What Is a HIPAA Covered Entity? Definition, Types, and Obligations

What Is a HIPAA Covered Entity

HIPAA uses the term “covered entity” to define which organizations the law applies to directly. The definition comes from 45 CFR § 160.103 and covers three distinct categories: health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically.

The practical trigger for most practices is that last phrase — “transmit electronically.” If your practice submits any electronic claims to Medicare, Medicaid, or a private insurer, you transmit health information electronically. That makes you a covered entity, regardless of your practice size, specialty, or how many patients you see.

The common assumption that HIPAA only applies to hospitals or large health systems is wrong. A solo family medicine physician, a two-person dental practice, and a behavioral health clinic with eight therapists are all covered entities if they bill electronically. In the United States, nearly every licensed healthcare provider is a covered entity.

The Three Types of Covered Entities

Health Plans

Health plans include any individual or group insurance plan, HMO, Medicare, Medicaid, Medicare supplement insurer, or long-term care insurer. Employer-sponsored health plans with 50 or more participants are also covered entities. The defining characteristic is that a health plan pays for or provides healthcare benefits.

Examples: Blue Cross Blue Shield, Aetna, UnitedHealth Group, Medicare Part A and B, state Medicaid programs, employer self-insured health plans with 50+ participants.

Healthcare Clearinghouses

Healthcare clearinghouses are entities that process nonstandard health information into standard electronic formats — or vice versa. They sit between providers and payers, translating billing data. Because they handle large volumes of PHI from many providers, they are covered entities themselves.

Examples: third-party billing companies that reformat claims, repricing companies, community health management information systems.

Healthcare Providers

This is the category that applies to most medical and dental practices. A healthcare provider is a covered entity if they transmit any health information electronically in connection with a transaction covered under HIPAA. Covered transactions include claims, eligibility inquiries, referral authorizations, and remittance advice.

Examples: physicians, surgeons, dentists, orthodontists, chiropractors, optometrists, podiatrists, psychologists, licensed counselors, physical therapists, occupational therapists, speech therapists, hospitals, urgent care centers, ambulatory surgery centers, pharmacies, nursing homes, and home health agencies.

The key word is “any.” A single electronic claim submission is sufficient.

How to Know If Your Practice Is a Covered Entity

Work through this checklist. If you answer yes to any of these, your practice is a covered entity:

• Do you submit claims electronically to Medicare or Medicaid?
• Do you submit claims electronically to any private insurer?
• Do you use a practice management system or billing software that submits claims on your behalf?
• Do you check patient eligibility electronically?
• Do you send or receive electronic remittance advice (ERA)?
• Do you request prior authorizations electronically?

If your practice uses a billing company to submit claims on your behalf, you are still the covered entity — the billing company is your business associate. The outsourcing does not transfer your HIPAA obligations.

The only healthcare providers who are not covered entities are those who operate entirely on cash, never submit any electronic claims, and have no payer relationships. This is rare in modern practice.

What Covered Entities Must Do

HIPAA compliance for covered entities is not optional and is not self-executing. The law requires specific, documented actions:

Annual security risk assessment. You must assess the risks to the confidentiality, integrity, and availability of all PHI your practice creates, receives, maintains, or transmits. This assessment must be documented. Lack of a risk assessment is the most common finding in OCR audits.

Written privacy and security policies. You need documented policies covering how PHI is used and disclosed, who has access, how breaches are handled, how workforce members are trained, and how patient rights are honored.

Workforce training. Every employee and contractor with access to PHI must receive HIPAA training. Training must be documented, including dates and which staff members completed it.

Business Associate Agreements. Every vendor that creates, receives, maintains, or transmits PHI on your behalf must sign a BAA before you share any patient data with them. This includes your EHR vendor, billing company, cloud storage provider, and any software platform that handles patient information. Using a vendor without a BAA is a HIPAA violation even if no breach occurs.

Breach notification. You must have a documented process for identifying, evaluating, and reporting breaches. Breaches affecting 500 or more individuals in a state must be reported to OCR and local media. Breaches of any size must be reported to affected patients within 60 days of discovery.

Privacy officer designation. HIPAA requires you to designate a privacy officer responsible for developing and implementing privacy policies. In a small practice this is often the practice administrator. The designation must be documented.

Business Associates vs. Covered Entities

The distinction matters because it determines who is directly regulated by HIPAA and what contracts are required.

A covered entity creates, receives, or transmits PHI as part of providing or paying for healthcare. HIPAA applies to covered entities directly.

A business associate is a person or entity that performs functions or services on behalf of a covered entity and, in doing so, creates, receives, maintains, or transmits PHI. Business associates are bound by HIPAA indirectly — through the BAA they sign with the covered entity, and through the HIPAA Omnibus Rule (2013), which extended direct liability to business associates.

Common business associates your practice likely has: EHR vendor, billing company, medical transcription service, IT support company with access to systems containing PHI, cloud storage provider, email service with patient communications, answering service that handles patient calls.

Your obligation as a covered entity: identify every vendor that touches PHI and execute a signed BAA before sharing any patient data. Keep a BAA log so you can produce evidence of signed agreements if OCR comes calling.

PHIGuard includes a signed BAA with every plan — no separate negotiation or legal review required. Every vendor you use to manage practice tasks should offer the same.