clearinghouses.
  • Consumer Fitness Apps: Standalone wellness trackers and health apps sold directly to consumers are not bound by HIPAA unless linked to a covered medical provider.

You can review official definitions of who qualifies using the U.S. Department of Health & Human Services Decision Tool.

What Are HIPAA Covered Entities? - AI and Technology Law

9 related questions found

What types of organizations are covered by HIPAA?

HIPAA applies strictly to Covered Entities and Business Associates that create, receive, maintain, or transmit protected health information.

Covered Entities

  • Healthcare Providers: Doctors, clinics, dentists, psychologists, chiropractors, nursing homes, and pharmacies that transmit health data electronically.
  • Health Plans: Health insurance companies, HMOs, company health plans, and government programs like Medicare and Medicaid.
  • Healthcare Clearinghouses: Entities that process non-standard health data into standard electronic formats (or vice versa).

Business Associates

  • Vendors and Partners: Third-party companies that handle protected health information on behalf of a covered entity.
  • Examples: Cloud storage providers, IT service contractors, billing companies, legal or accounting consultants, and data destruction services.

What are the three exceptions to HIPAA?

The three specific exceptions under the HIPAA Breach Notification Rule determine whether an unauthorized acquisition, access, or use of Protected Health Information (PHI) constitutes a reportable breach.

The Three Exceptions to a HIPAA Breach

  • Unintentional acquisition, access, or use of PHI: An employee or workforce member accesses PHI unintentionally, in good faith, and within the scope of their authority, without further impermissible disclosure.
  • Inadvertent disclosure between authorized persons: A person authorized to access PHI at a covered entity or business associate accidentally discloses that information to another authorized person within the same organization or arrangement, without further impermissible use.
  • Good faith belief that the recipient could not retain the information: An unauthorized disclosure where the covered entity or business associate has a good faith belief that the unauthorized person who received the PHI could not have reasonably retained it.

What is the new HIPAA rule in 2026?

The main new HIPAA requirement for 2026 is updating privacy notices under the HHS Model Notices of Privacy Practices to include stricter protections for substance use disorder (SUD) patient records.

Key 2026 Privacy Rule Updates

  • February 16, 2026 Deadline: Healthcare providers and health plans had to update their Notice of Privacy Practices (NPP).
  • Substance Use Records: Notices must now explain how substance use disorder records are protected under 42 CFR Part 2.
  • Legal Protections: Patient records generally cannot be used in civil or criminal legal cases without explicit consent or a court order.
  • Patient Rights: Patients gained clearer rights to restrict sharing, opt out of fundraising, and file complaints.

Proposed Security Rule Changes (Under Review)

Regulators are also pushing a major update to the HIPAA Security Rule that changes how organizations handle data safety:

  • No More "Addressable" Rules: Optional security steps are becoming mandatory.
  • Mandatory MFA: Multi-factor authentication is required across all systems.
  • Required Encryption: Patient data must be encrypted both in transit and at rest.

What is not a HIPAA covered entity?

A HIPAA covered entity does not include organizations that are not health care providers conducting electronic transactions, health plans, or health care clearinghouses.

Common Non-Covered Entities

  • Employers: General human resources files, leave requests, and employee health records managed in an employer role are exempt.
  • Life and Disability Insurers: Companies selling life, auto, liability, or disability insurance are not covered when performing underwriting or product administration.
  • Schools: K–12 schools and universities maintaining student educational and health records fall under FERPA instead of HIPAA.
  • Fitness and Wellness Apps: Standalone consumer apps, wearable fitness trackers, and nutrition logs that collect user data directly are not covered unless tied to a provider.
  • Law Enforcement: Police departments and government agencies are generally exempt when handling information independently.
  • Workers' Compensation: Carriers and programs managing injury claims outside a standard health plan function are excluded.

What are the 10 most common HIPAA violations?

The 10 most common HIPAA violations involve mishandling protected health information (PHI) through employee error, weak security, or administrative oversight.

Top 10 Most Common Violations

  • Employee Snooping: Accessing patient files, family records, or coworker charts without a direct, professional need to know.
  • Lost or Stolen Devices: Leaving unencrypted laptops, smartphones, tablets, or USB drives where they can be stolen or accessed by outsiders.
  • Failure to Conduct Risk Analyses: Neglecting regular, organization-wide checkups to find and fix security gaps.
  • Improper Disposal of Records: Tossing paper charts in regular trash or failing to securely wipe old hard drives.
  • Weak Passwords and Access Controls: Using simple passwords or giving too many staff members broad, unmonitored access to electronic records (ePHI).
  • Unauthorized Texting or Emailing: Sending patient details over regular, unsecured text messages or standard email instead of encrypted platforms.
  • Missing Business Associate Agreements (BAAs): Failing to sign legal BAA contracts with outside vendors and cloud providers who handle patient data.
  • Delayed Breach Notifications: Missing the legal deadline to notify patients, the government, and the media within 60 days of discovering a data breach.
  • Inadequate Employee Training: Not providing regular, documented privacy and security awareness education for staff.
  • Denying or Delaying Patient Access: Taking longer than allowed (or refusing outright) to give patients copies of their own medical records.