Which entities are subject to the HIPAA privacy rule?

Editorial team Published on

The HIPAA Privacy Rule applies to covered entities and their business associates.

Covered Entities

The U.S. Department of Health and Human Services (HHS) defines three main categories of covered entities:

  • Health Care Providers: Doctors, clinics, psychologists, dentists, chiropractors, nursing homes, and pharmacies—regardless of practice size—that electronically transmit health information in connection with standard HIPAA transactions (such as claims, benefit eligibility inquiries, or referral authorizations).
  • Health Plans: Individual and group health plans that provide or pay the cost of medical care. This includes health insurance companies, HMOs, Medicare, Medicaid, military/veterans' health programs, and employer-sponsored group health plans.
  • Health Care Clearinghouses: Entities that process nonstandard health information from other organizations into a standard electronic format (or vice versa), such as billing services or community health management information systems.

Business Associates

  • Business Associates: Persons or organizations (other than a member of a covered entity's workforce) that perform functions or services involving the use or disclosure of Protected Health Information (PHI) on behalf of a covered entity. Examples include third-party medical billing companies, cloud storage providers, legal consultants, and IT service providers. Business associates are directly liable for compliance with key Privacy and Security Rule provisions.

Who is exempt from the HIPAA privacy rule?

Organizations and data types that do not function as covered entities or business associates are exempt from the HIPAA Privacy Rule. HIPAA only applies to health plans, healthcare clearinghouses, healthcare providers who transmit health information electronically, and their business associates.

Exempt Entities and Organizations

  • Standard Employers: Employers acting in their employment role (managing sick leave, drug tests, or fitness-for-duty notes) are exempt, though their records may fall under other laws like the ADA.
  • Life and Disability Insurers: These companies collect health data but do not engage in standard electronic healthcare transactions covered by HIPAA.
  • Workers' Compensation Carriers: Insurers handling claims related to workplace injuries operate outside direct HIPAA jurisdiction.
  • Most Schools and Districts: Educational institutions maintain student health information, but these are governed by the Family Educational Rights and Privacy Act (FERPA) rather than HIPAA.
  • Law Enforcement and State Agencies: Police departments, child protective services, and local agencies do not meet the definition of a covered entity in their normal investigative capacities.
  • Direct-to-Consumer Apps: Fitness trackers, wellness apps, and data brokers that interact directly with consumers without a link to a covered entity are exempt.

Exempt Types of Information

  • Employment Records: Specific employment records held by a covered entity in its capacity as an employer are excluded.
  • De-Identified Data: Health information that has been stripped of individual identifiers or certified by a statistician has no restrictions under HIPAA.
  • Decedents' Information: Records of individuals who have been deceased for more than 50 years are excluded.

Who is not covered by the privacy rule?

The HIPAA Privacy Rule does not cover organizations that are not classified as covered entities (health plans, health care clearinghouses, and health care providers conducting electronic transactions) or their business associates.

Non-Covered Entities and Groups

  • Employers: Employment records held by an employer in their role as an employer are excluded.
  • Life and Disability Insurers: Policies providing life, disability, or auto insurance coverage are not covered.
  • Schools and Educational Institutions: Student records managed under the Family Educational Rights and Privacy Act (FERPA) are excluded.
  • Law Enforcement Agencies: Police and investigative groups collecting information outside traditional health care operations are not covered.
  • Direct-to-Consumer Apps: Many wellness programs, fitness clubs, and mobile health apps that operate independently from a covered healthcare provider are excluded.
  • Workers' Compensation Carriers: Programs paying for non-medical or injury compensation benefits are generally outside the rule.
  • Family Members: Relatives of patients are not regulated entities under the rule.

Excluded Data Types

  • De-identified Information: Health data that removes all individual identifiers or is certified by a statistician falls completely outside the Privacy Rule.
  • Deceased Records: Health information regarding individuals who have been deceased for more than 50 years is excluded.

What three types of entities are covered by HIPAA?

The three types of entities covered by HIPAA (Health Insurance Portability and Accountability Act) are healthcare providers, health plans, and healthcare clearinghouses. You can learn more details directly from the U.S. Department of Health & Human Services guidelines.

1. Healthcare Providers

  • Definition: Individuals or organizations that bill, transmit, or render medical care and services electronically.
  • Examples: Doctors, clinics, dentists, pharmacies, psychologists, chiropractors, and hospitals.

2. Health Plans

  • Definition: Individual and group plans that pay for or provide medical care.
  • Examples: Health insurance companies, HMOs (health maintenance organizations), Medicare, and Medicaid.

3. Healthcare Clearinghouses

  • Definition: Entities that process non-standard health data into standard electronic formats, or vice versa.
  • Examples: Billing services, community health information systems, and electronic data interchange (EDI) translators.

Which entity enforces the HIPAA privacy rule?

The Health Insurance Portability and Accountability Act (HIPAA) is primarily enforced by the Office for Civil Rights (OCR), an agency within the U.S. Department of Health and Human Services (HHS).

Primary Federal Enforcement

  • Office for Civil Rights (OCR): Enforces the HIPAA Privacy, Security, and Breach Notification Rules by investigating complaints, conducting audits, and imposing civil monetary penalties (CMPs).
  • Centers for Medicare & Medicaid Services (CMS): Enforces HIPAA administrative simplification rules, including transaction and code sets, national identifiers, and insurance portability requirements.

Criminal and State Enforcement

  • Department of Justice (DOJ): Handles criminal violations of HIPAA, which involve "knowingly" misusing or selling protected health information.
  • State Attorneys General: Have the legal authority to bring civil actions and seek damages or penalties on behalf of residents affected by HIPAA violations.

