Definition
Covered entities are health plans, health care clearinghouses, and health care providers that transmit health information in electronic form in connection with a covered transaction.
In practice
- A provider that submits electronic claims may be a covered entity even if a clearinghouse handles the transmission.
- A technology company serving a hospital may be a business associate rather than a covered entity.
Who this applies to
- Health plans
- Health care clearinghouses
- Health care providers conducting covered electronic transactions
What the rule asks for
- Analyze the organization's legal role and covered electronic transactions.
- Do not decide coverage solely from whether an organization handles health information.
- Document the scope decision and consider other privacy, contract, or state-law obligations.
How teams put it into practice
- Ask what services the organization performs, for whom, and how transactions are conducted.
- Map affiliated entities separately where their legal roles or data flows differ.
- Revisit the analysis after acquisitions, new products, or new transaction types.
Common mistakes
- Assuming every wellness, life-science, or technology company is a covered entity.
- Assuming a provider is outside HIPAA because it uses paper in one workflow.
- Ignoring the business associate analysis when the covered-entity analysis is negative.
Questions that come up
Are employers covered entities?
An employer is generally not a covered entity merely because it sponsors a group health plan, although the plan itself may be a covered entity and the employer may have other obligations.
References
- Covered entities and business associates HHS Office for Civil Rights