What is a covered entity?
A covered entity is an organization or individual that HIPAA applies to directly: a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with certain standard transactions, such as billing insurance. Nearly every independent practice that bills insurers electronically, directly or through a billing company, is a covered entity.
- There are three kinds of covered entity: health plans, health care clearinghouses and health care providers who conduct standard electronic transactions.
- A provider becomes covered by sending a standard transaction electronically, such as a claim or eligibility check, even if a billing company sends it on the provider's behalf.
- Covered entities must follow the HIPAA Privacy, Security and Breach Notification Rules.
- Vendors that handle PHI for a covered entity are business associates, not covered entities, and need a signed BAA.
The three types of covered entity
HIPAA defines covered entities in 45 CFR 160.103. There are exactly three kinds:
- Health plans: insurers, HMOs, employer group health plans and government programs that pay for care, such as Medicare and Medicaid.
- Health care clearinghouses: organizations that translate health information between nonstandard and standard formats, often sitting between practices and payers to process claims.
- Health care providers who transmit health information electronically in connection with a standard transaction: doctors, dentists, physical therapists, chiropractors, psychologists, clinics, pharmacies and others, but only if they conduct at least one HIPAA standard transaction electronically.
What makes a provider 'covered'
For providers, the trigger is the electronic transaction, not the size of the practice or whether it uses an EHR. HIPAA's standard transactions, set out in 45 CFR Part 162, include claims, eligibility inquiries, claim status inquiries, referral authorizations and remittance advice, among others.
If a practice sends any of these electronically, or has a billing company or clearinghouse send them on its behalf, the practice is a covered entity. Once covered, HIPAA applies to all the PHI the practice holds, not only the information in electronic claims.
A provider that never conducts standard transactions electronically, for example a strictly cash-pay practice that never bills insurance electronically, may not be a covered entity. That is a narrow case, and such a provider may still face state privacy laws and contract obligations. HHS and CMS publish guidance and a decision tool to help providers work out where they stand.
What a covered entity must do
- Privacy Rule: use and disclose PHI only as permitted, apply the minimum necessary standard, give patients a Notice of Privacy Practices and honor patients' rights, such as access to their records.
- Security Rule: protect electronic PHI with administrative, physical and technical safeguards, starting with a risk analysis.
- Breach Notification Rule: notify affected individuals, HHS and in some cases the media after a breach of unsecured PHI.
- Business associate oversight: have a Business Associate Agreement in place with every vendor that creates, receives, maintains or transmits PHI on its behalf.
- Policies, training and documentation: written policies, workforce training and records of compliance activities.
Covered entity versus business associate
A business associate is a person or company that performs functions or services for a covered entity that involve PHI: a billing company, an IT provider, a cloud host, a texting platform, a revenue recovery tool. Business associates are directly liable for certain HIPAA requirements, but their obligations to the practice are set by the Business Associate Agreement.
The practice remains the covered entity. It decides what PHI is shared, with whom and why, and it stays responsible for choosing vendors that can protect that information. For more, see what is a business associate agreement? and does my vendor need a BAA?
Why it matters to an independent practice
Being a covered entity is not optional once the practice bills electronically, and enforcement does not depend on size. The HHS Office for Civil Rights enforces HIPAA against small practices as well as large systems.
Practically, the label shapes every technology decision. Each new tool that will touch patient data raises the same questions: Is this vendor a business associate? Will it sign a BAA before data moves? Will it receive only the minimum necessary? How is the data protected, and where is it stored? A practice that asks these questions every time is already doing much of the work HIPAA expects.
Common mistakes
- Assuming small practices are exempt. Size does not matter; electronic standard transactions do.
- Assuming outsourcing billing removes coverage. A billing company sending claims for you makes you covered, not exempt.
- Treating vendors as someone else's problem. The covered entity must have BAAs with its business associates.
- Skipping the risk analysis. The Security Rule expects one, and it should be updated as systems change.
- Confusing 'HIPAA certified' claims with compliance. There is no official HIPAA certification for vendors; ask for a signed BAA and specific safeguards instead.
A quick self-check
- Do we send claims, eligibility checks or other standard transactions electronically, ourselves or through a billing company? If yes, we are a covered entity.
- Do we have a current list of every vendor that touches PHI?
- Does each one have a signed BAA on file?
- When did we last complete a security risk analysis?
- Are our Notice of Privacy Practices and staff training current?
DocsMD works as your business associate
Your practice is the covered entity; DocsMD acts as a business associate and signs a Business Associate Agreement with every practice before any patient data moves, including for the free leak audit. Data is encrypted at rest and in transit and kept in U.S. data centers, and patient texts are minimum necessary. Read more on our HIPAA and BAA page and security page.
Questions
Is every doctor a HIPAA covered entity?
Not automatically. A provider is covered if it conducts HIPAA standard transactions electronically, such as electronic claims. Most practices that bill insurance are covered.
Is a billing company a covered entity?
Usually a billing company is a business associate of the practice. A company that converts claims between nonstandard and standard formats may be a health care clearinghouse, which is a covered entity.
Are software vendors covered entities?
Generally no. Vendors that handle PHI for a practice are business associates and must sign a BAA.
Does HIPAA apply to a cash-only practice?
A provider that never conducts standard transactions electronically may not be a covered entity, but state privacy laws and other obligations can still apply. Get advice specific to your situation.