What are HIPAA Covered Entities?

9 related questions found

Which entities are not covered by HIPAA?

Organizations and groups that do not function as health plans, healthcare clearinghouses, or healthcare providers transmitting electronic standard transactions are not covered by the Health Insurance Portability and Accountability Act (HIPAA).

Common Non-Covered Entities

  • Employers (in their general employment or human resources role, such as maintaining sick leave requests or employment records)
  • Schools and school districts (student educational and treatment records are governed instead by FERPA, the Family Educational Rights and Privacy Act)
  • Life, auto, and disability insurers, as well as liability insurance policies
  • Workers' compensation carriers and state programs
  • Consumer wellness apps, fitness trackers, and wearables (like step counters or sleep logs) when operating directly for consumers rather than a covered entity
  • Direct-to-consumer services (such as recreational genetic testing kits or social media health support groups)
  • Law enforcement agencies and general government offices
  • Data brokers, marketers, and consumer tech companies handling health-related information outside traditional medical frameworks

What are three exceptions to HIPAA?

The three specific exceptions under the HIPAA Breach Notification Rule define when unauthorized access to or acquisition of protected health information (PHI) is not legally considered a reportable breach.

Three Core Exceptions to a HIPAA Breach

  • Unintentional Acquisition, Access, or Use of PHI: An employee or workforce member accesses health data accidentally in good faith and within their authorized scope of work, without further improper disclosure. (Example: A nurse accidentally opens the wrong electronic chart but closes it immediately upon realizing the error.)
  • Inadvertent Disclosure Between Authorized Persons: A person who is authorized to access PHI mistakenly shares it with another authorized person within the same organization or health care arrangement. (Example: Two clinicians with proper authorization mistakenly swap a verbal update using the wrong patient file name, but the recipient cannot retain or misuse the data.)
  • Unauthorized Disclosure Where Data Cannot Be Retained: An unauthorized recipient receives PHI, but the covered entity has a good-faith belief that the person could not have reasonably retained or compromised the information. (Example: A misdirected fax or email sent to an external party who immediately calls to report it and confirms they did not read, save, or print the document.)

Other Common Exceptions to HIPAA Privacy Rules

Beyond breach notification, the Department of Health and Human Services (HHS) allows the disclosure of PHI without patient authorization in specific public interest scenarios, including:

  • Treatment, payment, and healthcare operations (TPO)
  • Public health activities and disease reporting
  • Judicial and administrative court orders
  • Law enforcement and public safety threats
  • Workers' compensation compliance

Who is subject to the privacy rule?

Under the federal HIPAA Privacy Rule, covered entities and their business associates must abide by the regulations.

Covered Entities

According to the U.S. Department of Health and Human Services (HHS), covered entities include:

  • Health plans: Health insurance companies, HMOs, company health plans, and government programs like Medicare and Medicaid.
  • Healthcare clearinghouses: Entities that process nonstandard health information they receive from another entity into a standard format, or vice versa.
  • Healthcare providers: Doctors, clinics, psychologists, dentists, chiropractors, nursing homes, and pharmacies that transmit any health information in electronic form for standard transactions (like billing insurance).

Business Associates

  • Third-party vendors: Any person or organization (other than a member of a covered entity's workforce) that performs services or functions involving the use or disclosure of protected health information (PHI) on behalf of a covered entity.
  • Examples include billing companies, cloud storage providers, legal or accounting consultants, and data analysis firms working with medical data. Subcontractors of business associates must also comply.

What are exceptions to the privacy rule?

The HIPAA Privacy Rule allows medical providers and health plans to share protected health information without patient permission in specific public interest and operational situations.

Core Exceptions and Permitted Disclosures

  • Treatment, Payment, and Operations (TPO): Sharing data for patient care, billing, quality checks, and medical management.
  • Public Health Activities: Reporting disease outbreaks, child abuse, or faulty medical devices to public health authorities.
  • Averting Serious Threats: Disclosing information to prevent an immediate and severe threat to a person or the public safety.
  • Law Enforcement Purposes: Helping locate a suspect, reporting a crime on the premises, or obeying a court order.
  • Judicial and Administrative Proceedings: Responding to lawful subpoenas, warrants, or judge's orders.
  • Health Oversight: Providing records to government agencies that audit or inspect healthcare programs.
  • Workers' Compensation: Sharing injury details to process workers' compensation claims.
  • Required by Law: Following any other federal, state, or local laws that mandate the disclosure.

What are covered entities under the privacy rule?

Under the HIPAA Privacy Rule, covered entities are defined by the U.S. Department of Health and Human Services (HHS) as health plans, health care clearinghouses, and any health care provider that transmits health information electronically in connection with standard transactions.

The Three Categories of Covered Entities

  • Health Care Providers: Doctors, clinics, dentists, pharmacies, psychologists, hospitals, nursing homes, and chiropractors who transmit health data electronically (such as electronic billing or claims).
  • Health Plans: Health insurance companies, HMOs, company health plans, and government programs like Medicare and Medicaid that pay for medical care.
  • Health Care Clearinghouses: Entities that process non-standard health information from another party into a standard electronic format, or vice versa.

Key Responsibilities

  • Protect Protected Health Information (PHI) against unauthorized use or disclosure.
  • Provide patients with a Notice of Privacy Practices explaining how their health information is used.
  • Honor individual rights regarding patient access and the amendment of medical records.
  • Establish appropriate administrative, technical, and physical safeguards.