Who are the 3 primary covered entities under HIPAA?

Editorial team Published on

The three primary categories of covered entities under HIPAA are health care providers, health plans, and health care clearinghouses.

According to the U.S. Department of Health and Human Services (HHS), these three groups must follow the HIPAA Privacy and Security Rules:

  • Health Care Providers: Doctors, clinics, dentists, pharmacies, psychologists, and hospitals that transmit any health information in electronic form standard transactions.
  • Health Plans: Health insurance companies, HMOs, company-sponsored health plans, and government programs like Medicare and Medicaid.
  • Health Care Clearinghouses: Public or private entities—such as billing services or community health management information systems—that process nonstandard health data into standard electronic formats, or vice versa.

Who are the three entities covered by HIPAA?

HIPAA identifies three specific types of covered entities that must follow federal privacy and security rules: healthcare providers, health plans, and healthcare clearinghouses.

The Three Types of Covered Entities

  • Healthcare Providers: Doctors, clinics, hospitals, pharmacies, dentists, and psychologists who transmit health information electronically for standard transactions like billing or claims.
  • Health Plans: Health insurance companies, HMOs, company health plans, Medicare, and Medicaid that provide or pay for medical care.
  • Healthcare Clearinghouses: Entities that process nonstandard health information from another organization into a standard electronic format, or vice versa.

You can learn more about these definitions and official guidance directly from the U.S. Department of Health and Human Services.

What are the three primary parts of HIPAA?

Three major rules addressed in the HIPAA law are the Privacy Rule, the Security Rule, and the Breach Notification Rule.

Major Rules Addressed in HIPAA

  • The Privacy Rule: This rule sets national standards to protect medical records and other Protected Health Information (PHI). It limits how healthcare providers and insurers can use and share patient data while giving patients rights over their own health information.
  • The Security Rule: This rule focuses on safeguarding electronic protected health information (ePHI). It requires organizations to put administrative, physical, and technical safeguards in place, such as passwords and encryption.
  • The Breach Notification Rule: This rule requires healthcare providers and other covered groups to notify patients, the government, and sometimes the media if unsecured health data is compromised or stolen.

What group is not one of the three covered entities?

Depending on the context of the question or the specific multiple-choice options you are choosing from, the group that is not one of the three covered entities under HIPAA is typically Patients or Business Associates.

Other common incorrect choices (groups that are not covered entities) include employers, life insurers, or schools.

Why these are incorrect options

  • ❌ Patients: HIPAA is a federal law designed to protect the privacy and security of a patient's medical information. The law assigns compliance responsibilities to the organizations handling the data, meaning patients themselves are the beneficiaries of these rights, not the covered entities.
  • ❌ Business Associates: While contractors and vendors (like IT companies or billing services) must comply with HIPAA rules by signing a Business Associate Agreement (BAA), they are legally distinct from the three core "covered entities".
  • ❌ Employers / Life Insurers / Schools: These groups generally handle health data for employment, insurance underwriting, or educational records (which fall under FERPA), meaning they are excluded from direct HIPAA coverage.

The actual three covered entities

To help you narrow down your specific multiple-choice options, the only three official groups designated as Covered Entities under the HIPAA Privacy Rule are:

  1. Healthcare Providers: Doctors, clinics, psychologists, dentists, chiropractors, nursing homes, and pharmacies that transmit health information electronically.
  2. Health Plans: Health insurance companies, HMOs, company group health plans, and government programs like Medicare and Medicaid.
  3. Healthcare Clearinghouses: Entities that process nonstandard health information into standard formats (and vice versa), such as billing services and community health information systems.

Who are not covered entities under HIPAA?

An organization or individual is not considered a covered entity under HIPAA if they do not operate as a health care provider conducting standard electronic transactions, a health plan, or a health care clearinghouse.

Common Examples of Non-Covered Entities

  • Employers: Companies acting in their general employer role (handling HR files, FMLA requests, or sick notes) are not covered entities. (Note: If an employer sponsors a self-funded group health plan, the plan itself is covered, but general employment records are still excluded.)
  • Schools and Educational Institutions: Student health and education records are generally governed by the Family Educational Rights and Privacy Act (FERPA) rather than HIPAA.
  • Life and Disability Insurers: Companies offering life, disability, auto, or liability insurance are not covered entities when underwriting or administering those policies.
  • Workers' Compensation Carriers: Programs and carriers paying for work injury benefits operate outside the definition of a HIPAA health plan.
  • Fitness and Wellness Apps: Standalone consumer apps, wearable fitness trackers, and nutrition platforms that collect health data directly from users are not covered entities (unless working on behalf of a provider or health plan).
  • Law Enforcement and Legal Professionals: Police departments, courts, and personal injury law firms that may handle health records do not meet covered entity criteria.
  • General Tech Vendors: Cloud hosts, email services, or data analytics companies are not covered entities unless they create, receive, or transmit Protected Health Information (PHI) under a Business Associate Agreement (BAA) for a covered entity.

What are HIPAA Covered Entities?

9 related questions found

Who is a HIPAA covered entity?

A HIPAA covered entity is any health plan, health care clearinghouse, or health care provider that transmits health information in electronic form for specific standard transactions.

Under the U.S. Department of Health and Human Services (HHS) guidelines, covered entities fall into three main groups:

1. Health Care Providers

  • Doctors, clinics, and hospitals
  • Dentists and psychologists
  • Chiropractors and physical therapists
  • Nursing homes and pharmacies
  • Note: A provider is only covered if they transmit protected health information electronically for standard transactions like billing, claims, or referral authorizations.

