Covered Entity

HIPAA does not apply to every organization that handles health data. It names three categories, and belonging to one of them triggers the full set of privacy and security duties. The test is functional: an organization qualifies because of what it does with health information, not because of its legal form or size.

Providers count only if they send health information electronically in standard transactions, such as claims and eligibility checks. A practice that bills entirely on paper does not meet the definition.

Many large organizations do both covered and non-covered work, such as a university with a teaching hospital or a retailer with pharmacies. HIPAA lets such an organization designate itself a hybrid entity. Only the components that perform covered functions, identified in writing as the health care component, are then treated as the covered entity.

Designation is not an escape hatch. A unit that bills claims electronically stays inside the boundary, because the duties follow the data. Functions performed purely as an employer, such as payroll, always stay outside.

The exclusions matter as much as the definition. Data that leaves the HIPAA world may fall under another legal regime, or under none. These are the most common exclusions:

• Employers acting as employers: Payroll and staff files are not PHI
• Workers' compensation carriers: Governed by state law and usually not health plans
• Life, auto, and disability insurers: They cover financial risk, not healthcare
• Most school and campus clinics: Records usually fall under FERPA, not HIPAA
• Paper-only providers: No electronic standard transactions. Rare today.

A covered entity and a business associate are the two central roles in HIPAA's data model. The difference is the direction of service. A covered entity acts in the healthcare relationship under its own name: it treats patients, pays claims, or processes standard transactions. A business associate works for a covered entity from outside its workforce, creating, receiving, maintaining, or transmitting PHI while performing a service such as billing, transcription, hosting, or accounting.

Since the HITECH Act, business associates answer directly to regulators for many requirements. The covered entity keeps its own duties, though: written assurances before PHI goes to a vendor, and notice after a vendor breach. One organization can hold both roles. A hospital that bills claims for a neighboring clinic is that clinic's business associate and remains a covered entity for its own patients.

The Privacy Rule governs what a covered entity may do with PHI and gives individuals rights over their own information. Core duties:

• Uses and disclosures: PHI can be used for treatment, payment, and healthcare operations without patient authorization. Most other purposes, such as marketing, sale of information, and much research, require written authorization.
• Minimum necessary: each use or disclosure is limited to the least PHI needed, with narrow exceptions such as transfers between providers for treatment.
• Notice of privacy practices: a written notice describes how the entity uses and discloses PHI. It is given to patients and available on request.
• Individual rights: access to records, amendment, an accounting of disclosures, restriction requests, and confidential communications.
• Administration: a designated privacy official, workforce training and sanctions, complaint handling, and safeguards proportionate to risk.

The Security Rule applies to electronic protected health information (ePHI). It requires a documented, risk-based program rather than a fixed checklist. The covered entity must run a periodic risk analysis and put in place administrative, physical, and technical safeguards. Technical safeguards include need-to-know access control, unique user identification, audit controls, integrity protection, and encryption of ePHI in transit and at rest.

The Breach Notification Rule adds a deadline-driven duty. The steps are:

1. 1

   Presume a breach

   An impermissible use or disclosure of unsecured PHI is presumed reportable.

2. 2

   Run a four-factor assessment

   The presumption stands unless a documented assessment shows a low probability of compromise.

3. 3

   Notify on time

   Notify individuals and the regulator without unreasonable delay, and no later than 60 days after discovery.

Start by checking which of the three categories applies, because every later duty depends on that answer. Then list the vendors that receive PHI and the confidentiality controls each one must meet. For a practical view of protecting patient data, see patient data protection for healthcare.