Covered Entity

What Is a Covered Entity?

A covered entity is an organization that must comply directly with HIPAA because of how it handles protected health information. The three types are healthcare providers who transmit health information electronically, health plans such as insurers, and healthcare clearinghouses. If your organization is a covered entity, HIPAA’s rules for protecting patient data apply to you directly.

How It Works

HIPAA defines three categories of covered entity. Healthcare providers, including doctors, clinics, dentists, and pharmacies, are covered entities when they transmit health information electronically, such as for billing or claims. Health plans, including health insurers, HMOs, and government programs like Medicare, are covered entities. Healthcare clearinghouses, which process health information between formats, make up the third category.

As a covered entity, your organization bears direct legal responsibility for protecting patient data under HIPAA’s Privacy, Security, and Breach Notification Rules. This includes safeguarding electronic protected health information, limiting who can access it, and reporting breaches when they occur.

Covered entities also carry responsibility for the vendors they work with. When a covered entity shares patient data with an outside vendor, known as a business associate, it must have a signed agreement in place first, and it retains obligations even when a vendor handles the data.

Why It Matters

Knowing whether you are a covered entity is the starting point for HIPAA compliance, because covered entities face the full weight of HIPAA’s requirements and its penalties. Many small practices do not realize the extent of their obligations until an audit or breach makes it clear. Understanding your status is what allows you to put the right protections and documentation in place before a problem arises.

Related Terms

• What Is a Business Associate?
• What Is HIPAA?
• What Is ePHI?
• What Is a Business Associate Agreement (BAA)?

For a complete guide, read our full article on the business associate agreement explained for medical practice owners.

SecTec helps covered entities meet their HIPAA obligations as part of our HIPAA compliance service.