2. Health Plans

  • Health insurance companies
  • Health Maintenance Organizations (HMOs)
  • Employer-sponsored group health plans
  • Government programs like Medicare, Medicaid, and military health programs

3. Health Care Clearinghouses

  • Entities that process nonstandard health information into standard formats (or vice versa)
  • Billing services and community health management information systems that translate data for exchange between payers and providers

What about Business Associates?

Third-party vendors that create, receive, maintain, or transmit Protected Health Information (PHI) on behalf of a covered entity are business associates, not covered entities. Examples include cloud hosting providers, medical billing companies, and IT support. They must also comply with HIPAA rules and sign a Business Associate Agreement.

Which 3 categories of safeguards are outlined in the HIPAA security Rule?

The HIPAA Security Rule outlines three categories of safeguards to protect electronic protected health information (ePHI): administrative, physical, and technical safeguards.

1. Administrative Safeguards

Administrative safeguards involve the policies, procedures, and management actions used to select, develop, implement, and maintain security measures. They protect ePHI by setting clear rules for workforce conduct and organizational governance.

  • Security Management Process: Policies to analyze risks, manage threats, review activity, and apply sanctions.
  • Assigned Security Responsibility: Designation of a security official responsible for overseeing security procedures.
  • Workforce Security: Screening procedures and authorization controls for employees handling data.
  • Information Access Management: Restricting and monitoring access to patient information.
  • Security Awareness and Training: Providing ongoing security training and updates for staff.
  • Security Incident Procedures: Protocols to report, document, and respond to security incidents.
  • Contingency Planning: Establishing data backup, disaster recovery, and emergency operation plans.
  • Evaluation: Regular periodic assessments of security policies and performance.
  • Business Associate Contracts: Agreements ensuring third parties adequately protect ePHI.

2. Physical Safeguards

Physical safeguards focus on protecting physical computer systems, equipment, and the surrounding buildings from natural disasters, environmental hazards, and unauthorized intrusion.

  • Facility Access Controls: Limiting physical access to data centers and server rooms using badges, locks, or guards.
  • Workstation Use: Policies defining proper functions, physical positioning, and appropriate use of monitors and terminals.
  • Workstation Security: Safeguarding specific physical hardware and access points.
  • Device and Media Controls: Rules governing the receipt, removal, movement, and secure disposal of hardware and electronic media containing ePHI.

3. Technical Safeguards

Technical safeguards involve the technology and associated policies used to protect data and control individual access to computer systems.

  • Access Control: Unique user identification, emergency access procedures, and automated logoff.
  • Audit Controls: Hardware, software, and procedural mechanisms that record and examine activity in information systems.
  • Integrity: Policies and mechanisms to protect ePHI from improper alteration or destruction.
  • Person or Entity Authentication: Procedures to verify that a person or system seeking access is genuine.
  • Transmission Security: Guarding against unauthorized access to data sent over an electronic communications network via encryption or secure channels.

You can read the official guidelines directly on the HHS Summary of the HIPAA Security Rule.

What are the three main regulations of HIPAA?

The three main rules of HIPAA (Health Insurance Portability and Accountability Act) are the Privacy Rule, the Security Rule, and the Breach Notification Rule.

1. The HIPAA Privacy Rule

  • What it does: Protects all personal health records and Protected Health Information (PHI) in any format (paper, electronic, or spoken).
  • Key standard: Limits how healthcare providers and organizations share or use data, enforcing the "minimum necessary" rule to restrict sharing.
  • Patient rights: Gives patients the right to view their medical records, request corrections, and get a notice of how their data is used.

2. The HIPAA Security Rule

  • What it does: Focuses specifically on safeguarding electronic protected health information, known as ePHI.
  • Safeguards required: Mandates three types of security measures:
    • Administrative: Risk analysis, security management, and employee training.
    • Physical: Facility access controls, workstation security, and hardware protection.
    • Technical: Access controls, encryption, audit logs, and data integrity.

3. The Breach Notification Rule

  • What it does: Requires covered organizations to take action if unsecured patient data is leaked or stolen.
  • Notification steps:
    • Must notify affected individuals without unreasonable delay (no later than 60 days).
    • Must notify the Secretary of Health and Human Services (HHS).
    • Must notify local media if a breach affects more than 500 residents in a state or jurisdiction.

What are the three main focus areas of the HIPAA legislation?

With respect to permissions for uses and disclosures, HIPAA divides health information and its handling into three main categories based on the level of patient permission required.

The Three Categories of Uses and Disclosures

  • Uses or disclosures that can generally occur without any specific permission from the patient
    • Covers routine operations like treatment, payment, and health care operations (TPO).
  • Uses or disclosures that generally require oral agreement only
    • Covers informal permissions, such as discussions with family members or friends involved in the patient's care, provided the patient does not object.
  • Uses or disclosures that generally require specific written authorization
    • Covers non-routine or sensitive activities like research, marketing, and fundraising.

You can review more details about these privacy guidelines through the CITI Training Program.

What are the three obligations imposed by HIPAA for covered entities and business associates?

Three core obligations imposed by HIPAA for covered entities and business associates are implementing security safeguards, limiting the use and disclosure of protected health information (PHI), and complying with breach notification rules.

Core HIPAA Obligations

  • Implement Security Safeguards: Both covered entities and business associates must put in place administrative, physical, and technical safeguards to protect electronic protected health information (e-PHI).
  • Limit Use and Disclosure (Privacy Rule): They must restrict the use and sharing of PHI to the minimum necessary for the intended purpose, following the limits outlined in law and any signed Business Associate Agreements (BAAs).
  • Report and Notify of Breaches: They must detect, document, and report security incidents or data breaches of unsecured PHI to affected parties or partner entities without unreasonable delay.